analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | b66a60c1bad86476d28800fba424e63e6d1672e7fa6d68975a321ce456943de7 |
| Full analysis: | https://app.any.run/tasks/f2873630-bb0f-4fe9-b792-f84963c57247 |
| Verdict: | Malicious activity |
| Analysis date: | August 12, 2022, 18:35:10 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 3FF2243ED586414B2F9182F3AEC53FC9 |
| SHA1: | 722E23ACB38317AB79157017F0F905A52CBD0592 |
| SHA256: | B66A60C1BAD86476D28800FBA424E63E6D1672E7FA6D68975A321CE456943DE7 |
| SSDEEP: | 98304:2qzJy6+6efPk4OCgT/3sBvUGp819PY5ZWambTd:j/efPo65+1hY7Wtnd |
MALICIOUS
Drops executable file immediately after starts
- msiexec.exe (PID: 3792)
- rundll32.exe (PID: 4008)
- msiexec.exe (PID: 4084)
- ScreenConnect.ClientService.exe (PID: 3152)
- rundll32.exe (PID: 2532)
Application was dropped or rewritten from another process
- ScreenConnect.WindowsClient.exe (PID: 3640)
- ScreenConnect.ClientService.exe (PID: 3152)
- ScreenConnect.WindowsClient.exe (PID: 3304)
- ScreenConnect.ClientSetup.exe (PID: 2672)
- ScreenConnect.ClientService.exe (PID: 2328)
- ScreenConnect.WindowsClient.exe (PID: 3204)
- ScreenConnect.WindowsClient.exe (PID: 3816)
Loads dropped or rewritten executable
- ScreenConnect.WindowsClient.exe (PID: 3640)
- ScreenConnect.ClientService.exe (PID: 3152)
- ScreenConnect.WindowsClient.exe (PID: 3304)
- rundll32.exe (PID: 4008)
- rundll32.exe (PID: 2532)
- ScreenConnect.WindowsClient.exe (PID: 3204)
- ScreenConnect.ClientService.exe (PID: 2328)
- ScreenConnect.WindowsClient.exe (PID: 3816)
Deletes the SafeBoot registry key
- msiexec.exe (PID: 4084)
SUSPICIOUS
Checks supported languages
- msiexec.exe (PID: 4084)
- b66a60c1bad86476d28800fba424e63e6d1672e7fa6d68975a321ce456943de7.exe (PID: 2176)
- MsiExec.exe (PID: 3400)
- MsiExec.exe (PID: 1856)
- ScreenConnect.ClientService.exe (PID: 3152)
- MsiExec.exe (PID: 1812)
- ScreenConnect.WindowsClient.exe (PID: 3640)
- ScreenConnect.WindowsClient.exe (PID: 3304)
- ScreenConnect.ClientSetup.exe (PID: 2672)
- MsiExec.exe (PID: 3292)
- ScreenConnect.ClientService.exe (PID: 2328)
- ScreenConnect.WindowsClient.exe (PID: 3816)
- ScreenConnect.WindowsClient.exe (PID: 3204)
Reads the computer name
- b66a60c1bad86476d28800fba424e63e6d1672e7fa6d68975a321ce456943de7.exe (PID: 2176)
- msiexec.exe (PID: 4084)
- MsiExec.exe (PID: 3400)
- ScreenConnect.WindowsClient.exe (PID: 3640)
- ScreenConnect.ClientService.exe (PID: 3152)
- MsiExec.exe (PID: 1812)
- MsiExec.exe (PID: 1856)
- ScreenConnect.WindowsClient.exe (PID: 3304)
- MsiExec.exe (PID: 3292)
- ScreenConnect.ClientSetup.exe (PID: 2672)
- ScreenConnect.WindowsClient.exe (PID: 3204)
- ScreenConnect.ClientService.exe (PID: 2328)
- ScreenConnect.WindowsClient.exe (PID: 3816)
Drops a file with a compile date too recent
- msiexec.exe (PID: 3792)
- rundll32.exe (PID: 4008)
- msiexec.exe (PID: 4084)
- ScreenConnect.ClientService.exe (PID: 3152)
- rundll32.exe (PID: 2532)
Executable content was dropped or overwritten
- msiexec.exe (PID: 3792)
- b66a60c1bad86476d28800fba424e63e6d1672e7fa6d68975a321ce456943de7.exe (PID: 2176)
- rundll32.exe (PID: 4008)
- msiexec.exe (PID: 4084)
- ScreenConnect.ClientService.exe (PID: 3152)
- ScreenConnect.ClientSetup.exe (PID: 2672)
- rundll32.exe (PID: 2532)
Reads Windows owner or organization settings
- msiexec.exe (PID: 3792)
- msiexec.exe (PID: 4084)
Reads the Windows organization settings
- msiexec.exe (PID: 3792)
- msiexec.exe (PID: 4084)
Executed as Windows Service
- vssvc.exe (PID: 2984)
- ScreenConnect.ClientService.exe (PID: 3152)
- ScreenConnect.ClientService.exe (PID: 2328)
Reads Environment values
- vssvc.exe (PID: 2984)
Changes default file association
- msiexec.exe (PID: 4084)
Creates a directory in Program Files
- msiexec.exe (PID: 4084)
Creates files in the program directory
- ScreenConnect.ClientService.exe (PID: 3152)
- ScreenConnect.ClientService.exe (PID: 2328)
Reads CPU info
- ScreenConnect.WindowsClient.exe (PID: 3304)
- ScreenConnect.WindowsClient.exe (PID: 3816)
INFO
Checks supported languages
- msiexec.exe (PID: 3792)
- vssvc.exe (PID: 2984)
- rundll32.exe (PID: 4008)
- msiexec.exe (PID: 2472)
- rundll32.exe (PID: 2532)
Reads the computer name
- msiexec.exe (PID: 3792)
- rundll32.exe (PID: 4008)
- vssvc.exe (PID: 2984)
- msiexec.exe (PID: 2472)
- rundll32.exe (PID: 2532)
Application launched itself
- msiexec.exe (PID: 4084)
Loads dropped or rewritten executable
- MsiExec.exe (PID: 3400)
- MsiExec.exe (PID: 1856)
- MsiExec.exe (PID: 1812)
- MsiExec.exe (PID: 3292)
- msiexec.exe (PID: 4084)
Creates files in the program directory
- msiexec.exe (PID: 4084)
Creates a software uninstall entry
- msiexec.exe (PID: 4084)
Searches for installed software
- msiexec.exe (PID: 4084)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 EXE PECompact compressed (generic) (53.4) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (35.5) |
| .exe | | | Win32 Executable (generic) (5.8) |
| .exe | | | Generic Win/DOS Executable (2.5) |
| .exe | | | DOS Executable Generic (2.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2022:02:04 06:49:14+01:00 |
| PEType: | PE32 |
| LinkerVersion: | 14.16 |
| CodeSize: | 48640 |
| InitializedDataSize: | 4781056 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x1499 |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 04-Feb-2022 05:49:14 |
| Detected languages: |
|
| Debug artifacts: |
|
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000108 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 5 |
| Time date stamp: | 04-Feb-2022 05:49:14 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00001000 | 0x0000BCE6 | 0x0000BE00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.62079 |
.rdata | 0x0000D000 | 0x00005D68 | 0x00005E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.8737 |
.data | 0x00013000 | 0x000011E4 | 0x00000800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 2.25909 |
.rsrc | 0x00015000 | 0x00487DEC | 0x00487E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.40702 |
.reloc | 0x0049D000 | 0x00000ECC | 0x00001000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.31471 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 4.91161 | 381 | Latin 1 / Western European | English - United States | RT_MANIFEST |
SCREENCONNECT.CORE, VERSION=22.6.8531.8234, CULTURE=NEUTRAL, PUBLICKEYTOKEN=4B14C015C87C1AD8 | 6.00122 | 457216 | Latin 1 / Western European | UNKNOWN | FILES |
SCREENCONNECT.WINDOWS, VERSION=22.6.8531.8234, CULTURE=NEUTRAL, PUBLICKEYTOKEN=4B14C015C87C1AD8 | 6.69357 | 1672192 | Latin 1 / Western European | UNKNOWN | FILES |
SCREENCONNECT.WINDOWSINSTALLER, VERSION=22.6.8531.8234, CULTURE=NEUTRAL, PUBLICKEYTOKEN=4B14C015C87C1AD8 | 5.76353 | 71168 | Latin 1 / Western European | UNKNOWN | FILES |
_ENTRYPOINT | 7.81492 | 2543240 | Latin 1 / Western European | UNKNOWN | FILES |
_RESOLVER | 3.8513 | 5632 | Latin 1 / Western European | UNKNOWN | FILES |
Imports
KERNEL32.dll |
OLEAUT32.dll |
mscoree.dll |
Total processes
54
Monitored processes
18
Malicious processes
11
Suspicious processes
3
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2176 | "C:\Users\admin\AppData\Local\Temp\b66a60c1bad86476d28800fba424e63e6d1672e7fa6d68975a321ce456943de7.exe" | C:\Users\admin\AppData\Local\Temp\b66a60c1bad86476d28800fba424e63e6d1672e7fa6d68975a321ce456943de7.exe | Explorer.EXE | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 3792 | "C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\setup.msi" | C:\Windows\System32\msiexec.exe | b66a60c1bad86476d28800fba424e63e6d1672e7fa6d68975a321ce456943de7.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 4084 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3400 | C:\Windows\system32\MsiExec.exe -Embedding DD85AD323CA543244717429F2051BBC2 C | C:\Windows\system32\MsiExec.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 4008 | rundll32.exe "C:\Users\admin\AppData\Local\Temp\MSI87AF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_886750 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments | C:\Windows\system32\rundll32.exe | MsiExec.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2984 | C:\Windows\system32\vssvc.exe | C:\Windows\system32\vssvc.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1856 | C:\Windows\system32\MsiExec.exe -Embedding 81EEE927748E38565EF45134B1A08174 | C:\Windows\system32\MsiExec.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1812 | C:\Windows\system32\MsiExec.exe -Embedding 0EFE86D70BC08CCFC0B2D7E1D3C454C1 E Global\MSI0000 | C:\Windows\system32\MsiExec.exe | — | msiexec.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3152 | "C:\Program Files\ScreenConnect Client (cb4e2acfadcf6dfb)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-aab535-relay.screenconnect.com&p=443&s=9e3f469e-5762-4d1f-8f99-9cf9717f82aa&k=BgIAAACkAABSU0ExAAgAAAEAAQC5QfJPxEn43Gi67eGAyseFbyi8bDkKOFHFqab7QyWH3i%2fS1H3It0o4e%2b4S%2fmlx34%2bXzDFAUzWFN%2b0qqHVc%2fAOtAoABZ11qtn%2bPBGyyxOPPnutPeO%2fZRXsndWPdK3L4fn%2fWTfEhVV%2fLmMPZK5vNIk2k6%2fiB7E%2fTfvluQv0t%2fLLRKcPsSXdELEw5vAHhJenBj43bZ72ATwQakq5od%2bMGsQzZFWTjj6j70MZlBM8PD2Aylq7DCk1z919sEv1eUx3YfzEm85R2YJOLS%2fvy%2b668LN2bHlsyd%2foJB9b9I86LIiEZVtqvtDkxfLjtQrac02X9EDfq%2fytcu11ZpnLmTjTZfLyw&t=&c=CroixBleue&c=&c=&c=&c=&c=&c=&c=" | C:\Program Files\ScreenConnect Client (cb4e2acfadcf6dfb)\ScreenConnect.ClientService.exe | services.exe | ||||||||||||
User: SYSTEM Integrity Level: SYSTEM Exit code: 0 Version: 22.6.8531.8234 Modules
| |||||||||||||||
| 3640 | "C:\Program Files\ScreenConnect Client (cb4e2acfadcf6dfb)\ScreenConnect.WindowsClient.exe" "RunRole" "b631c241-57fa-4093-9c4d-f498084b63cf" "User" | C:\Program Files\ScreenConnect Client (cb4e2acfadcf6dfb)\ScreenConnect.WindowsClient.exe | — | ScreenConnect.ClientService.exe | |||||||||||
User: admin Company: ScreenConnect Software Integrity Level: MEDIUM Description: ScreenConnect Client Exit code: 0 Version: 22.6.8531.8234 Modules
| |||||||||||||||
Total events
8 378
Read events
7 862
Write events
0
Delete events
0
Modification events
Executable files
49
Suspicious files
16
Text files
17
Unknown types
6
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4084 | msiexec.exe | C:\System Volume Information\SPP\metadata-2 | — | |
MD5:— | SHA256:— | |||
| 4084 | msiexec.exe | C:\Program Files\ScreenConnect Client (cb4e2acfadcf6dfb)\ScreenConnect.Client.dll | executable | |
MD5:A0A3CB5C0F19EF2F717D2157E59F49BF | SHA256:B66E5184E34F6BBE968F7D5E0B3818F6B8D0C67945BC6B2BBDE7588EA1DCFE87 | |||
| 4084 | msiexec.exe | C:\System Volume Information\SPP\OnlineMetadataCache\{08b0f65b-0b3f-4a24-a58f-e9682e4a0cdd}_OnDiskSnapshotProp | binary | |
MD5:233F0FE886F281225424B093095E2CCC | SHA256:8F69B4C577B89D78B3462A1737ACCF7570B79F01F36F9C1BFE61F12BBDA25CEA | |||
| 2176 | b66a60c1bad86476d28800fba424e63e6d1672e7fa6d68975a321ce456943de7.exe | C:\Users\admin\AppData\Local\Temp\setup.msi | executable | |
MD5:8E96D3C438B237DD816B462CAD8D7472 | SHA256:75CBB7299AD6D4F368A65110F0FD6DF9C3D81C250CF96B91F1CC6074C5F9478E | |||
| 4084 | msiexec.exe | C:\Program Files\ScreenConnect Client (cb4e2acfadcf6dfb)\ScreenConnect.Core.dll | executable | |
MD5:38C2B352B79654EECB8BF9D2816F74CE | SHA256:5703FDF085D9B34A8D67A09A9B750247377B613D6472698F5F1DEBC83775E457 | |||
| 4084 | msiexec.exe | C:\Windows\Installer\d9be3.msi | executable | |
MD5:8E96D3C438B237DD816B462CAD8D7472 | SHA256:75CBB7299AD6D4F368A65110F0FD6DF9C3D81C250CF96B91F1CC6074C5F9478E | |||
| 4008 | rundll32.exe | C:\Users\admin\AppData\Local\Temp\MSI87AF.tmp-\ScreenConnect.Core.dll | executable | |
MD5:38C2B352B79654EECB8BF9D2816F74CE | SHA256:5703FDF085D9B34A8D67A09A9B750247377B613D6472698F5F1DEBC83775E457 | |||
| 4084 | msiexec.exe | C:\Windows\Installer\MSI9F9C.tmp | binary | |
MD5:B20D2A874BA0F027321C46B32F5DF19F | SHA256:F78280D1BE2927B963741E9C31CD861452C116482FC94ACF28D62462732500D9 | |||
| 4084 | msiexec.exe | C:\Windows\Installer\d9be4.ipi | binary | |
MD5:7D860178A31398927DFC91DC1C069F90 | SHA256:70AD564776C556A170AB17F6B621B34B2E7FC0C4625D0CBE23FC28DE918D7D0A | |||
| 4008 | rundll32.exe | C:\Users\admin\AppData\Local\Temp\MSI87AF.tmp-\ScreenConnect.InstallerActions.dll | executable | |
MD5:70BB4A408B579554E6AD56EAA89FED75 | SHA256:B6B94F84D990E5DFC35C960DFBF4C19FF26DD3F645FAA68862D7D9F82975BE12 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
1
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3152 | ScreenConnect.ClientService.exe | 145.40.105.156:443 | instance-aab535-relay.screenconnect.com | — | NL | unknown |
2328 | ScreenConnect.ClientService.exe | 145.40.105.156:443 | instance-aab535-relay.screenconnect.com | — | NL | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
instance-aab535-relay.screenconnect.com |
| unknown |
Threats
1 ETPRO signatures available at the full report