010e1b1bfa1956cb88e36f93c2a3459bdb0307dc08c319680fe4e185d404a613

General

Target
security.ClientSetup.msi
Size 13.1MB
Sample260522-laf9daa161
SHA256 010e1b1bfa1956cb88e36f93c2a3459bdb0307dc08c319680fe4e185d404a613
MD5 60d8ba129a80c5dd035fc81c0b255866
SHA1 0badaedeeae5821c0ea3c4a52b04f6e7f2c8601b
SHA512 34627032f2a69b5705e17023fe273d268365b4cad377d68d0f3bb1dfbdc16aad11e83182c9be194185cdb0861caca34002ef94297c011fb5d001c9e21b8c7341
SSDEEP 393216:CH2ET0H2ETNH2ETmH2ETeH2ETsMH2ETsyH2ETsL:CHfT0HfTNHfTmHfTeHfTsMHfTsyHfTsL
TLSH
T132D62321A6FE4624F5F21A30ED3AE1A14A7A7D118A12D17F2364380E3971F84DA73777
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  security.ClientSetup.msi
- Size 13.1MB
- SHA256 010e1b1bfa1956cb88e36f93c2a3459bdb0307dc08c319680fe4e185d404a613
- MD5 60d8ba129a80c5dd035fc81c0b255866
- SHA1 0badaedeeae5821c0ea3c4a52b04f6e7f2c8601b
- SHA512 34627032f2a69b5705e17023fe273d268365b4cad377d68d0f3bb1dfbdc16aad11e83182c9be194185cdb0861caca34002ef94297c011fb5d001c9e21b8c7341
- SSDEEP 393216:CH2ET0H2ETNH2ETmH2ETeH2ETsMH2ETsyH2ETsL:CHfT0HfTNHfTmHfTeHfTsMHfTsyHfTsL
- TLSH
  T132D62321A6FE4624F5F21A30ED3AE1A14A7A7D118A12D17F2364380E3971F84DA73777
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2