Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/09/2026, 12:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ScreenConnect.ClientSetup.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
ScreenConnect.ClientSetup.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target ScreenConnect.ClientSetup.exe
- Size 11.1MB
- Sample260928-prrcfsvxfx
- SHA256 a0aaa48a09b7de1757174e1d71f2f971ebacb0b519df482fb31a490d03038941
- MD5 c367f434aa20c7309783ad1853f7260d
- SHA1 ad72caca510a6133f9053c007398271b7479b37c
- SHA512 6c4ba0c2f5fee32c6f93a3ac80970887402b48dc6699055895de9c6e2b49dfd4eb30806285208d96fa3d03b632966a0459c99daaab702771b6cf83db89794591
- SSDEEP 98304:FRDRs6efPwdpiTBNxNBWHxGS0h7276YpiTBNxNBWHbpiTBNxNBWHhpiTBNxNBWH/:FRdfefPwdK5oqyNK5sK5GK5MK5m
- TLSH T171C61201B3DA4979D5BF0A78E87A81549B35BC049B12C7AF53947D6D2D32BC08A323B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation ScreenConnect.ClientSetup.exe - Loads dropped DLL 11 IoCs
pid Process 220 MsiExec.exe 3036 rundll32.exe 3036 rundll32.exe 3036 rundll32.exe 3036 rundll32.exe 3036 rundll32.exe 3036 rundll32.exe 3036 rundll32.exe 3036 rundll32.exe 3036 rundll32.exe 4204 MsiExec.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 7 2056 msiexec.exe - Enumerates connected drives 3 TTPs 47 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe \??\F:\ msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\app.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\system.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\Installer\e58f411.msi msiexec.exe File created C:\Windows\Installer\{214C861F-E4D9-F428-F022-51C030021EFF}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Installer\{214C861F-E4D9-F428-F022-51C030021EFF}\DefaultIcon msiexec.exe File created C:\Windows\Installer\e58f40f.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIF577.tmp msiexec.exe File opened for modification C:\Windows\Installer\e58f40f.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{214C861F-E4D9-F428-F022-51C030021EFF} msiexec.exe File opened for modification C:\Windows\Installer\MSIF5A7.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientSetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e01e56c99d3b8eb00000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e01e56c90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e01e56c9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae01e56c9000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de01e56c9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 32 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-6ff96698ab19e7f2\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-6ff96698ab19e7f2\shell\open msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-6ff96698ab19e7f2\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\ProductName = "ScreenConnect Client (6ff96698ab19e7f2)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\SourceList\PackageName = "ScreenConnect.ClientSetup.msi" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-6ff96698ab19e7f2 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-6ff96698ab19e7f2 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F168C4129D4E824F0F22150C0320E1FF msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\InstanceType = "0" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.8.0.9440\\6ff96698ab19e7f2\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\DeploymentFlags = "3" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\SourceList\Net msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\PackageCode = "F168C4129D4E824F0F22150C0320E1FF" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\ProductIcon = "C:\\Windows\\Installer\\{214C861F-E4D9-F428-F022-51C030021EFF}\\DefaultIcon" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3B26F3E9A0495A72F69F6689BA917E2F msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3B26F3E9A0495A72F69F6689BA917E2F\F168C4129D4E824F0F22150C0320E1FF msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.8.0.9440\\6ff96698ab19e7f2\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-6ff96698ab19e7f2\UseOriginalUrlEncoding = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-6ff96698ab19e7f2\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (6ff96698ab19e7f2)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F168C4129D4E824F0F22150C0320E1FF\Full msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\Version = "419954688" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-6ff96698ab19e7f2\URL Protocol msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-6ff96698ab19e7f2\shell msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1828 msiexec.exe 1828 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1648 ScreenConnect.ClientSetup.exe Token: SeShutdownPrivilege 2056 msiexec.exe Token: SeIncreaseQuotaPrivilege 2056 msiexec.exe Token: SeSecurityPrivilege 1828 msiexec.exe Token: SeCreateTokenPrivilege 2056 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2056 msiexec.exe Token: SeLockMemoryPrivilege 2056 msiexec.exe Token: SeIncreaseQuotaPrivilege 2056 msiexec.exe Token: SeMachineAccountPrivilege 2056 msiexec.exe Token: SeTcbPrivilege 2056 msiexec.exe Token: SeSecurityPrivilege 2056 msiexec.exe Token: SeTakeOwnershipPrivilege 2056 msiexec.exe Token: SeLoadDriverPrivilege 2056 msiexec.exe Token: SeSystemProfilePrivilege 2056 msiexec.exe Token: SeSystemtimePrivilege 2056 msiexec.exe Token: SeProfSingleProcessPrivilege 2056 msiexec.exe Token: SeIncBasePriorityPrivilege 2056 msiexec.exe Token: SeCreatePagefilePrivilege 2056 msiexec.exe Token: SeCreatePermanentPrivilege 2056 msiexec.exe Token: SeBackupPrivilege 2056 msiexec.exe Token: SeRestorePrivilege 2056 msiexec.exe Token: SeShutdownPrivilege 2056 msiexec.exe Token: SeDebugPrivilege 2056 msiexec.exe Token: SeAuditPrivilege 2056 msiexec.exe Token: SeSystemEnvironmentPrivilege 2056 msiexec.exe Token: SeChangeNotifyPrivilege 2056 msiexec.exe Token: SeRemoteShutdownPrivilege 2056 msiexec.exe Token: SeUndockPrivilege 2056 msiexec.exe Token: SeSyncAgentPrivilege 2056 msiexec.exe Token: SeEnableDelegationPrivilege 2056 msiexec.exe Token: SeManageVolumePrivilege 2056 msiexec.exe Token: SeImpersonatePrivilege 2056 msiexec.exe Token: SeCreateGlobalPrivilege 2056 msiexec.exe Token: SeCreateTokenPrivilege 2056 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2056 msiexec.exe Token: SeLockMemoryPrivilege 2056 msiexec.exe Token: SeIncreaseQuotaPrivilege 2056 msiexec.exe Token: SeMachineAccountPrivilege 2056 msiexec.exe Token: SeTcbPrivilege 2056 msiexec.exe Token: SeSecurityPrivilege 2056 msiexec.exe Token: SeTakeOwnershipPrivilege 2056 msiexec.exe Token: SeLoadDriverPrivilege 2056 msiexec.exe Token: SeSystemProfilePrivilege 2056 msiexec.exe Token: SeSystemtimePrivilege 2056 msiexec.exe Token: SeProfSingleProcessPrivilege 2056 msiexec.exe Token: SeIncBasePriorityPrivilege 2056 msiexec.exe Token: SeCreatePagefilePrivilege 2056 msiexec.exe Token: SeCreatePermanentPrivilege 2056 msiexec.exe Token: SeBackupPrivilege 2056 msiexec.exe Token: SeRestorePrivilege 2056 msiexec.exe Token: SeShutdownPrivilege 2056 msiexec.exe Token: SeDebugPrivilege 2056 msiexec.exe Token: SeAuditPrivilege 2056 msiexec.exe Token: SeSystemEnvironmentPrivilege 2056 msiexec.exe Token: SeChangeNotifyPrivilege 2056 msiexec.exe Token: SeRemoteShutdownPrivilege 2056 msiexec.exe Token: SeUndockPrivilege 2056 msiexec.exe Token: SeSyncAgentPrivilege 2056 msiexec.exe Token: SeEnableDelegationPrivilege 2056 msiexec.exe Token: SeManageVolumePrivilege 2056 msiexec.exe Token: SeImpersonatePrivilege 2056 msiexec.exe Token: SeCreateGlobalPrivilege 2056 msiexec.exe Token: SeCreateTokenPrivilege 2056 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2056 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2056 msiexec.exe 2056 msiexec.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1648 wrote to memory of 2056 1648 ScreenConnect.ClientSetup.exe 89 PID 1828 wrote to memory of 220 1828 msiexec.exe 92 PID 220 wrote to memory of 3036 220 MsiExec.exe 93 PID 1828 wrote to memory of 2944 1828 msiexec.exe 104 PID 1828 wrote to memory of 4204 1828 msiexec.exe 106 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe"C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.8.0.9440\6ff96698ab19e7f2\ScreenConnect.ClientSetup.msi"2⤵
- Badlisted process makes network request
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2056
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4946D3359805791AA44ECCBB32891610 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIC474.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240698531 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3036
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2944
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0054410336A3DF0E624C65AF77EE83A32⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4204
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1776
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58f410.rbs
- Size 9KB
- SHA256 259cfac3a00734ece51bbb521fb9b5ccd30ec0ad1afff93b21f0a50761629106
- MD5 e6bab81e8913046c9eb5b306f034915a
- SHA1 3ce46241f4bb99dd6b242f7d1ea03750ead69008
- SHA512 61f78d8f05a57e77fa1379297fc0c15c08a4de53543baec5c7ddb9f5d6230de2749177580228652a350845e20668af8c45c61b0d61ce273e549ec2efaaef331e
- SSDEEP 96:3VKr+z0bIg6TOH4GsHIQWYeeLlIUt9PRCsThquUt9PRC6jTcAYThqOHR459JDAxf:3gQMdYeUnLkIELkHSG54pQ
- TLSH T181223C10360061E1FAA64A7ED7135E643BB99EE55322338FD4CC59385F52B884BBD0FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIC474.tmp
- Size 1.1MB
- SHA256 cb73cb9f2dab77790dd09267fd53cfc67824f4b626b0df739732f79e9a428016
- MD5 a0d8201bd0f20e010ff95bace2e90982
- SHA1 f87c6e37f061655ca44122fdcb73f38c3e4eccf7
- SHA512 4f4f4992824d0a987cea54316e0af11fde6158843e5f5ad9aab8e141d9ce45944136d51415f91f043a8166cd017adfbda921f378aa3fcdc4642e844c5398a841
- SSDEEP 12288:FUUa/hkHVyAXiel5dzt1sNmgyFe642O8fDytplOCKYnJmIVs+DQbjuyiToZwtMAZ:FUUGGHVRl3cNmBFDVm/5Mt7CZpvjkWUK
- TLSH T17F3523203A94C936F1E52532AE78B3B119BD75626F30D18F675D271D1EA03C0DABA363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIC474.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 172KB
- SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
- MD5 5ef88919012e4a3d8a1e2955dc8c8d81
- SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
- SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
- SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
- TLSH T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIC474.tmp-\ScreenConnect.Core.dll
- Size 543KB
- SHA256 619de6b81b8055ee249b00df1150da82c2e97e6c54f3f4686f483ff8718a59f6
- MD5 490ef2cee6c1d8073c3d11bf89c4d2c7
- SHA1 d82d6e5d33d4f36b8ce73b503cdfc10b323fc319
- SHA512 5dc1d1a9072079cef74d1741d286163d990709e5ffb24cb3d499779decd256d4fe4550455b0c686c38c10be8c8d47a9239b2432a10d90fd6991ec4a7d108cb3c
- SSDEEP 12288:vx6Uvha0XYZB2N/R6qIs22VF/sbbGHEznI:DhXBJF/sEEzn
- TLSH T187C45C1333E8873AC67F0BBAF120D9154671E911B30AE75B1A9AF4E52D823894D4C7E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIC474.tmp-\ScreenConnect.InstallerActions.dll
- Size 11KB
- SHA256 2948a737ef6199d0fd348c767df0312a8f881d7ed13719af7c3aa5ae363299e3
- MD5 471396a9b173fb65689cc2b96abe711b
- SHA1 fae570b66d1a2f48115f908fc9c28454e513a512
- SHA512 4fc04a3c335eeb1acda057143aa5f84e9f88d2d32ddeec7b9a138c373242bf505fdfaab9750680cfb3d85a67acf4c096800baa752fdd74bf362bea34ef821ced
- SSDEEP 192:s8/Qp6lCJuV3jcXtyVNamVNG1YZfCrMmbfHJ7kjvLobuLd9NEFbAJE:h/cBJaQXt2NaheUrMmb/FkjvLobuZVE
- TLSH T1FB32C60077EC933AE8BE0F799AB762910671EB74A011DF2E18C851569C367449EA07B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIC474.tmp-\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 001f46a4c1ef3f09e0842acd0dc8975424dc01b87736b1176e785ac9721e0c08
- MD5 14db78fec8c3192d1972ea193d55e744
- SHA1 29b1025d6cda61759d36b52c86765f22b888d252
- SHA512 5e92fab1ccd35d7b5ef6cee5aa938b8d2d9075212496d0e9523def24e9690de75dc609a395c8d3b2fc9cd526e9c683876a1ea6d23e54889e5fb55ad5ea3b8d8d
- SSDEEP 24576:+RpiFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:kpiJkGYYpT0+TFiH7efP
- TLSH T1D585BD41E2C365F5D46B047888BF572AAA743C080325CAFB97D4BE396D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.8.0.9440\6ff96698ab19e7f2\ScreenConnect.ClientSetup.msi
- Size 8.7MB
- SHA256 ddcb689b6a98cb5db12e65e1a9bcb97727c1972a7b264daeba80225287c55fba
- MD5 d31c9c64ba2073b5320ec0849f59da7a
- SHA1 a98d7b452c14aa2865273f1b89ef4937b3ce6822
- SHA512 1f5892bacac711365ce6fb9b823cf0a21b1fb88e5660a8dfd90e297a2d44ccf2540d5959bf6cbe3891f4fc168dae34766e3b31d2093fbeec0c4d117965d02bd5
- SSDEEP 98304:RpiTBNxNBWHxGS0h7276YpiTBNxNBWHbpiTBNxNBWHhpiTBNxNBWHtpiTBNxNBWH:RK5oqyNK5sK5GK5MK5
- TLSH T15996236167EE8929F1F71F71F97A44E05A3A7C65ED22C00F9325395E29B0E8081B2377
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIF5A7.tmp
- Size 202KB
- SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
- MD5 ba84dd4e0c1408828ccc1de09f585eda
- SHA1 e8e10065d479f8f591b9885ea8487bc673301298
- SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
- SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
- TLSH T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 90d620e1c1b32bdfbf8cd3908c5dea7d2167396e450f42bfa3af730a922dac34
- MD5 62483cf29d2a64b63052c9c3c83cfc4c
- SHA1 7436151ef7ab0ebf0d49263018ef5a7c7408c456
- SHA512 a6ef053c4453d88181e61d521511d52c3d0ae194ccb18a91f298e9854ce9a2bc9d2c32204ca4cffa2a40becf06c024f424553d7f6f798d169d8898a2edb6af64
- SSDEEP 24576:ju8m+1zFdoO/vvTLb2t+oGqZc0UjVVdSBLGtPic1l0asOqEgIP1UlbGRI:d
- TLSH T19D47A3243AF92110E7B79E3C6CF0AA234D3A7D5B9C199E8D45411F4E0921FB0E972F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c9561ee0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{202e6268-94b5-4c23-adfe-b3a93897f150}_OnDiskSnapshotProp
- Size 6KB
- SHA256 96d0a95999c2eaf7c3702247fcc091234b1de42365cb7ac762351a447679e061
- MD5 014b48ec88c5734a0b6444a8b88ab656
- SHA1 0fee4cc324c790a24a98fc7ca176a38a84b3c773
- SHA512 ff38aae1f306fb0d0a1f22a89380d53bc99e379431015084659c296069ee6f45e44412f577d08880363b33893d6c1423b21b859f156d8024f2f0c9d324a17b80
- SSDEEP 96:F7RfIRvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:rWb++ZVm
- TLSH T1B9D189085AE54311E2B3AB312DF18557A877B811EF33CB8E0298638E2671A10F975F5F
- MD5 SHA1 SHA512 SSDEEP TLSH