3ae957495178aa42d7ca7448842d5097ac4cca4f217efffd18f1fdd9d6b750c9

General

Target
24062026_1648_DocuSign-Updater.vbs.zip
Size 1KB
Sample260624-vbmbfsdw71
SHA256 3ae957495178aa42d7ca7448842d5097ac4cca4f217efffd18f1fdd9d6b750c9
MD5 9ef1a3f83944b61a01ef124f5c09a917
SHA1 c75f4b6defa85cfaa3fcc273a2098517b16dad67
SHA512 b6860642f8ba8ea15358a33839d7ce5a22cf38f6cbca61c40c8fd2af518005f59bcf65e3402c7cf1d31d83fb7e206b31cea6f1038be413a695050a58c1f9e42c
TLSH
T15E11B54240590DD2C433DF7D60D23EA2580EC51D89AA06AA72F84B9C1D73BEA4403FA7
MD5 SHA1 SHA512 TLSH

Score

8^/10

Malware Config

Targets

- Target
  DocuSign-Updater.vbs
- Size 1KB
- SHA256 a37576706c25fa8e777c58b7ea8ff006690f0017c4566ce1e1efda278abbd1c1
- MD5 38ee81c3a7a81042d682c6d84e27552b
- SHA1 f9e77f8de7c603d3fdd0ad42561639537e1ec987
- SHA512 3b06dae279fe31c05fb5b6314401c4ce1ab2e5a28e4475a9d35d91ebd99db23ddfdc82953a698ca0f1e5ffaa5450472ab77faa088c9132fb9e582f6f40cf983b
- TLSH
  T10231765E6649C225397341E3B253FC1ED673C48A1CA2A0277D25C48E2A311F8DB5E5DB
- MD5 SHA1 SHA512 TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation rat revoked_codesign
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Deletes itself
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2