323acf5cf10eed20a3a634e06c0d6e20fa7d7c0ab61e9af6650961ef56a2fb28

General

Target
Adobe-Acrobat_a577563d.bat
Size 1KB
Sample260718-b7pxnsct4p
SHA256 323acf5cf10eed20a3a634e06c0d6e20fa7d7c0ab61e9af6650961ef56a2fb28
MD5 1d511ca7d7d5547c4e6d50cfdbfab742
SHA1 ae61acb5aaf17028c184b4dcc72e3a63f251fcb7
SHA512 ee8e15509ceacc1928c09c967b1b30670e9acaac0cccf6715461927efcbd8daad9d6ee999ed02e109ad8845ec7593a90884dc9fdc9aa4d17cf29817185c0efd6
TLSH
T12A2177E3921017D8C2E51454D86567CD617FEE8C1A0E6F7006F497D37DA57F80836C49
MD5 SHA1 SHA512 TLSH

Score

8^/10

Malware Config

Targets

- Target
  Adobe-Acrobat_a577563d.bat
- Size 1KB
- SHA256 323acf5cf10eed20a3a634e06c0d6e20fa7d7c0ab61e9af6650961ef56a2fb28
- MD5 1d511ca7d7d5547c4e6d50cfdbfab742
- SHA1 ae61acb5aaf17028c184b4dcc72e3a63f251fcb7
- SHA512 ee8e15509ceacc1928c09c967b1b30670e9acaac0cccf6715461927efcbd8daad9d6ee999ed02e109ad8845ec7593a90884dc9fdc9aa4d17cf29817185c0efd6
- TLSH
  T12A2177E3921017D8C2E51454D86567CD617FEE8C1A0E6F7006F497D37DA57F80836C49
- MD5 SHA1 SHA512 TLSH
Score

8^/10

backdoor discovery execution persistence privilege_escalation rat revoked_codesign
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2