Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/09/2026, 12:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ScreenConnect.ClientSetup.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
ScreenConnect.ClientSetup.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target ScreenConnect.ClientSetup.exe
- Size 11.1MB
- Sample260928-prrcfsvxfx
- SHA256 a0aaa48a09b7de1757174e1d71f2f971ebacb0b519df482fb31a490d03038941
- MD5 c367f434aa20c7309783ad1853f7260d
- SHA1 ad72caca510a6133f9053c007398271b7479b37c
- SHA512 6c4ba0c2f5fee32c6f93a3ac80970887402b48dc6699055895de9c6e2b49dfd4eb30806285208d96fa3d03b632966a0459c99daaab702771b6cf83db89794591
- SSDEEP 98304:FRDRs6efPwdpiTBNxNBWHxGS0h7276YpiTBNxNBWHbpiTBNxNBWHhpiTBNxNBWH/:FRdfefPwdK5oqyNK5sK5GK5MK5m
- TLSH T171C61201B3DA4979D5BF0A78E87A81549B35BC049B12C7AF53947D6D2D32BC08A323B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 11 IoCs
pid Process 4684 MsiExec.exe 1556 rundll32.exe 1556 rundll32.exe 1556 rundll32.exe 1556 rundll32.exe 1556 rundll32.exe 1556 rundll32.exe 1556 rundll32.exe 1556 rundll32.exe 1556 rundll32.exe 3016 MsiExec.exe - Enumerates connected drives 3 TTPs 47 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe \??\F:\ msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\system.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ff96698ab19e7f2)\app.config msiexec.exe - Drops file in Windows directory 15 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{214C861F-E4D9-F428-F022-51C030021EFF} msiexec.exe File opened for modification C:\Windows\Installer\MSI8EAB.tmp msiexec.exe File opened for modification C:\Windows\Installer\{214C861F-E4D9-F428-F022-51C030021EFF}\DefaultIcon msiexec.exe File created C:\Windows\SystemTemp\~DFBEDF5795C9C25E52.TMP msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI8E8A.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF7166A676A8BD0A2A.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\e598804.msi msiexec.exe File created C:\Windows\Installer\{214C861F-E4D9-F428-F022-51C030021EFF}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Installer\e598802.msi msiexec.exe File created C:\Windows\SystemTemp\~DFE327AA29A9B52A52.TMP msiexec.exe File created C:\Windows\Installer\e598802.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF424B207FB4AD8402.TMP msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientSetup.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000002fc1fe242d8ae0d60000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838012fc1fe240000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841012fc1fe24000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e32fc1fe2400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e62fc1fe2400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 32 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-6ff96698ab19e7f2\URL Protocol msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-6ff96698ab19e7f2\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F168C4129D4E824F0F22150C0320E1FF msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3B26F3E9A0495A72F69F6689BA917E2F msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-6ff96698ab19e7f2\UseOriginalUrlEncoding = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\PackageCode = "F168C4129D4E824F0F22150C0320E1FF" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\3B26F3E9A0495A72F69F6689BA917E2F\F168C4129D4E824F0F22150C0320E1FF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-6ff96698ab19e7f2 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-6ff96698ab19e7f2 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F168C4129D4E824F0F22150C0320E1FF\Full msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\Version = "419954688" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\SourceList\PackageName = "ScreenConnect.ClientSetup.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.8.0.9440\\6ff96698ab19e7f2\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\ProductName = "ScreenConnect Client (6ff96698ab19e7f2)" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\SourceList\Media msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-6ff96698ab19e7f2\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\ProductIcon = "C:\\Windows\\Installer\\{214C861F-E4D9-F428-F022-51C030021EFF}\\DefaultIcon" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\25.8.0.9440\\6ff96698ab19e7f2\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-6ff96698ab19e7f2\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-6ff96698ab19e7f2\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-6ff96698ab19e7f2\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (6ff96698ab19e7f2)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F168C4129D4E824F0F22150C0320E1FF\SourceList msiexec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4112 msiexec.exe 4112 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3844 ScreenConnect.ClientSetup.exe Token: SeShutdownPrivilege 2172 msiexec.exe Token: SeIncreaseQuotaPrivilege 2172 msiexec.exe Token: SeSecurityPrivilege 4112 msiexec.exe Token: SeCreateTokenPrivilege 2172 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2172 msiexec.exe Token: SeLockMemoryPrivilege 2172 msiexec.exe Token: SeIncreaseQuotaPrivilege 2172 msiexec.exe Token: SeMachineAccountPrivilege 2172 msiexec.exe Token: SeTcbPrivilege 2172 msiexec.exe Token: SeSecurityPrivilege 2172 msiexec.exe Token: SeTakeOwnershipPrivilege 2172 msiexec.exe Token: SeLoadDriverPrivilege 2172 msiexec.exe Token: SeSystemProfilePrivilege 2172 msiexec.exe Token: SeSystemtimePrivilege 2172 msiexec.exe Token: SeProfSingleProcessPrivilege 2172 msiexec.exe Token: SeIncBasePriorityPrivilege 2172 msiexec.exe Token: SeCreatePagefilePrivilege 2172 msiexec.exe Token: SeCreatePermanentPrivilege 2172 msiexec.exe Token: SeBackupPrivilege 2172 msiexec.exe Token: SeRestorePrivilege 2172 msiexec.exe Token: SeShutdownPrivilege 2172 msiexec.exe Token: SeDebugPrivilege 2172 msiexec.exe Token: SeAuditPrivilege 2172 msiexec.exe Token: SeSystemEnvironmentPrivilege 2172 msiexec.exe Token: SeChangeNotifyPrivilege 2172 msiexec.exe Token: SeRemoteShutdownPrivilege 2172 msiexec.exe Token: SeUndockPrivilege 2172 msiexec.exe Token: SeSyncAgentPrivilege 2172 msiexec.exe Token: SeEnableDelegationPrivilege 2172 msiexec.exe Token: SeManageVolumePrivilege 2172 msiexec.exe Token: SeImpersonatePrivilege 2172 msiexec.exe Token: SeCreateGlobalPrivilege 2172 msiexec.exe Token: SeCreateTokenPrivilege 2172 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2172 msiexec.exe Token: SeLockMemoryPrivilege 2172 msiexec.exe Token: SeIncreaseQuotaPrivilege 2172 msiexec.exe Token: SeMachineAccountPrivilege 2172 msiexec.exe Token: SeTcbPrivilege 2172 msiexec.exe Token: SeSecurityPrivilege 2172 msiexec.exe Token: SeTakeOwnershipPrivilege 2172 msiexec.exe Token: SeLoadDriverPrivilege 2172 msiexec.exe Token: SeSystemProfilePrivilege 2172 msiexec.exe Token: SeSystemtimePrivilege 2172 msiexec.exe Token: SeProfSingleProcessPrivilege 2172 msiexec.exe Token: SeIncBasePriorityPrivilege 2172 msiexec.exe Token: SeCreatePagefilePrivilege 2172 msiexec.exe Token: SeCreatePermanentPrivilege 2172 msiexec.exe Token: SeBackupPrivilege 2172 msiexec.exe Token: SeRestorePrivilege 2172 msiexec.exe Token: SeShutdownPrivilege 2172 msiexec.exe Token: SeDebugPrivilege 2172 msiexec.exe Token: SeAuditPrivilege 2172 msiexec.exe Token: SeSystemEnvironmentPrivilege 2172 msiexec.exe Token: SeChangeNotifyPrivilege 2172 msiexec.exe Token: SeRemoteShutdownPrivilege 2172 msiexec.exe Token: SeUndockPrivilege 2172 msiexec.exe Token: SeSyncAgentPrivilege 2172 msiexec.exe Token: SeEnableDelegationPrivilege 2172 msiexec.exe Token: SeManageVolumePrivilege 2172 msiexec.exe Token: SeImpersonatePrivilege 2172 msiexec.exe Token: SeCreateGlobalPrivilege 2172 msiexec.exe Token: SeCreateTokenPrivilege 2172 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2172 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2172 msiexec.exe 2172 msiexec.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2172 msiexec.exe 4112 msiexec.exe 4684 MsiExec.exe 3016 MsiExec.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3844 wrote to memory of 2172 3844 ScreenConnect.ClientSetup.exe 89 PID 4112 wrote to memory of 4684 4112 msiexec.exe 91 PID 4684 wrote to memory of 1556 4684 MsiExec.exe 92 PID 4112 wrote to memory of 2360 4112 msiexec.exe 97 PID 4112 wrote to memory of 3016 4112 msiexec.exe 99 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe"C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.8.0.9440\6ff96698ab19e7f2\ScreenConnect.ClientSetup.msi"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2172
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 95BD9849507CA0B1495CDE0F14C12554 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI384C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240728421 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1556
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2360
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 28937B267D29F2BB63F93D04D14CA0262⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3016
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:3356
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e598803.rbs
- Size 9KB
- SHA256 b547d455e8f60676374ecb1254d9fa1affeae9d8c52992a5426ceb70c1dca981
- MD5 a68e64d5e66dc11b37867dc4c103eef7
- SHA1 dac0e921186fc96708c45e927ff971557c6e3407
- SHA512 b9c385dae4c68fdabd59881d57cb43d7da7a81204524d9690a5b0d61314fa18c6eedc950e54cde74bc01291fbc31f258c6801e1ccaeff05650983ca428201b66
- SSDEEP 96:/VKr3z0bIg6TMp4GsfIQWJCDMlIUt9PRCsThquUt9PRC6jTcAYThqOHh459JDAxf:/5QkdJCMnLkIELkHyG54pQ
- TLSH T13B222C10360060E1FAA64E7AD7135E643BB99EE55322338FD4CC59385F52B884BBD1FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI384C.tmp
- Size 1.1MB
- SHA256 cb73cb9f2dab77790dd09267fd53cfc67824f4b626b0df739732f79e9a428016
- MD5 a0d8201bd0f20e010ff95bace2e90982
- SHA1 f87c6e37f061655ca44122fdcb73f38c3e4eccf7
- SHA512 4f4f4992824d0a987cea54316e0af11fde6158843e5f5ad9aab8e141d9ce45944136d51415f91f043a8166cd017adfbda921f378aa3fcdc4642e844c5398a841
- SSDEEP 12288:FUUa/hkHVyAXiel5dzt1sNmgyFe642O8fDytplOCKYnJmIVs+DQbjuyiToZwtMAZ:FUUGGHVRl3cNmBFDVm/5Mt7CZpvjkWUK
- TLSH T17F3523203A94C936F1E52532AE78B3B119BD75626F30D18F675D271D1EA03C0DABA363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI384C.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 172KB
- SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
- MD5 5ef88919012e4a3d8a1e2955dc8c8d81
- SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
- SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
- SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
- TLSH T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI384C.tmp-\ScreenConnect.Core.dll
- Size 543KB
- SHA256 619de6b81b8055ee249b00df1150da82c2e97e6c54f3f4686f483ff8718a59f6
- MD5 490ef2cee6c1d8073c3d11bf89c4d2c7
- SHA1 d82d6e5d33d4f36b8ce73b503cdfc10b323fc319
- SHA512 5dc1d1a9072079cef74d1741d286163d990709e5ffb24cb3d499779decd256d4fe4550455b0c686c38c10be8c8d47a9239b2432a10d90fd6991ec4a7d108cb3c
- SSDEEP 12288:vx6Uvha0XYZB2N/R6qIs22VF/sbbGHEznI:DhXBJF/sEEzn
- TLSH T187C45C1333E8873AC67F0BBAF120D9154671E911B30AE75B1A9AF4E52D823894D4C7E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI384C.tmp-\ScreenConnect.InstallerActions.dll
- Size 11KB
- SHA256 2948a737ef6199d0fd348c767df0312a8f881d7ed13719af7c3aa5ae363299e3
- MD5 471396a9b173fb65689cc2b96abe711b
- SHA1 fae570b66d1a2f48115f908fc9c28454e513a512
- SHA512 4fc04a3c335eeb1acda057143aa5f84e9f88d2d32ddeec7b9a138c373242bf505fdfaab9750680cfb3d85a67acf4c096800baa752fdd74bf362bea34ef821ced
- SSDEEP 192:s8/Qp6lCJuV3jcXtyVNamVNG1YZfCrMmbfHJ7kjvLobuLd9NEFbAJE:h/cBJaQXt2NaheUrMmb/FkjvLobuZVE
- TLSH T1FB32C60077EC933AE8BE0F799AB762910671EB74A011DF2E18C851569C367449EA07B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI384C.tmp-\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 001f46a4c1ef3f09e0842acd0dc8975424dc01b87736b1176e785ac9721e0c08
- MD5 14db78fec8c3192d1972ea193d55e744
- SHA1 29b1025d6cda61759d36b52c86765f22b888d252
- SHA512 5e92fab1ccd35d7b5ef6cee5aa938b8d2d9075212496d0e9523def24e9690de75dc609a395c8d3b2fc9cd526e9c683876a1ea6d23e54889e5fb55ad5ea3b8d8d
- SSDEEP 24576:+RpiFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:kpiJkGYYpT0+TFiH7efP
- TLSH T1D585BD41E2C365F5D46B047888BF572AAA743C080325CAFB97D4BE396D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.8.0.9440\6ff96698ab19e7f2\ScreenConnect.ClientSetup.msi
- Size 8.7MB
- SHA256 ddcb689b6a98cb5db12e65e1a9bcb97727c1972a7b264daeba80225287c55fba
- MD5 d31c9c64ba2073b5320ec0849f59da7a
- SHA1 a98d7b452c14aa2865273f1b89ef4937b3ce6822
- SHA512 1f5892bacac711365ce6fb9b823cf0a21b1fb88e5660a8dfd90e297a2d44ccf2540d5959bf6cbe3891f4fc168dae34766e3b31d2093fbeec0c4d117965d02bd5
- SSDEEP 98304:RpiTBNxNBWHxGS0h7276YpiTBNxNBWHbpiTBNxNBWHhpiTBNxNBWHtpiTBNxNBWH:RK5oqyNK5sK5GK5MK5
- TLSH T15996236167EE8929F1F71F71F97A44E05A3A7C65ED22C00F9325395E29B0E8081B2377
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI8EAB.tmp
- Size 202KB
- SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
- MD5 ba84dd4e0c1408828ccc1de09f585eda
- SHA1 e8e10065d479f8f591b9885ea8487bc673301298
- SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
- SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
- TLSH T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 5ba74e45273a4c08536218de50ab82f917e869c1c2bf2db2926d73d113308154
- MD5 a40dfff5a4f8483312f010987f22d6ef
- SHA1 1d7b530632f41922aa7b512175c0eaad5bcd2fde
- SHA512 df18bab6bbdc607741889d86e329d3064f6870e8c1a7999de2e763a28ceb067ba4c6cef0ff6b761528d7cdceef9db2b6191630b5ac7d33f7a8f8f42d559102b6
- SSDEEP 24576:ZFo3DMPkdoO/vvTL/SghxClQfLu7KrWCkMHjdMP5HkvapWwxMYxWRorg1eJ:IHg
- TLSH T18457B31836F92101E7B7DE3DA8F0AA234D397D5B9C16DE8D05811B4E0861F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{24fec12f-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{cc6e5d00-deb2-4dc9-af67-6a28e77948cc}_OnDiskSnapshotProp
- Size 6KB
- SHA256 978587c11e1ffc32e493f39e45e8efe85386a6aca90fc441826f973eb9a0ef46
- MD5 62014e4821db9c0ed559c545cb3c2433
- SHA1 81af1c69c02bc1c50f48edbb5884ee4ac4ebc661
- SHA512 b6231578b1dbe780e288c5fff7eccca42d251d7f1218b9987df3d11f94317aa7620fcf0973e74b8e4a0865ce2087db3fc9c3512f2871c5559e38fad293b4ab6f
- SSDEEP 96:FuU2vvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:QHb++uVm
- TLSH T156D1890C5AE54311E2B3AB7128F18557A877B911FF33CB8E0194238E6671910F875F6B
- MD5 SHA1 SHA512 SSDEEP TLSH