Overview

overview

8

Static

static

1

RSVP 06 co...on.msi

windows10-2004-x64

8

RSVP 06 co...on.msi

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20251231-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20251231-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/01/2026, 17:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RSVP 06 confirmation.msi
  • Size 9.6MB
  • Sample260107-wbdvraev7c
  • SHA256 138a2a015376e48160e89b7979d22f67b6ad4e3c60ea7321049e085db0abaab7
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
backdoordiscoverypersistenceprivilege_escalationransomwarerat

Malware Config

Signatures

  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat
  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 3 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Drops file in Program Files directory 16 IoCs
  • Drops file in Windows directory 13 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 22 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 37 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\RSVP 06 confirmation.msi"
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4412
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Boot or Logon Autostart Execution: Authentication Package
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5224
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding BDC8A81A9D036379C33A37DF59AADAC5 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3624
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI95D7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240621312 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4768
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4872
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding B39BC62D803760795D0C3E2DC5F23689
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2260
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding AC657BFD141886A8DCB0BA79B8256000 E Global\MSI0000
        2⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2500
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:1316
    • C:\Program Files (x86)\ScreenConnect Client (6a8b748a750532ae)\ScreenConnect.ClientService.exe
      "C:\Program Files (x86)\ScreenConnect Client (6a8b748a750532ae)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-mvh1uz-relay.screenconnect.com&p=443&s=966862d8-bfbe-4b4b-abbf-2b21b4c0a89d&k=BgIAAACkAABSU0ExAAgAAAEAAQAdAau%2fdgzUF3K6Vp%2fyiS0b5CIJqDcohgnjIiUUpvT%2bMAMYRJ0vJPbkYjjZoUym4eRVOFi%2bay6vE%2fQaztvuwNE6Oq3cI6xnA7fg48Q4FbkyNfDFdRD27YFHq3eATcsrMsgqeyADsySfHIA2s8stMpqS4ydvg7b%2fRBYq3GTYzg%2fY6iOP3rZu0w4V%2fVk9%2fLR7VsysB0NCyOMvVTndh15dvvDnR3pAQ%2fiPCe9GcSvoyaHZp2Ij2UW8jO%2brlcwDYDv%2bo%2bpEURxVLddjJX6oChgJ9lMS0Bmq9QZuUi6ZY77dv8ZABj%2brhEbCsoWVlflzlmx6Q1CjRA7CCEP5jFqi6plVVEqc"
      1⤵
      • Sets service image path in registry
      • Drops file in System32 directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4660
      • C:\Program Files (x86)\ScreenConnect Client (6a8b748a750532ae)\ScreenConnect.WindowsClient.exe
        "C:\Program Files (x86)\ScreenConnect Client (6a8b748a750532ae)\ScreenConnect.WindowsClient.exe" "RunRole" "b3b9c22e-d8a4-48fc-a6a3-334093b03817" "User"
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3944
      • C:\Program Files (x86)\ScreenConnect Client (6a8b748a750532ae)\ScreenConnect.WindowsClient.exe
        "C:\Program Files (x86)\ScreenConnect Client (6a8b748a750532ae)\ScreenConnect.WindowsClient.exe" "RunRole" "d817ed81-7a79-4c61-bee2-ed567a4c6887" "System"
        2⤵
        • Drops file in System32 directory
        • Executes dropped EXE
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        PID:4024

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e57d0be.rbs
          • Path C:\Config.Msi\e57d0be.rbs
          • Size 214KB
          • SHA256 1a3cc4c14982cdb38b023b994036fdaa9f87c8dcf56f314d55d4ffd3e7884641
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Client.en-US.resources
          • Path C:\Program Files (x86)\ScreenConnect Client (6a8b748a750532ae)\Client.en-US.resources
          • Size 64KB
          • SHA256 efdb0b4fcc38b52cbf72336bd107a814db8454003f3495de21e2026a148823ea
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Client.resources
          • Path C:\Program Files (x86)\ScreenConnect Client (6a8b748a750532ae)\Client.resources
          • Size 6KB
          • SHA256 bd34378ad99f7609fa0c7c8edde6337c738a61d288863015629329806a1cc728
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ScreenConnect.Client.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (6a8b748a750532ae)\ScreenConnect.Client.dll
          • Size 399KB
          • SHA256 dbaffdb4d49e5dba309f54b1fc110c236042ac82ccde029b2917e189edaf84d3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ScreenConnect.ClientService.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (6a8b748a750532ae)\ScreenConnect.ClientService.dll
          • Size 78KB
          • SHA256 c8102fc3bda354653fc1c80b500de20d1a6bb274826334f76817f595434d2f0d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ScreenConnect.ClientService.exe
          • Path C:\Program Files (x86)\ScreenConnect Client (6a8b748a750532ae)\ScreenConnect.ClientService.exe
          • Size 93KB
          • SHA256 a33c975b07fc9db4713b6584965dd88b143d61b99c4d699dd326374b82dcd271
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ScreenConnect.Core.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (6a8b748a750532ae)\ScreenConnect.Core.dll
          • Size 553KB
          • SHA256 a98c8a07c4b819afb60d4372b2b8428d08cdd93571acb02750c8a17287ca613b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ScreenConnect.Windows.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (6a8b748a750532ae)\ScreenConnect.Windows.dll
          • Size 1.7MB
          • SHA256 416a10eb49239bc3aa1b32acfa31bb206a662ab9969043a7f5fe9d6455ebc07a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ScreenConnect.WindowsAuthenticationPackage.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (6a8b748a750532ae)\ScreenConnect.WindowsAuthenticationPackage.dll
          • Size 254KB
          • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ScreenConnect.WindowsClient.exe
          • Path C:\Program Files (x86)\ScreenConnect Client (6a8b748a750532ae)\ScreenConnect.WindowsClient.exe
          • Size 604KB
          • SHA256 a5c8ede4d24165797dcfbabbb85f62c44a79b058381e68249bf418a01fc67a1d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ScreenConnect.WindowsClient.exe.config
          • Path C:\Program Files (x86)\ScreenConnect Client (6a8b748a750532ae)\ScreenConnect.WindowsClient.exe.config
          • Size 266B
          • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
          • MD5 SHA1 SHA512
          Submit Download

          ScreenConnect.WindowsCredentialProvider.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (6a8b748a750532ae)\ScreenConnect.WindowsCredentialProvider.dll
          • Size 838KB
          • SHA256 7a94f9bc46ebc6285b6a9d2ee989357705707c7e03831ce22e6fae7d8d7b471c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          system.config
          • Path C:\Program Files (x86)\ScreenConnect Client (6a8b748a750532ae)\system.config
          • Size 972B
          • SHA256 a753112226146bb44334b13cc1db940dc8e2a1ae30dd9788cb9c2231d3a23eb1
          • MD5 SHA1 SHA512
          Submit Download

          8EC9B1D0ABBD7F98B401D425828828CE_AE4B983DE066DC93BB134616BF886138
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_AE4B983DE066DC93BB134616BF886138
          • Size 727B
          • SHA256 70fa220bbaa1941c51d4d466cbd66625cb3a49ad15e440ef01896714daa14315
          • MD5 SHA1 SHA512
          Submit Download

          C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
          • Size 727B
          • SHA256 c271144251a20c42fa7718d18685284dc2edb52ccd4ada5dc714f2218a4170b6
          • MD5 SHA1 SHA512
          Submit Download

          8EC9B1D0ABBD7F98B401D425828828CE_AE4B983DE066DC93BB134616BF886138
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_AE4B983DE066DC93BB134616BF886138
          • Size 408B
          • SHA256 04ebdfbc4f9ebeae7dc450c587ea36e5f210bce33051ed762e15e86fcd92d485
          • MD5 SHA1 SHA512
          Submit Download

          C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
          • Size 412B
          • SHA256 80376887dc8e727e389c78d6b008e7f693fc0d43236a76009324510c1ccd6df6
          • MD5 SHA1 SHA512
          Submit Download

          MSI95D7.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI95D7.tmp
          • Size 1.1MB
          • SHA256 80c78c9e4eca39bdefdc9d47b9a8b49dfcc3fe1c0f135338584c7e83702d539a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Microsoft.Deployment.WindowsInstaller.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MSI95D7.tmp-\Microsoft.Deployment.WindowsInstaller.dll
          • Size 172KB
          • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ScreenConnect.Core.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MSI95D7.tmp-\ScreenConnect.Core.dll
          • Size 543KB
          • SHA256 553ace16fbc4f84d8c66ca9a56797fffd527e61215aae4c09d79a55b7653a774
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ScreenConnect.InstallerActions.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MSI95D7.tmp-\ScreenConnect.InstallerActions.dll
          • Size 11KB
          • SHA256 7071c7fa49e4b177126d58835d7df40ec0a18424d5c9110242d612fefb1974df
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ScreenConnect.Windows.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MSI95D7.tmp-\ScreenConnect.Windows.dll
          • Size 1.7MB
          • SHA256 d7610baba5b37a3c52bc19aae6440e7631d1184a3934ebe64f836716b427490d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSID216.tmp
          • Path C:\Windows\Installer\MSID216.tmp
          • Size 202KB
          • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          e57d0bd.msi
          • Path C:\Windows\Installer\e57d0bd.msi
          • Size 9.6MB
          • SHA256 138a2a015376e48160e89b7979d22f67b6ad4e3c60ea7321049e085db0abaab7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 24.1MB
          • SHA256 fd506576ceb4d175c9598357c4e1953bf862c76d48cd4af8ef6039dd64a00147
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          {09c67278-7e47-4b80-9083-56ca75ab012b}_OnDiskSnapshotProp
          • Path \??\Volume{9a9105de-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{09c67278-7e47-4b80-9083-56ca75ab012b}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 52096c91849b83f5cb14f874575b67c39a77b8f25bc4f5a8471e97c52e67d4df
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/3944-131-0x0000000001590000-0x00000000015A8000-memory.dmp
          Download

          memory/3944-129-0x000000001BFE0000-0x000000001C18E000-memory.dmp
          Download

          memory/3944-128-0x000000001BDA0000-0x000000001BE2E000-memory.dmp
          Download

          memory/3944-127-0x000000001BA30000-0x000000001BA98000-memory.dmp
          Download

          memory/3944-126-0x0000000000E40000-0x0000000000EDA000-memory.dmp
          Download

          memory/3944-130-0x000000001D3D0000-0x000000001D556000-memory.dmp
          Download

          memory/3944-132-0x0000000002E90000-0x0000000002EA8000-memory.dmp
          Download

          memory/4660-95-0x0000000003F90000-0x000000000413E000-memory.dmp
          Download

          memory/4660-117-0x00000000043C0000-0x0000000004495000-memory.dmp
          Download

          memory/4660-115-0x0000000003E80000-0x0000000003EC1000-memory.dmp
          Download

          memory/4660-113-0x00000000041E0000-0x0000000004272000-memory.dmp
          Download

          memory/4660-112-0x0000000003EF0000-0x0000000003F58000-memory.dmp
          Download

          memory/4660-108-0x0000000003E30000-0x0000000003E80000-memory.dmp
          Download

          memory/4660-91-0x0000000003D50000-0x0000000003DDE000-memory.dmp
          Download

          memory/4660-85-0x0000000000EF0000-0x0000000000F08000-memory.dmp
          Download

          memory/4768-30-0x0000000003040000-0x000000000304A000-memory.dmp
          Download

          memory/4768-26-0x0000000002FF0000-0x000000000301E000-memory.dmp
          Download

          memory/4768-34-0x0000000005490000-0x000000000551E000-memory.dmp
          Download

          memory/4768-38-0x00000000056D0000-0x000000000587E000-memory.dmp
          Download

          memory/4768-39-0x0000000005E30000-0x00000000063D4000-memory.dmp
          Download