URL:

https://secureconnect.honeywellcloud.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest&c=AUB%20Bank&c=Bahrain&c=Sayed%20Hussain&c=E482322&c=Sayed.Hussain%40Honeywell.com&c=KSA-EBI-META&c=&c=

Full analysis: https://app.any.run/tasks/4b1eca19-7b99-4b1f-b4ab-dafbc445604e
Verdict: Malicious activity
Analysis date: November 26, 2023, 10:36:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
screenconnect
remote
Indicators:
SHA1:

08777B3FBFC9EB3E904936ACDA1A96346408D074

SHA256:

83445B9BB07DABC76745608D064C20C1D25337C0DCE47759865E34E99C97BD6E

SSDEEP:

6:2Z2L1cuZcFKCF/G5AWYP21kTo7QGYgkZMIMLltY:2Z2L1mFg5AL2aRjZUhq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 2316)

    • Creates a writable file in the system directory

      • ScreenConnect.ClientService.exe (PID: 3172)

    • Connects to the CnC server

      • ScreenConnect.ClientService.exe (PID: 3172)

    • SCREENCONNECT has been detected (SURICATA)

      • ScreenConnect.ClientService.exe (PID: 3172)

  • SUSPICIOUS

    • Reads the Internet Settings

      • ScreenConnect.ClientSetup.exe (PID: 3924)
      • ScreenConnect.WindowsClient.exe (PID: 1872)

    • Uses RUNDLL32.EXE to load library

      • msiexec.exe (PID: 3208)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2072)
      • ScreenConnect.ClientService.exe (PID: 3172)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 2316)

    • Creates or modifies Windows services

      • ScreenConnect.ClientService.exe (PID: 3172)

  • INFO

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2820)

    • Application launched itself

      • iexplore.exe (PID: 2856)
      • msiexec.exe (PID: 2316)

    • Reads the computer name

      • wmpnscfg.exe (PID: 2820)
      • ScreenConnect.ClientSetup.exe (PID: 3924)
      • msiexec.exe (PID: 2316)
      • msiexec.exe (PID: 3208)
      • msiexec.exe (PID: 3600)
      • msiexec.exe (PID: 3944)
      • ScreenConnect.ClientService.exe (PID: 3172)
      • ScreenConnect.WindowsClient.exe (PID: 2904)
      • ScreenConnect.WindowsClient.exe (PID: 1872)

    • Checks supported languages

      • wmpnscfg.exe (PID: 2820)
      • ScreenConnect.ClientSetup.exe (PID: 3924)
      • msiexec.exe (PID: 2316)
      • msiexec.exe (PID: 3208)
      • msiexec.exe (PID: 3944)
      • msiexec.exe (PID: 3600)
      • ScreenConnect.ClientService.exe (PID: 3172)
      • ScreenConnect.WindowsClient.exe (PID: 1872)
      • ScreenConnect.WindowsClient.exe (PID: 2904)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 2820)
      • ScreenConnect.ClientSetup.exe (PID: 3924)
      • msiexec.exe (PID: 2316)
      • msiexec.exe (PID: 3944)
      • msiexec.exe (PID: 3600)
      • ScreenConnect.ClientService.exe (PID: 3172)
      • msiexec.exe (PID: 3208)
      • ScreenConnect.WindowsClient.exe (PID: 1872)
      • ScreenConnect.WindowsClient.exe (PID: 2904)

    • The process uses the downloaded file

      • iexplore.exe (PID: 2856)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 2856)
      • msiexec.exe (PID: 1360)
      • rundll32.exe (PID: 3396)
      • iexplore.exe (PID: 3024)

    • Create files in a temporary directory

      • ScreenConnect.ClientSetup.exe (PID: 3924)
      • rundll32.exe (PID: 3396)
      • msiexec.exe (PID: 2316)

    • Reads CPU info

      • ScreenConnect.WindowsClient.exe (PID: 2904)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
15
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe wmpnscfg.exe no specs screenconnect.clientsetup.exe no specs screenconnect.clientsetup.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs rundll32.exe no specs vssvc.exe no specs msiexec.exe no specs msiexec.exe no specs #SCREENCONNECT screenconnect.clientservice.exe screenconnect.windowsclient.exe no specs screenconnect.windowsclient.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1360"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\ScreenConnect\fb4c833997b10f3b\setup.msi"C:\Windows\System32\msiexec.exe—ScreenConnect.ClientSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1872"C:\Program Files\ScreenConnect Client (fb4c833997b10f3b)\ScreenConnect.WindowsClient.exe" "RunRole" "d15408fe-a728-4923-aeaa-efc23cb5b5cf" "User"C:\Program Files\ScreenConnect Client (fb4c833997b10f3b)\ScreenConnect.WindowsClient.exe—ScreenConnect.ClientService.exe
User:
admin
Company:
ScreenConnect Software
Integrity Level:
MEDIUM
Description:
ScreenConnect Client
Exit code:
0
Version:
23.8.1.8686
Modules
Images
c:\program files\screenconnect client (fb4c833997b10f3b)\screenconnect.windowsclient.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2072C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2316C:\Windows\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2432"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\ScreenConnect.ClientSetup.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\ScreenConnect.ClientSetup.exe—iexplore.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\78rfyb7z\screenconnect.clientsetup.exe
c:\windows\system32\ntdll.dll
2820"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
2856"C:\Program Files\Internet Explorer\iexplore.exe" "https://secureconnect.honeywellcloud.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest&c=AUB%20Bank&c=Bahrain&c=Sayed%20Hussain&c=E482322&c=Sayed.Hussain%40Honeywell.com&c=KSA-EBI-META&c=&c="C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2904"C:\Program Files\ScreenConnect Client (fb4c833997b10f3b)\ScreenConnect.WindowsClient.exe" "RunRole" "4bf7d33f-c276-4737-832a-891d4de02f28" "System"C:\Program Files\ScreenConnect Client (fb4c833997b10f3b)\ScreenConnect.WindowsClient.exe—ScreenConnect.ClientService.exe
User:
SYSTEM
Company:
ScreenConnect Software
Integrity Level:
SYSTEM
Description:
ScreenConnect Client
Exit code:
0
Version:
23.8.1.8686
Modules
Images
c:\program files\screenconnect client (fb4c833997b10f3b)\screenconnect.windowsclient.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3024"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2856 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3172"C:\Program Files\ScreenConnect Client (fb4c833997b10f3b)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=screlay.honeywellcloud.com&p=443&s=161e92d8-52b2-45ab-88e9-cd6134a2407c&k=BgIAAACkAABSU0ExAAgAAAEAAQAj2ASeRAOdsLfwObXg3jgoM9%2f5OvKC9Uvi7ypgNXQwdTQG6i8th7X0rLWGtj6KXUN7EMfpk7J375sz92p8C6vGv0FvmCeBbtHqy6DKeQfXz2%2fyp3tfJIM4sKSTK0f1sEa8QiYCbh5QE7hHUzyqjWgrFjzYkrceb4cgwzFcRQk%2bhGmYWps579bbP1vH5I321b90RlV92iyX%2fL48avtY81Y9TIwGhsUqJPwt2lGPJ9%2f%2fXURGfZniGu6CQNZ5sMnll7ZH%2fE5IXobUNg2itlulbaQPyCxzFe5BfBAVszgTkqh9UWOZVlrW9ZPQJAXXbi9Ta3cEGFPdUSquTk1UDMNZuzea&c=AUB%20Bank&c=Bahrain&c=Sayed%20Hussain&c=E482322&c=Sayed.Hussain%40Honeywell.com&c=KSA-EBI-META&c=&c="C:\Program Files\ScreenConnect Client (fb4c833997b10f3b)\ScreenConnect.ClientService.exe
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Version:
23.8.1.8686
Modules
Images
c:\program files\screenconnect client (fb4c833997b10f3b)\screenconnect.clientservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
16 165
Read events
16 057
Write events
95
Delete events
13

Modification events

(PID) Process:(2856) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(2856) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(2856) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(2856) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2856) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2856) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2856) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2856) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2856) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2856) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
17
Suspicious files
22
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
3924ScreenConnect.ClientSetup.exeC:\Users\admin\AppData\Local\Temp\ScreenConnect\fb4c833997b10f3b\setup.msi —
MD5:—
SHA256:—
2316msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
2316msiexec.exeC:\Windows\Installer\1c13fd.msi —
MD5:—
SHA256:—
2856iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{9CFAFC4B-8C47-11EE-A826-12A9866C77DE}.datbinary
MD5:4C3649431F1B745F2DC6047CE24D12AF
SHA256:8643038A88FFB676B39D8D13AF18DD1056AD5EB1F4E7631EB99A3D4C551B818F
3024iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5ABbinary
MD5:ED5BE6D3A0AA575DCAB5F93B725E221B
SHA256:0E7614D2012E46875F5C920AD0D59D5BFBCE2B581F4509382C6BB0BB7C1396D5
2856iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\ScreenConnect.ClientSetup.exeexecutable
MD5:628F2596799B5EED516DE20A4067470C
SHA256:C8606F2B1432D18B4D11D83FD0275F5983245A5962E60DDB8D51C674FD8934C7
2856iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF7AB7386F9FA7F826.TMPbinary
MD5:7455399513B7BEAECFCAA93A58DE58C4
SHA256:5A0A90DE79BE051B42F5D91D4AC499DE14FB1C106BDE39E71CB94C39A0C99976
3024iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5ABbinary
MD5:4C1C379E0F101BBBDE83F982E3F8CD9E
SHA256:2A5A2ABD86DABAAA6FE5A3F8E7671D200A9E963566130F0847BEDB76F3CAFAEA
3024iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
2856iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\ScreenConnect.ClientSetup.exe.5hfutc5.partial:Zone.Identifiertext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
16
DNS requests
6
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3024
iexplore.exe
GET
200
67.27.157.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0e152650b56312b4
unknown
compressed
4.66 Kb
unknown
3024
iexplore.exe
GET
200
67.27.157.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?be0537bbbaca182f
unknown
compressed
4.66 Kb
unknown
3024
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
unknown
binary
471 b
unknown
1080
svchost.exe
GET
304
67.27.157.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5c94acfb5b892539
unknown
—
—
unknown
2856
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
1080
svchost.exe
GET
200
67.27.157.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?68f52e492152febd
unknown
compressed
61.6 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3024
iexplore.exe
20.72.175.38:443
secureconnect.honeywellcloud.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
3024
iexplore.exe
67.27.157.126:80
ctldl.windowsupdate.com
LEVEL3
US
unknown
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3024
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1080
svchost.exe
67.27.157.126:80
ctldl.windowsupdate.com
LEVEL3
US
unknown
3172
ScreenConnect.ClientService.exe
52.190.37.34:443
screlay.honeywellcloud.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2856
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
secureconnect.honeywellcloud.com
  • 20.72.175.38
unknown
ctldl.windowsupdate.com
  • 67.27.157.126
  • 67.27.159.126
  • 8.248.131.254
  • 67.26.83.254
  • 67.27.159.254
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
screlay.honeywellcloud.com
  • 52.190.37.34
unknown
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

PID
Process
Class
Message
3172
ScreenConnect.ClientService.exe
Misc activity
ET INFO ScreenConnect/ConnectWise Initial Checkin Packet M2
3172
ScreenConnect.ClientService.exe
Potential Corporate Privacy Violation
REMOTE [ANY.RUN] ScreenConnect Server Response
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://secureconnect.honeywellcloud.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest&c=AUB%20Bank&c=Bahrain&c=Sayed%20Hussain&c=E482322&c=Sayed.Hussain%40Honeywell.com&c=KSA-EBI-META&c=&c=