File name:

sclient.exe

Full analysis: https://app.any.run/tasks/a1e11c05-44c0-4883-b572-65a35cfed16f
Verdict: Malicious activity
Analysis date: April 26, 2024, 16:01:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
remote
screenconnect
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

FF217DAB57393592C6767DE1C6A999EB

SHA1:

CC580C52F4263803255D65DFB6AB208BE7F4A534

SHA256:

B0903921E666CA3FFD45100A38C11D7E5C53AB38646715EAFC6D1851AD41B92E

SSDEEP:

98304:0O6WSq1v6mQr4OytH9awXB0DXe3S+5OmxlGwP3AW5JTGG0DR/Wk1jKnBKK9Mh6Bw:JDA3+UB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • sclient.exe (PID: 4084)
      • msiexec.exe (PID: 124)

    • Creates a writable file in the system directory

      • ScreenConnect.ClientService.exe (PID: 1928)

    • Connects to the CnC server

      • ScreenConnect.ClientService.exe (PID: 1928)

    • SCREENCONNECT has been detected (SURICATA)

      • ScreenConnect.ClientService.exe (PID: 1928)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • sclient.exe (PID: 4084)
      • ScreenConnect.ClientService.exe (PID: 1928)
      • ScreenConnect.WindowsClient.exe (PID: 2600)

    • Reads the Internet Settings

      • sclient.exe (PID: 4084)
      • ScreenConnect.WindowsClient.exe (PID: 2600)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 124)

    • Executes as Windows Service

      • VSSVC.exe (PID: 1768)
      • ScreenConnect.ClientService.exe (PID: 1928)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 124)

    • Non-standard symbols in registry

      • msiexec.exe (PID: 124)

    • Creates or modifies Windows services

      • ScreenConnect.ClientService.exe (PID: 1928)

    • Executable content was dropped or overwritten

      • rundll32.exe (PID: 1112)

    • Uses RUNDLL32.EXE to load library

      • msiexec.exe (PID: 2024)

  • INFO

    • Reads the machine GUID from the registry

      • sclient.exe (PID: 4084)
      • msiexec.exe (PID: 124)
      • msiexec.exe (PID: 2272)
      • msiexec.exe (PID: 2196)
      • ScreenConnect.ClientService.exe (PID: 1928)
      • ScreenConnect.WindowsClient.exe (PID: 2600)
      • msiexec.exe (PID: 2024)

    • Checks supported languages

      • sclient.exe (PID: 4084)
      • msiexec.exe (PID: 124)
      • msiexec.exe (PID: 2024)
      • msiexec.exe (PID: 2272)
      • msiexec.exe (PID: 2196)
      • wmpnscfg.exe (PID: 2472)
      • ScreenConnect.WindowsClient.exe (PID: 2600)
      • ScreenConnect.ClientService.exe (PID: 1928)

    • Reads the computer name

      • sclient.exe (PID: 4084)
      • msiexec.exe (PID: 124)
      • msiexec.exe (PID: 2024)
      • msiexec.exe (PID: 2272)
      • msiexec.exe (PID: 2196)
      • ScreenConnect.WindowsClient.exe (PID: 2600)
      • ScreenConnect.ClientService.exe (PID: 1928)
      • wmpnscfg.exe (PID: 2472)

    • Create files in a temporary directory

      • sclient.exe (PID: 4084)
      • msiexec.exe (PID: 124)
      • rundll32.exe (PID: 1112)

    • Application launched itself

      • msiexec.exe (PID: 124)

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 820)
      • rundll32.exe (PID: 1112)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 820)
      • msiexec.exe (PID: 124)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 124)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2472)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:11:18 20:10:20+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.33
CodeSize: 45568
InitializedDataSize: 5264384
UninitializedDataSize: -
EntryPoint: 0x14ad
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
12
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start sclient.exe msiexec.exe msiexec.exe msiexec.exe no specs rundll32.exe vssvc.exe no specs msiexec.exe no specs msiexec.exe no specs #SCREENCONNECT screenconnect.clientservice.exe screenconnect.windowsclient.exe no specs wmpnscfg.exe no specs sclient.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
124C:\Windows\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
820"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\ScreenConnect\3bd025b899729e0b\setup.msi"C:\Windows\System32\msiexec.exe
sclient.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1112rundll32.exe "C:\Users\admin\AppData\Local\Temp\MSI3932.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1063296 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArgumentsC:\Windows\System32\rundll32.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1768C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1928"C:\Program Files\ScreenConnect Client (3bd025b899729e0b)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-j6j3lm-relay.screenconnect.com&p=443&s=1c2012a8-b490-4ae9-b3ed-36b7eba73fe5&k=BgIAAACkAABSU0ExAAgAAAEAAQC1TmtnHOE8KBx2zPp%2fuJ%2by39l0NWWXy4hDwpp%2fLbmCFh5LK0SyDiXRm%2fTsND3dHdktOGdUBkofhti3sghfGqfVo6GP6Sg%2buHFcntPEuGDPR1Pgf6HCa7T9yXFofj9W1%2fCnU7E2qRO78Eg60Rg%2bnAM558GL6VW2HXSzjW4TIyleqQN2uzZ90v7j9qpImb9KxU5tUo75RqMp532OhGJmGxw6kdZlktuz2D%2frx86oirnZHMeuHLPkk2Gazr2Fj4pUNIUXhQykPJaTo%2bvj%2fj4BjIuDNHrkqKW9BrCTkQlF3r3GkVTekYAFjoQmeRfdofhEinrtxH6Vf%2frhM0YqQvaCMcK9"C:\Program Files\ScreenConnect Client (3bd025b899729e0b)\ScreenConnect.ClientService.exe
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Version:
23.8.5.8707
Modules
Images
c:\program files\screenconnect client (3bd025b899729e0b)\screenconnect.clientservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2024C:\Windows\system32\MsiExec.exe -Embedding E171F8D71829F3BAD40E8886B65CA45E CC:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2196C:\Windows\system32\MsiExec.exe -Embedding CFB69ADEE45132B191C2A81E56965E42 E Global\MSI0000C:\Windows\System32\msiexec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2272C:\Windows\system32\MsiExec.exe -Embedding F574C0DDE9D0DCDF2E788527DCBBFC85C:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2472"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2600"C:\Program Files\ScreenConnect Client (3bd025b899729e0b)\ScreenConnect.WindowsClient.exe" "RunRole" "a4dfce83-98b4-4412-b00c-fa48330088c5" "User"C:\Program Files\ScreenConnect Client (3bd025b899729e0b)\ScreenConnect.WindowsClient.exe—ScreenConnect.ClientService.exe
User:
admin
Company:
ScreenConnect Software
Integrity Level:
MEDIUM
Description:
ScreenConnect Client
Version:
23.8.5.8707
Modules
Images
c:\program files\screenconnect client (3bd025b899729e0b)\screenconnect.windowsclient.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
8 395
Read events
8 123
Write events
252
Delete events
20

Modification events

(PID) Process:(4084) sclient.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(4084) sclient.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(4084) sclient.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(4084) sclient.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(124) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4000000000000000C40E8AFAF297DA017C000000EC060000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(124) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4000000000000000C40E8AFAF297DA017C000000EC060000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(124) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
75
(PID) Process:(124) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
400000000000000006912EFBF297DA017C000000EC060000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(124) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
400000000000000060F330FBF297DA017C00000048070000E8030000010000000000000000000000B530AB8951E57C4CAE166D0EE07D5BB00000000000000000
(PID) Process:(1768) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
400000000000000014B835FBF297DA01E806000038060000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
Executable files
14
Suspicious files
6
Text files
6
Unknown types
5

Dropped files

PID
Process
Filename
Type
4084sclient.exeC:\Users\admin\AppData\Local\Temp\ScreenConnect\3bd025b899729e0b\setup.msi —
MD5:—
SHA256:—
124msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
124msiexec.exeC:\Windows\Installer\105054.msi —
MD5:—
SHA256:—
1112rundll32.exeC:\Users\admin\AppData\Local\Temp\MSI3932.tmp-\ScreenConnect.Core.dllexecutable
MD5:469A702D0861E2C63E6E6E575C58E399
SHA256:AFFB342D2DCE754B4DDBEEB4ED344806FDA531D68346DF12629B7BD8C0FA753C
124msiexec.exeC:\Windows\Installer\MSI5546.tmpbinary
MD5:048A0F5C2C25C4BC29D0EE51CE5A2E3C
SHA256:56CFC5318B93CB9D4E7A342841DC0CC8C6A4D942FE5062DC9FB85E9B20EF1A5E
1112rundll32.exeC:\Users\admin\AppData\Local\Temp\MSI3932.tmp-\Microsoft.Deployment.WindowsInstaller.dllexecutable
MD5:5EF88919012E4A3D8A1E2955DC8C8D81
SHA256:3E54286E348EBD3D70EAED8174CCA500455C3E098CDD1FCCB167BC43D93DB29D
1112rundll32.exeC:\Users\admin\AppData\Local\Temp\MSI3932.tmp-\CustomAction.configxml
MD5:EB99EE012EB63C162EEBC1DF3A15990B
SHA256:C5045C2D482F71215877EB668264EE47E1415792457F19A5A55651C3554CC7CD
124msiexec.exeC:\Windows\Installer\MSI5576.tmpexecutable
MD5:BA84DD4E0C1408828CCC1DE09F585EDA
SHA256:3CFF4AC91288A0FF0C13278E73B282A64E83D089C5A61A45D483194AB336B852
124msiexec.exeC:\Users\admin\AppData\Local\Temp\~DFDCF7E1D46F48B37F.TMPbinary
MD5:05294BBFEA4DA9AF638A51A448F9562B
SHA256:FF6489B1AB9ABFAF0118F5FF35A04F2537F4CC2B5F648DAE8A0972441F489AD2
124msiexec.exeC:\Windows\Installer\105057.msi —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
1
Threats
3

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1928
ScreenConnect.ClientService.exe
51.77.100.219:443
instance-j6j3lm-relay.screenconnect.com
OVH SAS
FR
unknown

DNS requests

Domain
IP
Reputation
instance-j6j3lm-relay.screenconnect.com
  • 51.77.100.219
unknown

Threats

PID
Process
Class
Message
1088
svchost.exe
Misc activity
ET INFO Observed DNS Query to Known ScreenConnect/ConnectWise Remote Desktop Service Domain
1928
ScreenConnect.ClientService.exe
Misc activity
ET INFO ScreenConnect/ConnectWise Initial Checkin Packet M2
1928
ScreenConnect.ClientService.exe
Potential Corporate Privacy Violation
REMOTE [ANY.RUN] ScreenConnect Server Response
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
sclient.exe