Operation SilentCanvas Uses JPEG-Disguised PowerShell to Deploy Trojanized ScreenConnect
Summary
CYFIRMA details Operation SilentCanvas, a multi-stage intrusion using a PowerShell payload disguised as a JPEG, on-host .NET compilation, a fileless UAC bypass and trojanized ScreenConnect for persistent encrypted remote access.
Key points
- CYFIRMA reports that sysupdate.jpeg is a PowerShell payload disguised as an image; delivery likely involved phishing or other social engineering, but the initial vector is not confirmed.
- The loader uses AMSI bypass and obfuscation, downloads additional components, and compiles a launcher on the host with csc.exe.
- A malicious ms-settings registry handler and ComputerDefaults.exe are used for a fileless UAC bypass; the malware then creates a persistent service disguised as OneDriveServers.
- The trojanized ScreenConnect framework connects to legitserver[.]theworkpc[.]com and 45.138.16[.]64 using encrypted command-and-control.
- Static analysis found capabilities for credential interception, remote command execution, file transfer, surveillance, hidden desktop interaction and privileged operations.
- The report includes YARA rules and recommends restricting unauthorized PowerShell and .NET execution, monitoring abused Windows binaries, and investigating suspicious ScreenConnect activity.
Article Details
- Attack Vectors
- A malicious PowerShell payload disguised as sysupdate.jpeg was executed on the victim system; the article describes phishing or other deceptive delivery as likely, not confirmed.
- The payload downloaded additional components, including a secondary script and ScreenConnect package, from attacker-controlled infrastructure.
- The loader used csc.exe to compile uds.exe on the victim system, then abused ComputerDefaults.exe and a malicious ms-settings registry handler for a fileless UAC bypass.
- A trojanized ConnectWise ScreenConnect instance established encrypted remote access and persistence through a malicious Windows service masquerading as OneDriveServers.
- Defensive Notes
- Govern and monitor enterprise RMM and remote administration platforms, including ScreenConnect.
- Use application allowlisting and restrict unauthorized PowerShell scripts and unsigned .NET assemblies.
- Block or closely monitor csc.exe, cvtres.exe, ComputerDefaults.exe, and other commonly abused Windows binaries.
- Detect suspicious PowerShell activity, including AMSI bypass patterns, Invoke-Expression use, and hidden execution flags such as CreateNoWindow=true.
- Isolate systems showing unauthorized ScreenConnect activity or suspicious PowerShell execution, and reset potentially exposed credentials, especially privileged accounts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | legitserver[.]theworkpc[.]com | Attacker-controlled infrastructure used for payload retrieval and encrypted ScreenConnect C2 sessions. |
| IPV4 | 45[.]138[.]16[.]64 | Attacker-controlled C2 infrastructure mapped to the malicious ScreenConnect hostname. |
| MD5 | 7dd05336097e5a833f03a63d3221494f | Exact hash identified in a YARA rule for the compiled uds.exe dropper. |
| SHA256 | 4d8ac85c5b98c69ba44146df61183e9bf613edd796aa516c3ae73611b7d77c06 | Malicious payload hash listed for blocking in the article's IOC table. |
| SHA256 | 7adffc1c0b3fdcba46e8d0a81203c955976d4ef39893c98d0b2dbfbb8d6a8ec3 | Malicious payload hash listed for blocking in the article's IOC table. |
| SHA256 | a635f0c94c98b658ae799978994f0d0a292567cd97b8a19068a8423d1297652a | Exact hash identified in a YARA rule for the compiled uds.exe dropper. |
| SHA256 | cea1d85967d2c456fccecae3a70ff2adfe4c113aacf9d18c35906c2ed24ca9b4 | Malicious payload hash listed for blocking in the article's IOC table. |
| SHA256 | e4c9f3bb4a65c640795bfc1a56c0b56485b849ccd97027eed7ad9aa78a732a4f | Malicious payload hash listed for blocking in the article's IOC table. |
| SHA256 | ecd5ed16975d556d1d17bc980f248f8a5262bed11df9d9cf999efd9c273c11df | Malicious payload hash listed for blocking in the article's IOC table. |
| SHA256 | ee3d776cdaf82335e4293e19ee313cc35eee49cde9963b96766a8f9c89d44a79 | Malicious payload hash listed for blocking in the article's IOC table. |
MITRE ATT&CK
T1027.004 · Compile After DeliveryThe loader compiled the malicious uds.exe launcher on the victim system using csc.exe.T1036.005 · Match Legitimate Resource Name or LocationThe intrusion used names and paths such as OneDriveServers and C:Systems to resemble legitimate software or Windows locations.T1036.008 · Masquerade File TypeThe malicious PowerShell payload used a .jpeg extension to masquerade as an image.T1056 · Input CaptureStatic analysis identified a Credential Provider interception framework for capturing login credentials.T1059.001 · PowerShellThe staged payload used obfuscated PowerShell to download and execute additional payloads, including in memory.T1105 · Ingress Tool TransferThe loader downloaded staged scripts and packages, including OneDriveServer.zip, from attacker-controlled infrastructure.T1112 · Modify RegistryThe malware created and then removed ms-settings registry entries to enable the UAC bypass.T1113 · Screen CaptureThe framework included screen capture and recording functionality, with screenshots also described among data sent to attacker infrastructure.T1204.002 · Malicious FileThe intrusion used a malicious file named sysupdate.jpeg, disguised as an image, for victim execution.T1219 · Remote Access ToolsA trojanized ConnectWise ScreenConnect instance provided covert remote access to compromised systems.T1518.001 · Security Software DiscoveryThe malware used WMI queries against rootSecurityCenter2 to enumerate installed antivirus products.T1543.003 · Windows ServicePersistence was established through a malicious Windows service masquerading as OneDriveServers.T1548.002 · Bypass User Account ControlThe malware used ComputerDefaults.exe and an ms-settings registry hijack to launch uds.exe with elevated privileges without a visible UAC prompt.T1562.001 · Disable or Modify ToolsThe PowerShell execution chain incorporated AMSI bypass logic.T1573 · Encrypted ChannelThe trojanized ScreenConnect client used PBKDF2/HMAC-SHA256-derived keys to encrypt bidirectional C2 traffic.
Vendors
ConnectWiseCYFIRMA identified a multi-stage intrusion that used a weaponized PowerShell payload disguised as sysupdate.jpeg to deploy a trojanized ConnectWise ScreenConnect instance for covert remote access.MicrosoftThe malware abused Microsoft LOLBins including csc.exe, cvtres.exe, and ComputerDefaults.exe to compile payloads and bypass UAC.
Products
ConnectWise ScreenConnectCYFIRMA identified a multi-stage intrusion that used a weaponized PowerShell payload disguised as sysupdate.jpeg to deploy a trojanized ConnectWise ScreenConnect instance for covert remote access.Microsoft WindowsThe payload established persistence through a malicious Windows service masquerading as OneDriveServers and used encrypted C2 communications.PowerShellCYFIRMA identified a multi-stage intrusion that used a weaponized PowerShell payload disguised as sysupdate.jpeg to deploy a trojanized ConnectWise ScreenConnect instance for covert remote access.