8e5cb59f2b2bca9b970d5918dd2e0d8667a1f319fb7a8c6290c8ae1df0e04f0a

General

Target
ScreenConnect.ClientSetup.msi
Size 11.1MB
Sample260623-w1jsasft9w
SHA256 8e5cb59f2b2bca9b970d5918dd2e0d8667a1f319fb7a8c6290c8ae1df0e04f0a
MD5 9778a46c5aff90a51b69eab214861f32
SHA1 9d85e496f465774e831d562a5b3313e3b5b15354
SHA512 a522044fdcd8ca595ec98f23cf6883126ed52f3580aceb183074ae36637da5e3e402830ec5761965e5289a0fb134f5a808156435afd903a4e684390c9e64ea1c
SSDEEP 196608:7Hxcp9ym3nltDUJVtHxcp9ym3LHxcp9ym3BHxcp9ym3JHxcp9ym3wHxcp9ym3:FGplpCGpVGpzGpbGpeGp
TLSH
T170C623116BF89678F1F22A35E876A0B1A5367C119E23D12E2324791E2C75EC0C9B3777
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ScreenConnect.ClientSetup.msi
- Size 11.1MB
- SHA256 8e5cb59f2b2bca9b970d5918dd2e0d8667a1f319fb7a8c6290c8ae1df0e04f0a
- MD5 9778a46c5aff90a51b69eab214861f32
- SHA1 9d85e496f465774e831d562a5b3313e3b5b15354
- SHA512 a522044fdcd8ca595ec98f23cf6883126ed52f3580aceb183074ae36637da5e3e402830ec5761965e5289a0fb134f5a808156435afd903a4e684390c9e64ea1c
- SSDEEP 196608:7Hxcp9ym3nltDUJVtHxcp9ym3LHxcp9ym3BHxcp9ym3JHxcp9ym3wHxcp9ym3:FGplpCGpVGpzGpbGpeGp
- TLSH
  T170C623116BF89678F1F22A35E876A0B1A5367C119E23D12E2324791E2C75EC0C9B3777
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2