download:

/Bin/ScreenConnect.Client.exe

Full analysis: https://app.any.run/tasks/e7785d4e-cda0-460b-b4c3-cf9ade2c06eb
Verdict: Malicious activity
Analysis date: May 18, 2024, 10:55:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
remote
screenconnect
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

11821FCDB5BB03AF7618DBDF29DDEDD5

SHA1:

3B6129C9988CCE43E858E0D9B998FC61058BB609

SHA256:

EB7C12DDA5311FE4CA0A271B6E4C24F1A748C958911F9A30C62C1D142B8BF620

SSDEEP:

1536:tejLH3MVw8licIgWQog5Mzg+MoCdqQsWQcd69jPVfqUNKg4/F:UjLHcVw8licpWQog5Ms+f+l6xPVfq84d

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • ScreenConnect.Client.exe (PID: 3956)
      • dfsvc.exe (PID: 3996)

    • Connects to the CnC server

      • ScreenConnect.ClientService.exe (PID: 1652)

    • Creates a writable file in the system directory

      • ScreenConnect.WindowsClient.exe (PID: 1812)

    • SCREENCONNECT has been detected (SURICATA)

      • ScreenConnect.ClientService.exe (PID: 1652)

  • SUSPICIOUS

    • Adds/modifies Windows certificates

      • ScreenConnect.Client.exe (PID: 3956)
      • dfsvc.exe (PID: 3996)

    • Reads security settings of Internet Explorer

      • dfsvc.exe (PID: 3996)
      • ScreenConnect.WindowsClient.exe (PID: 2116)
      • ScreenConnect.ClientService.exe (PID: 764)
      • ScreenConnect.ClientService.exe (PID: 1652)
      • ScreenConnect.WindowsClient.exe (PID: 1080)
      • ScreenConnect.WindowsClient.exe (PID: 1812)

    • Reads the Internet Settings

      • dfsvc.exe (PID: 3996)
      • ScreenConnect.WindowsClient.exe (PID: 2116)
      • ScreenConnect.ClientService.exe (PID: 764)
      • ScreenConnect.WindowsClient.exe (PID: 1080)

    • Reads settings of System Certificates

      • dfsvc.exe (PID: 3996)
      • ScreenConnect.Client.exe (PID: 3956)

    • Checks Windows Trust Settings

      • dfsvc.exe (PID: 3996)

    • The process creates files with name similar to system file names

      • dfsvc.exe (PID: 3996)

    • Reads Internet Explorer settings

      • dfsvc.exe (PID: 3996)

    • Executable content was dropped or overwritten

      • dfsvc.exe (PID: 3996)

    • Executes as Windows Service

      • ScreenConnect.ClientService.exe (PID: 1652)

    • Creates or modifies Windows services

      • ScreenConnect.ClientService.exe (PID: 1652)

    • Potential Corporate Privacy Violation

      • ScreenConnect.ClientService.exe (PID: 1652)

  • INFO

    • Checks supported languages

      • ScreenConnect.Client.exe (PID: 3956)
      • dfsvc.exe (PID: 3996)
      • ScreenConnect.WindowsClient.exe (PID: 2116)
      • wmpnscfg.exe (PID: 1136)
      • ScreenConnect.ClientService.exe (PID: 764)
      • ScreenConnect.ClientService.exe (PID: 1652)
      • ScreenConnect.WindowsClient.exe (PID: 1080)
      • ScreenConnect.WindowsClient.exe (PID: 1812)

    • Reads the machine GUID from the registry

      • ScreenConnect.Client.exe (PID: 3956)
      • dfsvc.exe (PID: 3996)
      • ScreenConnect.WindowsClient.exe (PID: 2116)
      • ScreenConnect.ClientService.exe (PID: 764)
      • ScreenConnect.ClientService.exe (PID: 1652)
      • ScreenConnect.WindowsClient.exe (PID: 1080)
      • ScreenConnect.WindowsClient.exe (PID: 1812)

    • Reads the computer name

      • ScreenConnect.Client.exe (PID: 3956)
      • dfsvc.exe (PID: 3996)
      • wmpnscfg.exe (PID: 1136)
      • ScreenConnect.ClientService.exe (PID: 764)
      • ScreenConnect.WindowsClient.exe (PID: 2116)
      • ScreenConnect.ClientService.exe (PID: 1652)
      • ScreenConnect.WindowsClient.exe (PID: 1080)
      • ScreenConnect.WindowsClient.exe (PID: 1812)

    • Creates files or folders in the user directory

      • dfsvc.exe (PID: 3996)
      • ScreenConnect.WindowsClient.exe (PID: 2116)
      • ScreenConnect.ClientService.exe (PID: 1652)

    • Reads Environment values

      • dfsvc.exe (PID: 3996)

    • Disables trace logs

      • dfsvc.exe (PID: 3996)

    • Process checks whether UAC notifications are on

      • dfsvc.exe (PID: 3996)

    • Create files in a temporary directory

      • dfsvc.exe (PID: 3996)

    • Checks proxy server information

      • dfsvc.exe (PID: 3996)

    • Reads the software policy settings

      • dfsvc.exe (PID: 3996)

    • Reads CPU info

      • ScreenConnect.WindowsClient.exe (PID: 1812)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1136)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:11:18 19:55:37+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.33
CodeSize: 40448
InitializedDataSize: 32768
UninitializedDataSize: -
EntryPoint: 0x14ba
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
8
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start screenconnect.client.exe no specs dfsvc.exe wmpnscfg.exe no specs screenconnect.windowsclient.exe no specs screenconnect.clientservice.exe #SCREENCONNECT screenconnect.clientservice.exe screenconnect.windowsclient.exe no specs screenconnect.windowsclient.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
764"C:\Users\admin\AppData\Local\Apps\2.0\OQVLXTZK.4P5\AK6KX289.K1P\scre..tion_25b0fbb6ef7eb094_0017.0009_fa0089c793aa6304\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=instance-elllr3-relay.screenconnect.com&p=443&s=c70c5214-26f1-4faf-8a84-b5f74139be5b&k=BgIAAACkAABSU0ExAAgAAAEAAQBZRp%2fB4AVZJqX0E7Ot0n9AVRPC5B2UKtzxIp701XN%2b2X78A%2fdnMpNnHeUOs3%2b%2fh973N6cnWtf3hCEjZSoxlUoZnF8kDcd0S6hNYEPCD%2foDinqSNaY9RJteuGOsqIoB9cq2cVgprmsiyfndrfiteWeQLxZT5%2fqUeeB4V5NoAC2aco%2bPcV05WErR9OfAP%2bXx7Jbmvv8tMK2rvO9Za4tegnUj7pcEIu73PBtS10K7xlVorsV%2bYM4GHrg7mZSZpdQddUZ1eiMqP3c28h4t4rKSh0370mAkNck93Ay2IZfbwqiC36sn5XYNAezedeeFvULlK6n0bERGELI07eyut2GfwHeq&r=&i=Untitled%20Session" "1"C:\Users\admin\AppData\Local\Apps\2.0\OQVLXTZK.4P5\AK6KX289.K1P\scre..tion_25b0fbb6ef7eb094_0017.0009_fa0089c793aa6304\ScreenConnect.ClientService.exe
ScreenConnect.WindowsClient.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
23.9.10.8817
Modules
Images
c:\users\admin\appdata\local\apps\2.0\oqvlxtzk.4p5\ak6kx289.k1p\scre..tion_25b0fbb6ef7eb094_0017.0009_fa0089c793aa6304\screenconnect.clientservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1080"C:\Users\admin\AppData\Local\Apps\2.0\OQVLXTZK.4P5\AK6KX289.K1P\scre..tion_25b0fbb6ef7eb094_0017.0009_fa0089c793aa6304\ScreenConnect.WindowsClient.exe" "RunRole" "bb656c36-6a6d-453e-aa98-521210429277" "User"C:\Users\admin\AppData\Local\Apps\2.0\OQVLXTZK.4P5\AK6KX289.K1P\scre..tion_25b0fbb6ef7eb094_0017.0009_fa0089c793aa6304\ScreenConnect.WindowsClient.exe—ScreenConnect.ClientService.exe
User:
admin
Company:
ScreenConnect Software
Integrity Level:
MEDIUM
Description:
ScreenConnect Client
Version:
23.9.10.8817
Modules
Images
c:\users\admin\appdata\local\apps\2.0\oqvlxtzk.4p5\ak6kx289.k1p\scre..tion_25b0fbb6ef7eb094_0017.0009_fa0089c793aa6304\screenconnect.windowsclient.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1136"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1652"C:\Users\admin\AppData\Local\Apps\2.0\OQVLXTZK.4P5\AK6KX289.K1P\scre..tion_25b0fbb6ef7eb094_0017.0009_fa0089c793aa6304\ScreenConnect.ClientService.exe" "?e=Support&y=Guest&h=instance-elllr3-relay.screenconnect.com&p=443&s=c70c5214-26f1-4faf-8a84-b5f74139be5b&k=BgIAAACkAABSU0ExAAgAAAEAAQBZRp%2fB4AVZJqX0E7Ot0n9AVRPC5B2UKtzxIp701XN%2b2X78A%2fdnMpNnHeUOs3%2b%2fh973N6cnWtf3hCEjZSoxlUoZnF8kDcd0S6hNYEPCD%2foDinqSNaY9RJteuGOsqIoB9cq2cVgprmsiyfndrfiteWeQLxZT5%2fqUeeB4V5NoAC2aco%2bPcV05WErR9OfAP%2bXx7Jbmvv8tMK2rvO9Za4tegnUj7pcEIu73PBtS10K7xlVorsV%2bYM4GHrg7mZSZpdQddUZ1eiMqP3c28h4t4rKSh0370mAkNck93Ay2IZfbwqiC36sn5XYNAezedeeFvULlK6n0bERGELI07eyut2GfwHeq&r=&i=Untitled%20Session" "1"C:\Users\admin\AppData\Local\Apps\2.0\OQVLXTZK.4P5\AK6KX289.K1P\scre..tion_25b0fbb6ef7eb094_0017.0009_fa0089c793aa6304\ScreenConnect.ClientService.exe
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Version:
23.9.10.8817
Modules
Images
c:\users\admin\appdata\local\apps\2.0\oqvlxtzk.4p5\ak6kx289.k1p\scre..tion_25b0fbb6ef7eb094_0017.0009_fa0089c793aa6304\screenconnect.clientservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1812"C:\Users\admin\AppData\Local\Apps\2.0\OQVLXTZK.4P5\AK6KX289.K1P\scre..tion_25b0fbb6ef7eb094_0017.0009_fa0089c793aa6304\ScreenConnect.WindowsClient.exe" "RunRole" "66cd6e08-8954-4f4a-a83e-ac3fb50fc4d7" "System"C:\Users\admin\AppData\Local\Apps\2.0\OQVLXTZK.4P5\AK6KX289.K1P\scre..tion_25b0fbb6ef7eb094_0017.0009_fa0089c793aa6304\ScreenConnect.WindowsClient.exe—ScreenConnect.ClientService.exe
User:
SYSTEM
Company:
ScreenConnect Software
Integrity Level:
SYSTEM
Description:
ScreenConnect Client
Exit code:
0
Version:
23.9.10.8817
Modules
Images
c:\users\admin\appdata\local\apps\2.0\oqvlxtzk.4p5\ak6kx289.k1p\scre..tion_25b0fbb6ef7eb094_0017.0009_fa0089c793aa6304\screenconnect.windowsclient.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2116"C:\Users\admin\AppData\Local\Apps\2.0\OQVLXTZK.4P5\AK6KX289.K1P\scre..tion_25b0fbb6ef7eb094_0017.0009_fa0089c793aa6304\ScreenConnect.WindowsClient.exe"C:\Users\admin\AppData\Local\Apps\2.0\OQVLXTZK.4P5\AK6KX289.K1P\scre..tion_25b0fbb6ef7eb094_0017.0009_fa0089c793aa6304\ScreenConnect.WindowsClient.exe—dfsvc.exe
User:
admin
Company:
ScreenConnect Software
Integrity Level:
MEDIUM
Description:
ScreenConnect Client
Exit code:
0
Version:
23.9.10.8817
Modules
Images
c:\users\admin\appdata\local\apps\2.0\oqvlxtzk.4p5\ak6kx289.k1p\scre..tion_25b0fbb6ef7eb094_0017.0009_fa0089c793aa6304\screenconnect.windowsclient.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3956"C:\Users\admin\AppData\Local\Temp\ScreenConnect.Client.exe" C:\Users\admin\AppData\Local\Temp\ScreenConnect.Client.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\screenconnect.client.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\rpcrt4.dll
3996"C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe
ScreenConnect.Client.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
ClickOnce
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\dfsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
12 549
Read events
12 257
Write events
239
Delete events
53

Modification events

(PID) Process:(3956) ScreenConnect.Client.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3956) ScreenConnect.Client.exeKey:HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates
Operation:delete valueName:7B0F360B775F76C94A12CA48445AA2D2A875701C
Value:
(PID) Process:(3956) ScreenConnect.Client.exeKey:HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C
Operation:writeName:Blob
Value:
0300000001000000140000007B0F360B775F76C94A12CA48445AA2D2A875701C2000000001000000B4060000308206B030820498A003020102021008AD40B260D29C4C9F5ECDA9BD93AED9300D06092A864886F70D01010C05003062310B300906035504061302555331153013060355040A130C446967694365727420496E6331193017060355040B13107777772E64696769636572742E636F6D3121301F060355040313184469676943657274205472757374656420526F6F74204734301E170D3231303432393030303030305A170D3336303432383233353935395A3069310B300906035504061302555331173015060355040A130E44696769436572742C20496E632E3141303F060355040313384469676943657274205472757374656420473420436F6465205369676E696E6720525341343039362053484133383420323032312043413130820222300D06092A864886F70D01010105000382020F003082020A0282020100D5B42F42D028AD78B75DD539591BB18842F5338CEB3D819770C5BBC48526309FA48E68D85CF5EB342407E14B4FD37843F417D71EDAF9D2D5671A524F0EA157FC8899C191CC81033E4D702464B38DE2087D347D4C8057126B439A99F2C53B1FF2EFCB475A13A64CB3012025F310D38BB2FB08F08AE09D09C065A7FA98804935873D5119E8902178452EA19F2CE118C21ACCC5EE93497042328FFBC6EA1CF3656891A24D4C8211485268DE10BD14575DE8181365C57FB24F852C48A4568435D6F92E9CAA0015D137FE1A0694C27CC8EA1B32E6CAC2F4A7A3030E74A5AF39B6AB6012E3E8D6B9F731E1DCADE418A0D8C1234747B3A10F6EA3AB6D9806831BB76A672DD2BD441A9210818FB03B09D7C79B325AC2FF6A60548B49C193EDE1B45CE06FEB26F98CD5B2F93810E6EACE91F5BED3FB6F9361345CBC93452883362A66285FB073CE8B262506B283D45CF615194CED62E05E33F2E8E8EC0AA7B0032B91B23679BEF7AD081E75A665CCBBE34850F377911AFEDB50A246C8615898F57C02163C8328AD3986ECD4B70D53D0F847E675308DEC30937614A65B4B5D74614D3F129176DEBF58CB72102941F0D5C56D267668114113589ADC262B01F4894D59DB78CF814A3E40475FC98150738510232159608A6454C1CC211AE838197C661CCD78384530994FFF634F4CBBAA0D0853417C583D47B3FAB6EC8C320902CC6C3C0C56110203010001A38201593082015530120603551D130101FF040830060101FF020100301D0603551D0E041604146837E0EBB63BF85F1186FBFE617B088865F44E42301F0603551D23041830168014ECD7E382D2715D644CDF2E673FE7BA98AE1C0F4F300E0603551D0F0101FF04040302018630130603551D25040C300A06082B06010505070303307706082B06010505070101046B3069302406082B060105050730018618687474703A2F2F6F6373702E64696769636572742E636F6D304106082B060105050730028635687474703A2F2F636163657274732E64696769636572742E636F6D2F446967694365727454727573746564526F6F7447342E63727430430603551D1F043C303A3038A036A0348632687474703A2F2F63726C332E64696769636572742E636F6D2F446967694365727454727573746564526F6F7447342E63726C301C0603551D20041530133007060567810C01033008060667810C010401300D06092A864886F70D01010C050003820201003A23443D8D0876EE8FBC3A99D356E0021AA5F84834F32CB6E67466F79472B100CAAF6C302713129E90449F4BFD9EA37C26D537BC3A5D486D95D53F49F427BB16814550FD9CBDB685E0767E3771CB22F75AAA90CFF5936AE3EB20D1D55079889A8A8AC1B6BDA148187EDCD8801A111918CD61998156F6C9E376E7C4E41B5F43F83E94FF76393D9ED499CF4ADD28EB5F26A1955848D51AFED7273FFD90D17686DD1CB0605CF30DA8EEE089A1BD39E1384EDA6EBB369DFBE521535AC3CAE96AF1A23EDB43B833C84F38149299F5DDCE546DD95D02141F40337C03E295B2C221757352CB46D8C4341CA2A54B8DCD6F76372C853F1ACE26E918BE9007B0437F9588208270F0CCCAEFFD29355C1F893855F7378A8B09A1CB0BE9311AFF2E195C3971E1BE9CA70A06D62667B792E64E5FDE7AAC49CF2EA47492ADDB3CA49C861FE3C1561B2B23FF8FB5EA887B706BE6A0BAFD3A3F45A6C4E81691528B41C048844B964DAB4440E38DF01528CEEDF11856072A2F10C40C08643C338FAE288C3CCB8F880B0DBF3BF4CE1E7B8EEFB5EBCBB7F07713E6E7283FAC12AEA52F226C41F9825C1566CC6C0ECAC586C3F626330C074BA0D307026A6A4030484B34A85120BBAD1B8508E2590D6DCA05502BEA4A1C9EA5FDA0A71F0674E7F2D65290FDAF854821F9573BB49C03ED8645F4B4616EBF68E2266086EAC8AFA9FE941DE7631B3A8656784E
(PID) Process:(3956) ScreenConnect.Client.exeKey:HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates
Operation:delete valueName:4C2272FBA7A7380F55E2A424E9E624AEE1C14579
Value:
(PID) Process:(3956) ScreenConnect.Client.exeKey:HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\4C2272FBA7A7380F55E2A424E9E624AEE1C14579
Operation:writeName:Blob
Value:
0300000001000000140000004C2272FBA7A7380F55E2A424E9E624AEE1C145792000000001000000640700003082076030820548A00302010202100B9360051BCCF66642998998D5BA97CE300D06092A864886F70D01010B05003069310B300906035504061302555331173015060355040A130E44696769436572742C20496E632E3141303F060355040313384469676943657274205472757374656420473420436F6465205369676E696E67205253413430393620534841333834203230323120434131301E170D3232303831373030303030305A170D3235303831353233353935395A3065310B30090603550406130255533110300E06035504081307466C6F72696461310E300C0603550407130554616D706131193017060355040A1310436F6E6E656374776973652C204C4C433119301706035504031310436F6E6E656374776973652C204C4C4330820222300D06092A864886F70D01010105000382020F003082020A0282020100EC489826D08D2C6DE21B3CD3676DB1E0E50CB1FF75FF564E9741F9574AA3640AA8297294A05B4DB68ABD0760B6B05B50CE92FF42A4E390BE776A43E9961C722F6B3A4D5C880BCC6A61B4026F9137D36B2B7E9B86055876B9FA860DBCB164FE7F4B5B9DE4799AE4E02DC1F0BEE01E5D032933A2827388F8DB0B482E76C441B1BD50909EF2023E1FB62196C994CE052266B28CD89253E6416044133139764DB5FC45702529536BF82C775F9EC81FA27DC409530325F40CDEF95B81B9CE0D42791CEE72E7BD1B36C257B52257C65A28970E457513989434BFC239E2992B193E1B3CC3F11CCDD1D26D4EC9845099AB913906A42069AF999C0071169B45A2EA1AA666F1904E8ACB05E1823A359A291FD46B4EF7AED5935BB6AB17EBF077210726930C90F01761D6544A94E8FA614CC41D817EEC734B1C3D3AFB7C58FB256F0C09EDC1459BDDBFF9940ED1958570265D67AF79A9B6A16AFFD70FC6328C9810D5DC186E39AF6FBCAD49A270F237E6BCD5DE0BC014BC3179CD79776591340311A42CA94F33416C2E01B59BD1D71DE86ACE6716BC90B2D7695D155039AA08FBAC19A4D93FB784230A20A485287A16355645FC09142C602D140FA046B7BFD75328184FF7BDF8F9E0D65E6201C8D242931047F59BD328AC353777CCEFA60408887B84FC3631301463461A1D73C0B5CC74D6D82905DDF923BDBAB027A311CC38D3FA16F639A50203010001A382020630820202301F0603551D230418301680146837E0EBB63BF85F1186FBFE617B088865F44E42301D0603551D0E04160414338CE10A6E06D9C6ED0BC6CAE736CEFB8188646A300E0603551D0F0101FF04040302078030130603551D25040C300A06082B060105050703033081B50603551D1F0481AD3081AA3053A051A04F864D687474703A2F2F63726C332E64696769636572742E636F6D2F4469676943657274547275737465644734436F64655369676E696E6752534134303936534841333834323032314341312E63726C3053A051A04F864D687474703A2F2F63726C342E64696769636572742E636F6D2F4469676943657274547275737465644734436F64655369676E696E6752534134303936534841333834323032314341312E63726C303E0603551D20043730353033060667810C0104013029302706082B06010505070201161B687474703A2F2F7777772E64696769636572742E636F6D2F43505330819406082B06010505070101048187308184302406082B060105050730018618687474703A2F2F6F6373702E64696769636572742E636F6D305C06082B060105050730028650687474703A2F2F636163657274732E64696769636572742E636F6D2F4469676943657274547275737465644734436F64655369676E696E6752534134303936534841333834323032314341312E637274300C0603551D130101FF04023000300D06092A864886F70D01010B050003820201000AD79F00CF4984864C8981ECCE8718AA875647F6A74608C968E16568C7AA9D711ED7341676038067F01330C91621B27A2A8894C4108C268162A31F13F9757A7D6BB3C6F19BF27C3A29896D712D85873627D827CD6471761444FABF1D31E903F791143C5B4CE5E7444AACBA36D759AEBA3069D195226755CBC675AA747F77596C53C96E083C45BBA24479D6845EEA9F2B28BA29B4DCF0BCF14AA4CE176C24E2C1B8FEC3EE16E1C086DB6FDA97388859E83BE65C03F701395B78B842C6DD1533EF642CCA6FE50F6337D3F2DFEDD8B28F2B28E0C98EDD2151392E7CC75489F48859F1DE14C81B306EB50EED7BB78BE30EAADA76767C4CA523A11EEC5A2372D6122926AB1801A6A6778E9504791487EE47D4577154988802070F80FC535957658F954CD083546C5AFB5A6567B6761275F5DB20F70AB86FEEF94C7CFC65369D325121B69A82399BC7DC1962416F0F05CF1EEE64D495A3527E464E2C68DA0187093F97B673E43DDDBCC067E00713F1565FCFF8C3772D44B40A04E600644F22A990345F9A6B5B52963E82C81A0CE91D43A230F67B37D8DEBDA40EA3D59D305E18ADC1976516C12A8BA2BCA24143B12E9527B4DCA58872AA9B3A8C6AC563FC2DC02BF51BE889516D35A4BA9D062417B5BDCC50BA945FAE26B60D6AEC03984798A6A21D3FF793CC0849E81ED55B8027411C50DB776AE8FEEF2FDC2DAFB04345261DEDC054
(PID) Process:(3996) dfsvc.exeKey:HKEY_CLASSES_ROOT\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager
Operation:writeName:StateStore_RandomString
Value:
661M0X3XNW9ZOH2Z66VVYWNN
(PID) Process:(3996) dfsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3996) dfsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3996) dfsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3996) dfsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
Executable files
16
Suspicious files
12
Text files
23
Unknown types
0

Dropped files

PID
Process
Filename
Type
3996dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\C1H8OTLJ.DNA\Y08KP49H.NR9\ScreenConnect.Windows.dllexecutable
MD5:29454A0CB83F28C24805E9A70E53444A
SHA256:998CC3F9AF5BD41CCF0F9BE86192BBE20CDEC08A6FF73C1199E1364195A83E14
3996dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\C1H8OTLJ.DNA\Y08KP49H.NR9\ScreenConnect.WindowsBackstageShell.exe.configxml
MD5:728175E20FFBCEB46760BB5E1112F38B
SHA256:87C640D3184C17D3B446A72D5F13D643A774B4ECC7AFBEDFD4E8DA7795EA8077
3996dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\C1H8OTLJ.DNA\Y08KP49H.NR9\ScreenConnect.WindowsClient.exe.manifestxml
MD5:F4B84E283123B025A90BBDE33E2080FD
SHA256:93F9EB492B6952D8C7AA1EF1EE5A901234BA1FD2D5EF58D24E1FAEF597EA8E02
3996dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\C1H8OTLJ.DNA\Y08KP49H.NR9\ScreenConnect.WindowsFileManager.exeexecutable
MD5:C333D3A6EEB74E4D76C3B9E0F6BFD04C
SHA256:998D7A0CD6B1A837489E55E99CB992088B9FDE220A1025346A461849E1F50D22
3996dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\C1H8OTLJ.DNA\Y08KP49H.NR9\ScreenConnect.WindowsBackstageShell.exeexecutable
MD5:10DBA57F22A6AB4039330000570F39F8
SHA256:9BD8D15759F83D99EDD1F2617D59A94E1C2BB4BD7C4977958F5D5F22C5A7C469
3996dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\C1H8OTLJ.DNA\Y08KP49H.NR9\ScreenConnect.Client.dllexecutable
MD5:6BC9611D5B6CEE698149A18D986547A8
SHA256:17377A52EEAE11E8EE01EB629D6A60C10015AD2BB8BC9768E5C8E4B6500A15ED
3996dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\C1H8OTLJ.DNA\Y08KP49H.NR9\ScreenConnect.ClientService.exeexecutable
MD5:DC615E9D8EC81CBF2E2452516373E5A0
SHA256:E9AB064ED381C29A3930F75CA3E05605C6EE07F30A69C043F576A5461DE3BAFC
3996dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\C1H8OTLJ.DNA\Y08KP49H.NR9\ScreenConnect.ClientService.dllexecutable
MD5:22AF3A23BD30484514CDACF67C5B3810
SHA256:7C5442121DBA2A30AB9579EC08E111DED372CF9CF90FB3256F273980B975AFA9
3996dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\C1H8OTLJ.DNA\Y08KP49H.NR9\ScreenConnect.Core.dllexecutable
MD5:B319407E807BE1A49E366F7F8EA7EE2A
SHA256:761B7E50BAA229E8AFCD9A50990D7F776DDB5ED1EA5FBB131C802E57CF918742
3996dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\C1H8OTLJ.DNA\Y08KP49H.NR9\ScreenConnect.Client.dll.genmanxml
MD5:9CE092E164085CE2566F654314BF99DC
SHA256:6B36DDCE4021FD15C29CF63C7102E60EDFE2627D1B00EF97D0B4DE3051737439
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
7
DNS requests
3
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3996
dfsvc.exe
GET
200
192.229.221.95:80
http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
3996
dfsvc.exe
147.28.163.206:443
fa-histsedueg.screenconnect.com
PACKET
US
unknown
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3996
dfsvc.exe
192.229.221.95:80
cacerts.digicert.com
EDGECAST
US
whitelisted
1652
ScreenConnect.ClientService.exe
147.28.163.204:443
instance-elllr3-relay.screenconnect.com
PACKET
US
unknown

DNS requests

Domain
IP
Reputation
fa-histsedueg.screenconnect.com
  • 147.28.163.206
unknown
cacerts.digicert.com
  • 192.229.221.95
whitelisted
instance-elllr3-relay.screenconnect.com
  • 147.28.163.204
unknown

Threats

PID
Process
Class
Message
1088
svchost.exe
Misc activity
ET INFO Observed DNS Query to Known ScreenConnect/ConnectWise Remote Desktop Service Domain
1088
svchost.exe
Misc activity
ET INFO Observed DNS Query to Known ScreenConnect/ConnectWise Remote Desktop Service Domain
1652
ScreenConnect.ClientService.exe
Misc activity
ET INFO ScreenConnect/ConnectWise Initial Checkin Packet M2
1652
ScreenConnect.ClientService.exe
Potential Corporate Privacy Violation
REMOTE [ANY.RUN] ScreenConnect Server Response
1652
ScreenConnect.ClientService.exe
Misc activity
ET INFO ScreenConnect/ConnectWise Initial Checkin Packet M2
1652
ScreenConnect.ClientService.exe
Potential Corporate Privacy Violation
REMOTE [ANY.RUN] ScreenConnect Server Response
Process
Message
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status Originated: -1073741772 *** Source File: d:\iso_whid\x86fre\base\isolation\win32\isoreg_direct.cpp, line 1127
dfsvc.exe
*** Status Originated: -1073741772 *** Source File: d:\iso_whid\x86fre\base\isolation\win32\isoreg_direct.cpp, line 1127
dfsvc.exe
*** Status Originated: -1073741772 *** Source File: d:\iso_whid\x86fre\base\isolation\win32\isoreg_direct.cpp, line 1127
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/Bin/ScreenConnect.Client.exe