260e7de046acea354f9b1a3560a81b3f3c73222d2b7aa9597bd7b6ce4ded436c

General

Target
BLUEMOUNTAIN%20INVITE.zip
Size 21KB
Sample260713-pgz7lsaz2w
SHA256 260e7de046acea354f9b1a3560a81b3f3c73222d2b7aa9597bd7b6ce4ded436c
MD5 57a76ad2be6d5d1ee99c61aeb92eb22e
SHA1 3973e84228ba6d64fc3d0ef228a3ba474b7c5b43
SHA512 ed1df65a43e60a91516135bee1dab840fe0da10db93d22af2b756fc697bf28de3b27dffdcf852c33372bbc5ad4f3b017544bf50ed4763f2de99c7d73a8f66d5d
SSDEEP 384:uELIKoB4vZYrygwSxo0q++Ltzl83kRZXdUZFE4sz1k1bqcgYOd6MD2DbZaG0nst:uELIK1g7x/q+azl8URZ2Z+nzCke88/Zj
TLSH
T14EA2D07869791ED3C14DBB79A57F2849900F5F1135113C29AD20BE8CE69F0D4CAF0B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ic/InviteJuly26.bat
- Size 1KB
- SHA256 415da0881ae2019a096bba596c1643fee0ec44d08682f748f88a39665d99a375
- MD5 39f4e4bc7c393ccdc480a047e0351dc0
- SHA1 a3ced797cfffaf2179a36d4256ab3b4887f350e6
- SHA512 6befcade528027a4f1c9819b0a8a68c0c638b6bf04c8ffbde7aa61c9d0a9aab25928837c8a663f91d8918d3fb73118530f559fabd7779b910aff489583132cac
- TLSH
  T11821748336A017ED47E78874D871A39CA66BA9C51B0D77F223B490A23C25FF48859C88
- MD5 SHA1 SHA512 TLSH
Score

8^/10

backdoor discovery execution persistence privilege_escalation rat
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  ic/index.html
- Size 38KB
- SHA256 4473a4b3e3b4c5fe3fe1e9d033c223c1d3f7b2bd532b71e950c740c4164ffc06
- MD5 923500b685f8f414f04886b2c6671264
- SHA1 1f1706e1624bbfdd1ef240f4aa6a89d6ad61f8bb
- SHA512 b8ecf2bb6c93790f806be9b177872c6e360889cda92279f4a0e8e61e73ee9982f81cdc2e21b8f5c81689c394396e9ca997a144a74c722c17a12a62fa4d5df29d
- SSDEEP 384:M6K/uOwORSrIGU/p9ogUSiiM3ru45XbjkySVYM:tK/uOwORCU/fUSLM3qikySVr
- TLSH
  T12303F99F19775026A817557B27EF274A32249003D90BCC587FDD6348CFC529CA8F2BAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral3 behavioral4