Edit tour
Windows
Analysis Report
ScreenConnect.ClientService.exe
Overview
General Information
| Sample name: | ScreenConnect.ClientService.exe |
| Analysis ID: | 1393795 |
| MD5: | 89d3d099b6d8731bd1b7f5a68b5bf17c |
| SHA1: | c6aed886840aafd08796207e2646d8805d012b81 |
| SHA256: | bcaa3d8dcba6ba08bf20077eadd0b31f58a1334b7b9c629e475694c4eeafd924 |
| Infos: | |
 | |
Detection
| Score: | 3 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 60% |
Signatures
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
May sleep (evasive loops) to hinder dynamic analysis
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Uses 32bit PE files
Classification
Analysis Advice
| Initial sample is implementing a service and should be registered / started as service |
| Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior |
- System is w10x64
ScreenConnect.ClientService.exe (PID: 2228 cmdline: C:\Users\u ser\Deskto p\ScreenCo nnect.Clie ntService. exe MD5: 89D3D099B6D8731BD1B7F5A68B5BF17C)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Snort rule has matched
- • Compliance
- • Networking
- • System Summary
- • Hooking and other Techniques for Hiding and Protection
- • Malware Analysis System Evasion
- • Anti Debugging
Click to jump to signature section
Show All Signature Results
There are no malicious signatures, click here to show all signatures.
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | Static PE information: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | 1 DLL Side-Loading | 1 DLL Side-Loading | 1 Masquerading | OS Credential Dumping | 31 Virtualization/Sandbox Evasion | Remote Services | Data from Local System | Data Obfuscation | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | 1 Disable or Modify Tools | LSASS Memory | 1 System Information Discovery | Remote Desktop Protocol | Data from Removable Media | Junk Data | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 31 Virtualization/Sandbox Evasion | Security Account Manager | Query Registry | SMB/Windows Admin Shares | Data from Network Shared Drive | Steganography | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 DLL Side-Loading | NTDS | System Network Configuration Discovery | Distributed Component Object Model | Input Capture | Protocol Impersonation | Traffic Duplication | Data Destruction |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | ReversingLabs | |||
| 1% | Virustotal | Browse |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No contacted domains info
⊘No contacted IP infos
| Joe Sandbox version: | 40.0.0 Tourmaline |
| Analysis ID: | 1393795 |
| Start date and time: | 2024-02-17 03:07:13 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 1m 46s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 1 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | ScreenConnect.ClientService.exe |
| Detection: | CLEAN |
| Classification: | clean3.winEXE@1/1@0/0 |
| EGA Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
- Execution Graph export aborted
for target ScreenConnect.Clie ntService.exe, PID 2228 becaus e it is empty
⊘No simulations
⊘No context
⊘No context
⊘No context
⊘No context
⊘No context
| Process: | C:\Users\user\Desktop\ScreenConnect.ClientService.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 42 |
| Entropy (8bit): | 4.0050635535766075 |
| Encrypted: | false |
| SSDEEP: | 3:QHXMKa/xwwUy:Q3La/xwQ |
| MD5: | 84CFDB4B995B1DBF543B26B86C863ADC |
| SHA1: | D2F47764908BF30036CF8248B9FF5541E2711FA2 |
| SHA-256: | D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B |
| SHA-512: | 485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE |
| Malicious: | false |
| Reputation: | high, very likely benign file |
| Preview: |
| File type: | |
| Entropy (8bit): | 6.504754320583222 |
| TrID: |
|
| File name: | ScreenConnect.ClientService.exe |
| File size: | 95'520 bytes |
| MD5: | 89d3d099b6d8731bd1b7f5a68b5bf17c |
| SHA1: | c6aed886840aafd08796207e2646d8805d012b81 |
| SHA256: | bcaa3d8dcba6ba08bf20077eadd0b31f58a1334b7b9c629e475694c4eeafd924 |
| SHA512: | 6cb52828006ef2d41b9acc2a8a8e84b2d5f0bee0304cc8762d5945a1e21023373371893a261d089599799ebe89cbe0da5327ee80d5db07a936727ea21fb0951a |
| SSDEEP: | 1536:Jg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgIU0HMe7ox6:qhbNDxZGXfdHrX7rAc6myJkgIU0HNj |
| TLSH: | 1E935A13B5C28872D573093158E0DAB49A3FF9615E21DEAB3798022A4F342C1BE75E77 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(..qF..qF..qF......qF......qF......qF.<.B..qF.<.E..qF.<.C..qF......qF..#...qF..qG..qF.2.O..qF.2....qF.2.D..qF.Rich.qF........ |
 | |
| Icon Hash: | 90cececece8e8eb0 |
| Entrypoint: | 0x40217f |
| Entrypoint Section: | .text |
| Digitally signed: | true |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | EXECUTABLE_IMAGE, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x6377E6AD [Fri Nov 18 20:10:21 2022 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 5 |
| OS Version Minor: | 1 |
| File Version Major: | 5 |
| File Version Minor: | 1 |
| Subsystem Version Major: | 5 |
| Subsystem Version Minor: | 1 |
| Import Hash: | 5f510e22d141c137199e2ff4021a57be |
| Signature Valid: | true |
| Signature Issuer: | CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US |
| Signature Validation Error: | The operation completed successfully |
| Error Number: | 0 |
| Not Before, Not After |
|
| Subject Chain |
|
| Version: | 3 |
| Thumbprint MD5: | AAE704EC2810686C3BF7704E660AFB5D |
| Thumbprint SHA-1: | 4C2272FBA7A7380F55E2A424E9E624AEE1C14579 |
| Thumbprint SHA-256: | 82B4E7924D5BED84FB16DDF8391936EB301479CEC707DC14E23BC22B8CDEAE28 |
| Serial: | 0B9360051BCCF66642998998D5BA97CE |
| Instruction |
|---|
| call 00007F5FE4E848B0h |
| jmp 00007F5FE4E8411Fh |
| retn 0000h |
| push ebp |
| mov ebp, esp |
| push 00000000h |
| call dword ptr [0040D0B0h] |
| push dword ptr [ebp+08h] |
| call dword ptr [0040D0ACh] |
| push C0000409h |
| call dword ptr [0040D0B4h] |
| push eax |
| call dword ptr [0040D0B8h] |
| pop ebp |
| ret |
| push ebp |
| mov ebp, esp |
| sub esp, 00000324h |
| push 00000017h |
| call dword ptr [0040D0BCh] |
| test eax, eax |
| je 00007F5FE4E842A7h |
| push 00000002h |
| pop ecx |
| int 29h |
| mov dword ptr [00414998h], eax |
| mov dword ptr [00414994h], ecx |
| mov dword ptr [00414990h], edx |
| mov dword ptr [0041498Ch], ebx |
| mov dword ptr [00414988h], esi |
| mov dword ptr [00414984h], edi |
| mov word ptr [004149B0h], ss |
| mov word ptr [004149A4h], cs |
| mov word ptr [00414980h], ds |
| mov word ptr [0041497Ch], es |
| mov word ptr [00414978h], fs |
| mov word ptr [00414974h], gs |
| pushfd |
| pop dword ptr [004149A8h] |
| mov eax, dword ptr [ebp+00h] |
| mov dword ptr [0041499Ch], eax |
| mov eax, dword ptr [ebp+04h] |
| mov dword ptr [004149A0h], eax |
| lea eax, dword ptr [ebp+08h] |
| mov dword ptr [004149ACh], eax |
| mov eax, dword ptr [ebp-00000324h] |
| mov dword ptr [004148E8h], 00000001h |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x12e70 | 0x78 | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x16000 | 0x450 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x14c00 | 0x2920 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x17000 | 0xfc0 | .reloc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x12160 | 0x70 | .rdata |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x120a0 | 0x40 | .rdata |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0xd000 | 0x188 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0xbf3a | 0xc000 | 4903141203ee15a88e0ec583d004b2e1 | False | 0.6032918294270834 | data | 6.576560633933191 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0xd000 | 0x66f2 | 0x6800 | d7ff5c28f3b91b07d0d4a0084e0c4027 | False | 0.41710486778846156 | data | 4.804608720286551 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0x14000 | 0x1284 | 0xa00 | c1c9bc79d0134b5bbd10e2601a2f323e | False | 0.166015625 | data | 2.1434314299622814 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0x16000 | 0x450 | 0x600 | 95f5ecb7c6a43682e09b1c9c3bc9bd51 | False | 0.3678385416666667 | data | 4.693997166054143 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .reloc | 0x17000 | 0xfc0 | 0x1000 | b8d6010afa6ab836c37551e6072726fe | False | 0.777587890625 | data | 6.512317090870992 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_VERSION | 0x160a0 | 0x22c | data | 0.49460431654676257 | ||
| RT_MANIFEST | 0x162cc | 0x184 | XML 1.0 document, ASCII text, with CRLF line terminators | English | United States | 0.5979381443298969 |
| DLL | Import |
|---|---|
| mscoree.dll | CorBindToRuntimeEx |
| SHLWAPI.dll | StrCatW, PathFindFileNameW, StrCpyW, PathRemoveExtensionW |
| KERNEL32.dll | SetEvent, CloseHandle, LoadLibraryW, DecodePointer, GetProcAddress, GetLastError, GetCurrentProcessId, GetModuleHandleW, SetStdHandle, Sleep, CreateEventW, InitializeCriticalSectionAndSpinCount, GetModuleFileNameW, GetCommandLineW, GetStringTypeW, FlushFileBuffers, GetConsoleCP, GetConsoleMode, SetFilePointerEx, WriteConsoleW, DeleteCriticalSection, RtlUnwind, GetFileType, GetProcessHeap, FreeEnvironmentStringsW, IsDebuggerPresent, OutputDebugStringW, RaiseException, EnterCriticalSection, LeaveCriticalSection, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, CreateFileW, SetLastError, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleHandleExW, GetModuleFileNameA, MultiByteToWideChar, WideCharToMultiByte, GetStdHandle, WriteFile, GetACP, HeapFree, HeapSize, HeapReAlloc, LCMapStringW, HeapAlloc, FindClose, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetEnvironmentStringsW |
| ADVAPI32.dll | RegisterServiceCtrlHandlerExW, CreateServiceW, QueryServiceStatus, CloseServiceHandle, OpenSCManagerW, SetServiceStatus, RegSetValueExW, StartServiceW, RegCreateKeyW, StartServiceCtrlDispatcherW, OpenServiceW, RegOpenKeyW |
| OLEAUT32.dll | VariantInit, SysFreeString, SysAllocString, SafeArrayPutElement, SafeArrayCreateVector, VariantClear |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node⊘No network behavior found
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
| Target ID: | 0 |
| Start time: | 03:07:59 |
| Start date: | 17/02/2024 |
| Path: | C:\Users\user\Desktop\ScreenConnect.ClientService.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x40000 |
| File size: | 95'520 bytes |
| MD5 hash: | 89D3D099B6D8731BD1B7F5A68B5BF17C |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
| Has exited: | true |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
