a149d74f6ce7b4cec8350d4cfbafe5da5346bf95920800460f7e1b005d6f8dac

General

Target
sample.zip
Size 987B
Sample260625-p33vmab15s
SHA256 a149d74f6ce7b4cec8350d4cfbafe5da5346bf95920800460f7e1b005d6f8dac
MD5 7c76fda7bf583563ab03d18ff2521b3b
SHA1 ccb5c37c842369c9b77618771819381a86f104e5
SHA512 1e9e4e3cb47524fa1eab204a1928a467ff730bad14772f06608362007b8e26f3f461ffd73fc8f563041df3652e91e72b9709d72ffdbc31b7800af7ebd3cc5af3
TLSH
T17A116784610924E2F027D3B064D00BC1AC7899C36BA51C2E81663ED80973BA31E5ABB9
MD5 SHA1 SHA512 TLSH

Score

8^/10

Malware Config

Targets

- Target
  88 Chinnes Payroll Summary.pdf.lnk
- Size 1KB
- SHA256 0f38fddd82fa746492f03db7660d2f4645fa04fc2e23056d6997209893188a60
- MD5 aaaabf733e10ec949c5ead8e869ea682
- SHA1 788a369060973f73f7d9ecbec712bfd3ed6558da
- SHA512 ee59a53a7e32ccabe2f8966697aec0895f989ee6d6bdf3987183178b3550be26fbd041047ec07ebdcabdbb9d3f8413eb0dd53c9ea6eb751e48517e0e37a7003b
- TLSH
  T10A212B5006E43724D3F406386C7E91D0DE777C069BA0434E1085414D09B2A388871F77
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware backdoor discovery execution persistence privilege_escalation ransomware rat spyware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  connect.bat
- Size 551B
- SHA256 5d30dfbee3f9ef74800b3b86ee7ab4fcd88ea65f995acd1ab424f488b7ef6bf0
- MD5 497e96c17c5e92152ac9a189d111565a
- SHA1 f343d605a7ed632526aceaa7c274ebc7a2da29f0
- SHA512 05fbc1f78ba3c90b80204d4b9f7bda168bf42b10d51914cd0060fe5c0327118748f3a4ec7927c463c9f7d12c5911a879b991187181207a7b0a2818a4f39b6693
- TLSH
  T1AFF08B63114A217088FF51D1CCAFA746AD55E8C0930E70B332A89926AD013EF479E8C2
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery execution spyware backdoor persistence privilege_escalation rat
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral3 behavioral4