c761a050842f58785d329cc3bcb57d720d7705c43d2d8f47a466b2ba5997fb09

General

Target
ALL%20CONTROL_PDF.zip
Size 1KB
Sample260511-pgwjesc15k
SHA256 c761a050842f58785d329cc3bcb57d720d7705c43d2d8f47a466b2ba5997fb09
MD5 0b835c54f4a2c13b7bee26fe8c602e8e
SHA1 bfe77f820d894d0d3e14ca21059bca7668e95085
SHA512 12e164c799f79862aed2db86e61773864468cc689ed64edc431bca227e9eefed432194b706bf8e34c90685c56663d8d509306b4eaebce70c98286a81de21ce88
TLSH
T1A23138280F17233FFEBE48F205A70000ED0E6EA200964D8A1BC2E9B9011ABFCAD74557
MD5 SHA1 SHA512 TLSH

Score

8^/10

Malware Config

Targets

- Target
  ALL CONTROL_PDF.vbs
- Size 9KB
- SHA256 f212271b0b43e80ed845aa34bf1f420ed2e9668b2642f4c0347979d250e2e3e9
- MD5 0ecbd65df2469113d4bc3ca0af0f1fda
- SHA1 7605d82dc7d45216d1e247c9fdafcf2e457cad33
- SHA512 3686929072b27f2758b4c7a596154c399c324fe2b819fe05d9d12f7fd67b14d1b1b3c90272af2448f5560ce42a2545de1748637e19da858618874ef0c0354a93
- SSDEEP 96:Cv51WpDNFoaeidIR1WD6jkAyEwsTSFccs/+lCbOGf9LDNCbcQ6BAbfJBzh8GiWW9:PSZ5P+mH3CuAHCnWP5Fq9
- TLSH
  T1B01244D840AB06FA67CBDF689295683D1E56A3CF04C273B8C5C6D0EF3BD5F9440648A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery execution persistence privilege_escalation rat revoked_codesign
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2