0ce3b8a0893b99502ffd282af9bfcbffefe1b01d61166df7c29b6004af7348ce

General

Target
ScreenConnect.ClientSetup.msi
Size 12.9MB
Sample260711-amaftabs2v
SHA256 0ce3b8a0893b99502ffd282af9bfcbffefe1b01d61166df7c29b6004af7348ce
MD5 54c5fb5356920658bcbdfc7441a4a4d9
SHA1 71ca1d3359d46dfc7ed270a7bec4b716d8a1e671
SHA512 ae1d6ea5c1bc54e9c7014f16e4a9baa62d85a0f332e2865db25b2ea9673ad6eaa8f1f5bfdebd62d39f1f17f63fa43f2be69bf2e71fef8159e2a77453104d1b58
SSDEEP 196608:DWh0cGwXWh0cGSWh0cGQWh0cGLWh0cGMWh0cG8Wh0cG0:DWacBWacnWacDWacYWac5WacTWacl
TLSH
T16BD6221313AD4D5BE8B6CBB9FF3682A45B627E54CE11F1DE5224790E2F3094085A23B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ScreenConnect.ClientSetup.msi
- Size 12.9MB
- SHA256 0ce3b8a0893b99502ffd282af9bfcbffefe1b01d61166df7c29b6004af7348ce
- MD5 54c5fb5356920658bcbdfc7441a4a4d9
- SHA1 71ca1d3359d46dfc7ed270a7bec4b716d8a1e671
- SHA512 ae1d6ea5c1bc54e9c7014f16e4a9baa62d85a0f332e2865db25b2ea9673ad6eaa8f1f5bfdebd62d39f1f17f63fa43f2be69bf2e71fef8159e2a77453104d1b58
- SSDEEP 196608:DWh0cGwXWh0cGSWh0cGQWh0cGLWh0cGMWh0cG8Wh0cG0:DWacBWacnWacDWacYWac5WacTWacl
- TLSH
  T16BD6221313AD4D5BE8B6CBB9FF3682A45B627E54CE11F1DE5224790E2F3094085A23B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2