96386b1ebec5544c5523dec9ed7cb5e0b83263bb6da4d92ea8896510c06bf093

General

Target
Message.eml
Size 29KB
Sample260708-tpblfacs5l
SHA256 96386b1ebec5544c5523dec9ed7cb5e0b83263bb6da4d92ea8896510c06bf093
MD5 adb382fef983224f464f6de72cb65e74
SHA1 ae973f1c0d5276efebf27a0a67cf87c9c9e9ef04
SHA512 d625754353930f72653fd8d0206be855ee7d0a4640acfe257ab6c21c3b438588dac217c4faa27175ce07a6ef4e8be82a1bfb106f039a307eb582c4971a03af1e
SSDEEP 384:xNZNLufUvdeRkDrNFfusEg4abUOESHDJLMVRtHJalVaoXoAg:xNZNLufUFew5FfFsWUO4HJ0oAg
TLSH
T1CED23C40C3414087EBB60589BD30699951926F7ED6FF9894BC7B60759DCB2FA2B083CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Message.eml
- Size 29KB
- SHA256 96386b1ebec5544c5523dec9ed7cb5e0b83263bb6da4d92ea8896510c06bf093
- MD5 adb382fef983224f464f6de72cb65e74
- SHA1 ae973f1c0d5276efebf27a0a67cf87c9c9e9ef04
- SHA512 d625754353930f72653fd8d0206be855ee7d0a4640acfe257ab6c21c3b438588dac217c4faa27175ce07a6ef4e8be82a1bfb106f039a307eb582c4971a03af1e
- SSDEEP 384:xNZNLufUvdeRkDrNFfusEg4abUOESHDJLMVRtHJalVaoXoAg:xNZNLufUFew5FfFsWUO4HJ0oAg
- TLSH
  T1CED23C40C3414087EBB60589BD30699951926F7ED6FF9894BC7B60759DCB2FA2B083CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  email-html-2.txt
- Size 15KB
- SHA256 7ceb0c4ad9ad065864a95d9a941cc97a8d89a02a4a883caf5d5834df38216472
- MD5 05679d74827f1254ee4a7d793e5ef7cc
- SHA1 522956074962984359511ddaf5694eb105e46da2
- SHA512 b921475f6a197031c8a80e9cbdc864e8e8ab4343d30b2d3cc077bc11b4b54a80d18140476a3279f1de180ecd35200ec289bf554ae3c5504b464c2f969f95ac3b
- SSDEEP 192:iaMPtHp40R46aeJRehVInokfp/k4oxUpUM7TbdXQDF8Sj+Ig:Pa7XJReXax17fdXQZC
- TLSH
  T1BB62B450C381881AEA6A0889F63196E95143437B5FDE8D18FF794137F59B3F617082EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  email-plain-1.txt
- Size 390B
- SHA256 32afdaf7a73f81476b4b11174e08002f5f9b5415b9822eb88d53f95191e27150
- MD5 7a194dca40744dd1957568fdb2af2c54
- SHA1 b9ee412242e93fec8e48afce6e60e65c504d82b7
- SHA512 274f1c6bb9d747d17926ebf65ea50a63860526c52d8225416fcd6a807cc41481352b4e9b3a1b30d45e80e5851de0ae39fc0cf0e8c0dd3bc2a24735972cede1a1
- TLSH
  T121E065A9F33742658A32775D5CA85EE4C3E76304B60C198FFDD0422804B942D163B02F
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6