| File name: | Signed Documents .ClientSetup.exe |
| Full analysis: | https://app.any.run/tasks/9979f5cf-b575-414b-9698-c5911849cee8 |
| Verdict: | Malicious activity |
| Threats: | Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. |
| Analysis date: | June 02, 2025, 14:41:13 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections |
| MD5: | 203AAEBD4460C619F8F33BD6D8148482 |
| SHA1: | 140C9BF9ABB16E2FEFC04D4AAFEAFAA9BE5EE491 |
| SHA256: | 907A6D4BAAF3A1071E80CAFFAE66DB3704583133549DA1187AD48970EF754654 |
| SSDEEP: | 98304:GahxA3yFBPR3ipsn6lev+KNCOytH9awXB0DXe3S+5OmxlGwP3AW5JTGG0DR/Wzi9:bwDAYqhtuSZK6 |
MALICIOUS
No malicious indicators.SUSPICIOUS
Reads security settings of Internet Explorer
- Signed Documents .ClientSetup.exe (PID: 6816)
Executes as Windows Service
- VSSVC.exe (PID: 2740)
- ScreenConnect.ClientService.exe (PID: 7184)
There is functionality for taking screenshot (YARA)
- ScreenConnect.ClientService.exe (PID: 7184)
- ScreenConnect.WindowsClient.exe (PID: 5508)
Executable content was dropped or overwritten
- rundll32.exe (PID: 1512)
Connects to unusual port
- ScreenConnect.ClientService.exe (PID: 7184)
Detects ScreenConnect RAT (YARA)
- ScreenConnect.WindowsClient.exe (PID: 5508)
- ScreenConnect.ClientService.exe (PID: 7184)
INFO
Reads the machine GUID from the registry
- Signed Documents .ClientSetup.exe (PID: 6816)
Checks supported languages
- Signed Documents .ClientSetup.exe (PID: 6816)
- msiexec.exe (PID: 6980)
- msiexec.exe (PID: 7484)
Reads the computer name
- msiexec.exe (PID: 7484)
- msiexec.exe (PID: 6980)
- Signed Documents .ClientSetup.exe (PID: 6816)
Executable content was dropped or overwritten
- msiexec.exe (PID: 7152)
- msiexec.exe (PID: 7484)
Create files in a temporary directory
- rundll32.exe (PID: 1512)
- Signed Documents .ClientSetup.exe (PID: 6816)
Process checks computer location settings
- Signed Documents .ClientSetup.exe (PID: 6816)
CONNECTWISE has been detected
- msiexec.exe (PID: 7152)
Manages system restore points
- SrTasks.exe (PID: 4528)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (76.4) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (12.4) |
| .exe | | | Generic Win/DOS Executable (5.5) |
| .exe | | | DOS Executable Generic (5.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2022:11:18 20:10:20+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14.33 |
| CodeSize: | 45568 |
| InitializedDataSize: | 5500928 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x14ad |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
Total processes
161
Monitored processes
16
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1512 | rundll32.exe "C:\Users\admin\AppData\Local\Temp\MSI2C7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1180421 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments | C:\Windows\SysWOW64\rundll32.exe | msiexec.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows host process (Rundll32) Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2740 | C:\WINDOWS\system32\vssvc.exe | C:\Windows\System32\VSSVC.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4528 | C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11 | C:\Windows\System32\SrTasks.exe | — | msiexec.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Windows System Protection background tasks. Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5280 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | SrTasks.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5508 | "C:\Program Files (x86)\ScreenConnect Client (42b9c193963ff5c3)\ScreenConnect.WindowsClient.exe" "RunRole" "8035a225-d424-428a-809c-fa52acfbf0de" "User" | C:\Program Files (x86)\ScreenConnect Client (42b9c193963ff5c3)\ScreenConnect.WindowsClient.exe | ScreenConnect.ClientService.exe | ||||||||||||
User: admin Company: ScreenConnect Software Integrity Level: MEDIUM Description: ScreenConnect Client Version: 25.2.4.9229 Modules
| |||||||||||||||
| 6132 | C:\Windows\syswow64\MsiExec.exe -Embedding 66B8B31E9D79AC9F42967594C26C4E3C | C:\Windows\SysWOW64\msiexec.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows® installer Exit code: 0 Version: 5.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6744 | "C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca | C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Shell Experience Host Version: 10.0.19041.3758 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6816 | "C:\Users\admin\AppData\Local\Temp\Signed Documents .ClientSetup.exe" | C:\Users\admin\AppData\Local\Temp\Signed Documents .ClientSetup.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 6980 | C:\Windows\syswow64\MsiExec.exe -Embedding 60BA59DD60AF319C845682CEDEC5529E C | C:\Windows\SysWOW64\msiexec.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows® installer Exit code: 0 Version: 5.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7052 | "C:\Users\admin\AppData\Local\Temp\Signed Documents .ClientSetup.exe" | C:\Users\admin\AppData\Local\Temp\Signed Documents .ClientSetup.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
| |||||||||||||||
Total events
5 509
Read events
5 217
Write events
275
Delete events
17
Modification events
| (PID) Process: | (7484) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore |
| Operation: | write | Name: | SrCreateRp (Enter) |
Value: 480000000000000085130B69CCD3DB013C1D000074140000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (7484) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppGetSnapshots (Enter) |
Value: 480000000000000085130B69CCD3DB013C1D000074140000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (7484) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppGetSnapshots (Leave) |
Value: 4800000000000000D8752C69CCD3DB013C1D000074140000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (7484) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP |
| Operation: | write | Name: | LastIndex |
Value: 11 | |||
| (PID) Process: | (7484) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP |
| Operation: | write | Name: | SppGatherWriterMetadata (Enter) |
Value: 4800000000000000BAD96C69CCD3DB013C1D000074140000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (2740) VSSVC.exe | Key: | HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\11000001 |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (2740) VSSVC.exe | Key: | HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\11000001 |
| Operation: | write | Name: | Element |
Value: 0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000 | |||
| (PID) Process: | (2740) VSSVC.exe | Key: | HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\12000002 |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (2740) VSSVC.exe | Key: | HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\12000002 |
| Operation: | write | Name: | Element |
Value: \EFI\Boot\Loader.efi | |||
| (PID) Process: | (2740) VSSVC.exe | Key: | HKEY_LOCAL_MACHINE\BCD00000000\Objects\{a5a30fa2-3d06-4e9f-b5f4-a01df9d1fcba}\Description |
| Operation: | delete key | Name: | (default) |
Value: | |||
Executable files
20
Suspicious files
9
Text files
7
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6816 | Signed Documents .ClientSetup.exe | C:\Users\admin\AppData\Local\Temp\ScreenConnect\25.2.4.9229\42b9c193963ff5c3\ScreenConnect.ClientSetup.msi | — | |
MD5:— | SHA256:— | |||
| 7484 | msiexec.exe | C:\System Volume Information\SPP\snapshot-2 | — | |
MD5:— | SHA256:— | |||
| 7484 | msiexec.exe | C:\System Volume Information\SPP\OnlineMetadataCache\{12e2fa0c-005e-45df-bdb5-07611605cb8b}_OnDiskSnapshotProp | — | |
MD5:— | SHA256:— | |||
| 7484 | msiexec.exe | C:\System Volume Information\SPP\metadata-2 | — | |
MD5:— | SHA256:— | |||
| 7484 | msiexec.exe | C:\Windows\Installer\1232d0.msi | — | |
MD5:— | SHA256:— | |||
| 7484 | msiexec.exe | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log | — | |
MD5:— | SHA256:— | |||
| 7484 | msiexec.exe | C:\Windows\Installer\MSI3495.tmp | — | |
MD5:— | SHA256:— | |||
| 7484 | msiexec.exe | C:\Windows\Installer\inprogressinstallinfo.ipi | — | |
MD5:— | SHA256:— | |||
| 7484 | msiexec.exe | C:\Windows\Temp\~DF16BB3BB55A3C454D.TMP | — | |
MD5:— | SHA256:— | |||
| 7484 | msiexec.exe | C:\Program Files (x86)\ScreenConnect Client (42b9c193963ff5c3)\ScreenConnect.Core.dll | executable | |
MD5:1DB8B9FA0BDCBFAAB807F715C288C19A | SHA256:B8100E5AB07983CBF82D721CF719576CA3F60E352628DCAABD42D428011FDEDF | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
58
DNS requests
21
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
7564 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1180 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
7564 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
7184 | ScreenConnect.ClientService.exe | 151.242.63.156:8041 | qoansbw2.anondns.net | Aria Shatel Company Ltd | IR | unknown |
2112 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2924 | SearchApp.exe | 104.126.37.42:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
5496 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
qoansbw2.anondns.net |
| unknown |
www.bing.com |
| whitelisted |
fp.msedge.net |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
cxcs.microsoft.net |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |
dns.msftncsi.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |