General
- Target http://91.224.92.80/bin/support.client.exe
- Sample260620-ve73bsf12p
Score
8/10
Malware Config
Targets
-
- Target http://91.224.92.80/bin/support.client.exe
Score8/10-
Downloads MZ/PE file
-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
-
Signed with revoked ConnectWise certificate
Binary is signed using a ConnectWise certificate revoked for key compromise.
-
Executes dropped EXE
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1