2b9da80c8f7aba94ab3345287cf47d552ff7fc9f6ec517a55db039dd8ed1b011

General

Target
10072026_0330_Pdf_Reader.js.iso
Size 68KB
Sample260710-d2j6cady3z
SHA256 2b9da80c8f7aba94ab3345287cf47d552ff7fc9f6ec517a55db039dd8ed1b011
MD5 20b39e9597682caaa78e7de4f1558331
SHA1 1967cc56ead4a82f27350aded2a700b1452da6e4
SHA512 0dfe34f454f252ed1d3e8024e541c5735db9fa28fa23170a7a8446c2e1c977c4e90a0089c4516968090ad5d3fb7689808d96030caf38aa363dc0cdb107af552b
SSDEEP 192:fIBgg1u0pCHSlzfLqAqcZqg09RYmv2oBBkzxRbA7:fh/0vfA9eEBkzxRbA
TLSH
T1F6634F898E4024A5DA32B778CB6AE12CFA67756716B4D215B88CE4085F7307092F4FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Pdf_Reader.js
- Size 7KB
- SHA256 c43dd1538dfd39a534ea88696c8effb0a238989fe003fd9e6655a96f6499bc07
- MD5 7454cd6022c4e41ecb17edb5676dd111
- SHA1 26fe2d9cad9d0d775d506bd6d78fd8fbb165142e
- SHA512 3efcd959b5c858fbdbde67a01d27cad43a329f08381d1e8a8a0b9c968d068d61a50c882b73a1eaf766b243cb6c89b3de2533ad41a3c7ea3a3885c89e0b51247c
- SSDEEP 192:hg1u0pCHSlzfLqAqcZqg09RYmv2oBBkzxRbA7B:h/0vfA9eEBkzxRbAV
- TLSH
  T122F14E8E8D4564659A33B7B8CB6B911CFA6725771A04D250B88CE0486F31474D2F8FFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery execution persistence privilege_escalation ransomware rat revoked_codesign
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2