Windows Analysis Report
ScreenConnect.WindowsClient.exe

Overview

General Information

Sample name:	ScreenConnect.WindowsClient.exe
Analysis ID:	1500129
MD5:	ab5fa8d90645878d587f386d0e276c02
SHA1:	a602a20735a1104851f293965f1fe4ab678bf627
SHA256:	316bbf433f1f803d113adf060c528ccc636656cee26b90f5fea011c1c73c7d16
Infos:

Detection

ScreenConnect Tool

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

.NET source code contains a domain name check

.NET source code contains potential unpacker

Contains functionality to capture screen (.Net source)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Creates a process in suspended mode (likely to inject code)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

Yara detected ScreenConnect Tool

Classification

Signatures

Source: ScreenConnect.WindowsClient.exe

Static PE information: certificate valid

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe

File opened: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_88e266cb2fac7c0d\MSVCR80.dll

Jump to behavior

Source: ScreenConnect.WindowsClient.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbBB source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822708751.0000000000D76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Client.pdbTV source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1821702084.00000000003D1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\exe\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822245852.0000000000854000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\symbols\exe\ScreenConnect.WindowsClient.pdbn Fil source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822708751.0000000000D76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\ScreenConnect.WindowsClient.pdbon source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822245852.0000000000854000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\ScreenConnect.WindowsClient.pdbgMh source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822245852.000000000082B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\ScreenConnect.WindowsClient.pdbo source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822708751.0000000000D76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe
Source:	Binary string: C:\Users\user\Desktop\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822708751.0000000000D76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1821702084.00000000003D1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: ws\ScreenConnect.WindowsClient.pdbpdbent.pdb\jone source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822708751.0000000000D76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\exe\ScreenConnect.WindowsClient.pdbommon source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822708751.0000000000D76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\exe\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822245852.000000000082B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\ScreenConnect.WindowsClient.PDB/N source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822245852.000000000082B000.00000004.00000020.00020000.00000000.sdmp

Source: ScreenConnect.WindowsClient.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: ScreenConnect.WindowsClient.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: ScreenConnect.WindowsClient.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: ScreenConnect.WindowsClient.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: ScreenConnect.WindowsClient.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: ScreenConnect.WindowsClient.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: ScreenConnect.WindowsClient.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ScreenConnect.WindowsClient.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: ScreenConnect.WindowsClient.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: ScreenConnect.WindowsClient.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: ScreenConnect.WindowsClient.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: ScreenConnect.WindowsClient.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: ScreenConnect.WindowsClient.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: Amcache.hve.1.dr	String found in binary or memory: http://upx.sf.net
Source: ScreenConnect.WindowsClient.exe	String found in binary or memory: http://www.digicert.com/CPS0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture screen (.Net source)

Source: ScreenConnect.WindowsClient.exe, WindowsClientExtensions.cs

.Net Code: CaptureScreen

One or more processes crash

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe

Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe dw20.exe -x -s 1232

Source: classification engine

Classification label: mal52.spyw.evad.winEXE@3/4@0/0

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe

Mutant created: NULL

Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\7d5a730d-ef8b-44c4-9f9a-7826c204f454

Jump to behavior

Source: ScreenConnect.WindowsClient.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: ScreenConnect.WindowsClient.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.98%

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ScreenConnect.WindowsClient.exe

String found in binary or memory: Status/Adding main form from:

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe

File read: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe "C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe"
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe dw20.exe -x -s 1232
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe dw20.exe -x -s 1232	Jump to behavior

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll

Jump to behavior

Source: ScreenConnect.WindowsClient.exe

Static PE information: certificate valid

Source: ScreenConnect.WindowsClient.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe

File opened: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_88e266cb2fac7c0d\MSVCR80.dll

Jump to behavior

Source: ScreenConnect.WindowsClient.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: ScreenConnect.WindowsClient.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbBB source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822708751.0000000000D76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Client.pdbTV source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1821702084.00000000003D1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\exe\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822245852.0000000000854000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\symbols\exe\ScreenConnect.WindowsClient.pdbn Fil source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822708751.0000000000D76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\ScreenConnect.WindowsClient.pdbon source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822245852.0000000000854000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\ScreenConnect.WindowsClient.pdbgMh source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822245852.000000000082B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\ScreenConnect.WindowsClient.pdbo source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822708751.0000000000D76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe
Source:	Binary string: C:\Users\user\Desktop\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822708751.0000000000D76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1821702084.00000000003D1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: ws\ScreenConnect.WindowsClient.pdbpdbent.pdb\jone source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822708751.0000000000D76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\exe\ScreenConnect.WindowsClient.pdbommon source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822708751.0000000000D76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\exe\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822245852.000000000082B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\ScreenConnect.WindowsClient.PDB/N source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822245852.000000000082B000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: ScreenConnect.WindowsClient.exe, PrintJobReceiver.cs

.Net Code: RunThread

Binary contains a suspicious time stamp

Source: ScreenConnect.WindowsClient.exe

Static PE information: 0xC05DF8E0 [Fri Apr 8 23:33:52 2072 UTC]

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT			Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

.NET source code contains a domain name check

Source: ScreenConnect.WindowsClient.exe, Program.cs

.Net Code: Environment.GetEnvironmentVariable("USERDOMAIN")

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Memory allocated: 9C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Memory allocated: 2960000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Memory allocated: 1A960000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: Amcache.hve.1.dr	Binary or memory string: VMware
Source: dw20.exe, 00000001.00000003.1820063002.0000000000681000.00000004.00000020.00020000.00000000.sdmp, dw20.exe, 00000001.00000003.1819711424.000000000067A000.00000004.00000020.00020000.00000000.sdmp, dw20.exe, 00000001.00000002.1822387679.0000000000682000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW*l
Source: Amcache.hve.1.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.1.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.1.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.1.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.1.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.1.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.1.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: dw20.exe, 00000001.00000003.1820063002.0000000000681000.00000004.00000020.00020000.00000000.sdmp, dw20.exe, 00000001.00000003.1819711424.000000000067A000.00000004.00000020.00020000.00000000.sdmp, dw20.exe, 00000001.00000002.1822387679.0000000000682000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.1.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.1.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.1.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.1.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.1.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.1.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.1.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.1.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.1.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.1.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.1.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.1.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.1.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.1.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.1.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.1.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.1.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.1.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.1.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.1.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: dw20.exe, 00000001.00000002.1822210616.0000000000614000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW }h%SystemRoot%\system32\mswsock.dll`Jd
Source: Amcache.hve.1.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe

Memory allocated: page read and write | page guard

Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe

Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe dw20.exe -x -s 1232

Jump to behavior

Source: ScreenConnect.WindowsClient.exe	Binary or memory string: Progman
Source: ScreenConnect.WindowsClient.exe	Binary or memory string: Shell_TrayWnd-Shell_SecondaryTrayWnd%MsgrIMEWindowClass

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.1.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.1.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.1.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.1.dr	Binary or memory string: MsMpEng.exe

Yara detected ScreenConnect Tool

Source: Yara match	File source: ScreenConnect.WindowsClient.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ScreenConnect.WindowsClient.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1646016569.0000000000202000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ScreenConnect.WindowsClient.exe PID: 6852, type: MEMORYSTR

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Source: ScreenConnect.WindowsClient.exe

Static PE information: certificate valid

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe

File opened: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_88e266cb2fac7c0d\MSVCR80.dll

Jump to behavior

Source: ScreenConnect.WindowsClient.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbBB source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822708751.0000000000D76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Client.pdbTV source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1821702084.00000000003D1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\exe\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822245852.0000000000854000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\symbols\exe\ScreenConnect.WindowsClient.pdbn Fil source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822708751.0000000000D76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\ScreenConnect.WindowsClient.pdbon source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822245852.0000000000854000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\ScreenConnect.WindowsClient.pdbgMh source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822245852.000000000082B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\ScreenConnect.WindowsClient.pdbo source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822708751.0000000000D76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe
Source:	Binary string: C:\Users\user\Desktop\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822708751.0000000000D76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1821702084.00000000003D1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: ws\ScreenConnect.WindowsClient.pdbpdbent.pdb\jone source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822708751.0000000000D76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\exe\ScreenConnect.WindowsClient.pdbommon source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822708751.0000000000D76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\exe\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822245852.000000000082B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\ScreenConnect.WindowsClient.PDB/N source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822245852.000000000082B000.00000004.00000020.00020000.00000000.sdmp

Source: ScreenConnect.WindowsClient.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: ScreenConnect.WindowsClient.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: ScreenConnect.WindowsClient.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: ScreenConnect.WindowsClient.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: ScreenConnect.WindowsClient.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: ScreenConnect.WindowsClient.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: ScreenConnect.WindowsClient.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ScreenConnect.WindowsClient.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: ScreenConnect.WindowsClient.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: ScreenConnect.WindowsClient.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: ScreenConnect.WindowsClient.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: ScreenConnect.WindowsClient.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: ScreenConnect.WindowsClient.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: Amcache.hve.1.dr	String found in binary or memory: http://upx.sf.net
Source: ScreenConnect.WindowsClient.exe	String found in binary or memory: http://www.digicert.com/CPS0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture screen (.Net source)

Source: ScreenConnect.WindowsClient.exe, WindowsClientExtensions.cs

.Net Code: CaptureScreen

One or more processes crash

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe

Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe dw20.exe -x -s 1232

Source: classification engine

Classification label: mal52.spyw.evad.winEXE@3/4@0/0

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe

Mutant created: NULL

Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\7d5a730d-ef8b-44c4-9f9a-7826c204f454

Jump to behavior

Source: ScreenConnect.WindowsClient.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: ScreenConnect.WindowsClient.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.98%

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ScreenConnect.WindowsClient.exe

String found in binary or memory: Status/Adding main form from:

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe

File read: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe "C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe"
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe dw20.exe -x -s 1232
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe dw20.exe -x -s 1232	Jump to behavior

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll

Jump to behavior

Source: ScreenConnect.WindowsClient.exe

Static PE information: certificate valid

Source: ScreenConnect.WindowsClient.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe

File opened: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_88e266cb2fac7c0d\MSVCR80.dll

Jump to behavior

Source: ScreenConnect.WindowsClient.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: ScreenConnect.WindowsClient.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdbBB source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822708751.0000000000D76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Client.pdbTV source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1821702084.00000000003D1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\exe\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822245852.0000000000854000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\symbols\exe\ScreenConnect.WindowsClient.pdbn Fil source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822708751.0000000000D76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\ScreenConnect.WindowsClient.pdbon source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822245852.0000000000854000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\ScreenConnect.WindowsClient.pdbgMh source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822245852.000000000082B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\ScreenConnect.WindowsClient.pdbo source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822708751.0000000000D76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe
Source:	Binary string: C:\Users\user\Desktop\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822708751.0000000000D76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1821702084.00000000003D1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: ws\ScreenConnect.WindowsClient.pdbpdbent.pdb\jone source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822708751.0000000000D76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\exe\ScreenConnect.WindowsClient.pdbommon source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822708751.0000000000D76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\exe\ScreenConnect.WindowsClient.pdb source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822245852.000000000082B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\ScreenConnect.WindowsClient.PDB/N source: ScreenConnect.WindowsClient.exe, 00000000.00000002.1822245852.000000000082B000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: ScreenConnect.WindowsClient.exe, PrintJobReceiver.cs

.Net Code: RunThread

Binary contains a suspicious time stamp

Source: ScreenConnect.WindowsClient.exe

Static PE information: 0xC05DF8E0 [Fri Apr 8 23:33:52 2072 UTC]

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT			Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

.NET source code contains a domain name check

Source: ScreenConnect.WindowsClient.exe, Program.cs

.Net Code: Environment.GetEnvironmentVariable("USERDOMAIN")

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Memory allocated: 9C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Memory allocated: 2960000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Memory allocated: 1A960000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: Amcache.hve.1.dr	Binary or memory string: VMware
Source: dw20.exe, 00000001.00000003.1820063002.0000000000681000.00000004.00000020.00020000.00000000.sdmp, dw20.exe, 00000001.00000003.1819711424.000000000067A000.00000004.00000020.00020000.00000000.sdmp, dw20.exe, 00000001.00000002.1822387679.0000000000682000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW*l
Source: Amcache.hve.1.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.1.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.1.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.1.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.1.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.1.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.1.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: dw20.exe, 00000001.00000003.1820063002.0000000000681000.00000004.00000020.00020000.00000000.sdmp, dw20.exe, 00000001.00000003.1819711424.000000000067A000.00000004.00000020.00020000.00000000.sdmp, dw20.exe, 00000001.00000002.1822387679.0000000000682000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.1.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.1.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.1.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.1.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.1.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.1.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.1.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.1.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.1.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.1.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.1.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.1.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.1.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.1.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.1.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.1.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.1.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.1.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.1.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.1.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: dw20.exe, 00000001.00000002.1822210616.0000000000614000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW }h%SystemRoot%\system32\mswsock.dll`Jd
Source: Amcache.hve.1.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe

Memory allocated: page read and write | page guard

Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe

Process created: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe dw20.exe -x -s 1232

Jump to behavior

Source: ScreenConnect.WindowsClient.exe	Binary or memory string: Progman
Source: ScreenConnect.WindowsClient.exe	Binary or memory string: Shell_TrayWnd-Shell_SecondaryTrayWnd%MsgrIMEWindowClass

Source: C:\Users\user\Desktop\ScreenConnect.WindowsClient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.1.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.1.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.1.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.1.dr	Binary or memory string: MsMpEng.exe

Yara detected ScreenConnect Tool

Source: Yara match	File source: ScreenConnect.WindowsClient.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ScreenConnect.WindowsClient.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1646016569.0000000000202000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ScreenConnect.WindowsClient.exe PID: 6852, type: MEMORYSTR

ID:	1500129
Product:	CloudBasic
Start time:	23:28:06
Start date:	27.08.2024
Sample:	ScreenConnect.WindowsClient.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	ab5fa8d90645878d587f386d0e276c02
SHA1:	a602a20735a1104851f293965f1fe4ab678bf627
SHA256:	316bbf433f1f803d113adf060c528ccc636656cee26b90f5fea011c1c73c7d16
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.98%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_ScreenConnect.Wi_678d95b9d51074be56918e3ca898aa852cba5_00000000_b16e6a68-d273-4b22-9528-2ab1fc8b7f74\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	9CCE5B2E38926A1FCD2D8D536B077B6C	32EA6FA7F40CDAA47B6A9507DD8EFC7DFCD8E73E	F6094AFF4A09B273A733FB29D0821120CAA8680EAC7E4504DFF34CB70538D4DC
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2FA8.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	7C084A149657646C6A5C6B440EA5BD51	CB30914288B38A2F014F9D9FF6E790B519E4FE42	6C848F8D68156AE4CE2C8C39306A57B58657E292ED10A1AF06BD06FF1C267B3F
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2FD8.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	81C22493AE27C91D69F200BFED46273A	B6F4268153A726DEE02581756F2F31BBD68B663C	2E3AF68D63912F09CD7A8880C44E335C319582901BB78A23811F0576FB6C2839
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	F7D955DC84B3C1BF3B5A923A1D1BEC5D	48EF0CF23F7B7B8ABC84805326BC7AFF040F5B62	3AC5A39D050288D8CBA26B79153EA0C99939815B8E56112782D7D72A05B303CA

Windows Analysis Report
ScreenConnect.WindowsClient.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Windows Analysis Report ScreenConnect.WindowsClient.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
ScreenConnect.WindowsClient.exe