3f2de9f29834ca7fb64dc53ac7415e9903b1cfb23e52b1b0a28dc08798c2f790

General

Target
MSTeamsInstaller.exe
Size 322KB
Sample260108-kx1e4aez3a
SHA256 3f2de9f29834ca7fb64dc53ac7415e9903b1cfb23e52b1b0a28dc08798c2f790
MD5 92d606c247f974c5419ed9ac461618a8
SHA1 9df02a107eb5b05420d29100409833243746e3d1
SHA512 d5f4ee26507307e913b172b3f9a68c7d0142085ba01a74c46a145adca6c8c1d4d8681c6880ac629d28916402fb18019ed0fd940ffbe75df312a2fa7c01fda2d4
SSDEEP 6144:jJ7B8JB00cyP8PxOv2ZgZhZyZZZZZZZZZ0bzNZlZDZdZe0Ut62gDlIYCAX:JBw002ZgZhZyZZZZZZZZZ0bzNZlZDZd5
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  MSTeamsInstaller.exe
- Size 322KB
- SHA256 3f2de9f29834ca7fb64dc53ac7415e9903b1cfb23e52b1b0a28dc08798c2f790
- MD5 92d606c247f974c5419ed9ac461618a8
- SHA1 9df02a107eb5b05420d29100409833243746e3d1
- SHA512 d5f4ee26507307e913b172b3f9a68c7d0142085ba01a74c46a145adca6c8c1d4d8681c6880ac629d28916402fb18019ed0fd940ffbe75df312a2fa7c01fda2d4
- SSDEEP 6144:jJ7B8JB00cyP8PxOv2ZgZhZyZZZZZZZZZ0bzNZlZDZdZe0Ut62gDlIYCAX:JBw002ZgZhZyZZZZZZZZZ0bzNZlZDZd5
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

backdoor discovery execution persistence privilege_escalation rat revoked_codesign
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Sets service image path in registry
  persistence
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2
- Target
  $TEMP/agent.js
- Size 4KB
- SHA256 29fcf08c52e35089c4d0c94bc02e8107efc4d222dd6d545de145876d0413f167
- MD5 85059e4dd8ec3a876a398ce306d285ca
- SHA1 cd4e7587f1609909fd7f6a86a1090613dc117ddc
- SHA512 0656c3c3a5891fc0bc0b3c6a685744827e221a0e73479616f3a4952883a51883a2d2be6ea693273df7ba12d4a95dd2a9deec87ea2a8c82508d51f08071b550f5
- SSDEEP 96:INiHwy4nKhzsigwYGiX3wUtXKV0fVC0KlWVcm:IN44nWYiz5iH9tXKOfVC0K8cm
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

backdoor discovery execution persistence privilege_escalation rat revoked_codesign
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Sets service image path in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral3 behavioral4