The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign

MITRE Techniques

• [T1055.012 ] Process Hollowing – The payload spawns RegAsm.exe suspended and replaces its original code with the injected .NET module, allowing AsyncRAT to run inside a trusted process. [‘spawn a new RegAsm.exe process with the CREATE_SUSPENDED flag… the RegAsm.exe process no longer executes its original code’]
• [T1218.009 ] Signed Binary Proxy Execution: Regsvcs/Regasm – The malware abuses RegAsm.exe as the host process for malicious execution and code injection. [‘RegAsm.exe process… serving as a container for the injected .NET module’]
• [T1027 ] Obfuscated Files or Information – The loader decrypts payload bytes using XOR, bit inversion, and reflective loading before execution. [‘uses a 0xA7 XOR key to decrypt each byte and inverts the bit order’]
• [T1059.001 ] Command and Scripting Interpreter: PowerShell – PowerShell scripts are created and executed to configure exclusions and launch later stages. [‘created and executed a PowerShell script’]
• [T1059.005 ] Command and Scripting Interpreter: Visual Basic – VBScript is used to create files and trigger the next script in the chain. [‘The installer_method3_stream.vbs script creates five files… and immediately triggers their execution’]
• [T1112 ] Modify Registry – The script disables UAC prompts by changing a registry value. [‘disables User Account Control (UAC) prompts by setting the ConsentPromptBehaviorAdmin registry parameter to 0’]
• [T1562.001 ] Impair Defenses: Disable or Modify Tools – Microsoft Defender exclusions are added to weaken host protection. [‘configures Microsoft Defender exclusions’]
• [T1053.005 ] Scheduled Task/Job: Scheduled Task – Persistence is achieved by creating a task that runs every two minutes. [‘schtasks” /Create /TN “MasterPackager.Updater”… /SC MINUTE /MO 2 /F’]
• [T1547.001 ] Boot or Logon Autostart Execution: Registry Run Keys/Startup Folder – The article describes persistence through a task that survives reboot and keeps the loader chain running. [‘ensuring that script.vbs — and consequently the entire loader chain — executes even after a system reboot’]
• [T1105 ] Ingress Tool Transfer – Malicious archives and payload components are downloaded from spoofed websites to the victim device. [‘Clicking the download button… triggers a request… from which the archive is fetched’]
• [T1195.002 ] Compromise Software Supply Chain: Compromise Software Dependency and Development Tools – Legitimate software installers are packaged with malicious components to deliver ScreenConnect. [‘bundle a legitimate, signed Microsoft install.exe binary alongside a rogue install.res.1033.dll library’]
• [T1574.002 ] Hijack Execution Flow: DLL Side-Loading – The legitimate installer loads the malicious DLL to execute the attacker’s code. [‘When OBS-Studio-Installer.exe is executed, it loads install.res.1033.dll via DLL sideloading’]
• [T1218.011 ] System Binary Proxy Execution: Rundll32 – The detection logic notes rundll32.exe as a suspicious child process from ScreenConnect, indicating abuse of trusted binaries. [‘Anomalous child processes being spawned by the ScreenConnect service’]