6aba72d89fdc0cf61e5b51cb1cd05ab32861d71433581ff8dab81c594f473928

General

Target
e58ac3c.msi
Size 13.0MB
Sample260721-xt7q8aed66
SHA256 6aba72d89fdc0cf61e5b51cb1cd05ab32861d71433581ff8dab81c594f473928
MD5 363df012f6c186f2a0885281e374a868
SHA1 ac41f5ffc0c2d08422faaeeda49c60e46bc69571
SHA512 14ca7ad7e20d00c07729624a74f559a432d03eecc398023c7e9190f69d9d6504db0787868e54d8454bd264e3bc7f98639a674858e485780c48b82dbc2090eab4
SSDEEP 196608:EHxcp9ym3nltDUJVEHxcp9ym3DHxcp9ym33Hxcp9ym3eHxcp9ym39Hxcp9ym3THk:iGplpPGptGphGpsGpvGp9Gp
TLSH
T1A1D623116BF89668F0F22A35E876A0B1E5377D125E22D12E2324791E2C75EC0C9B3777
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  e58ac3c.msi
- Size 13.0MB
- SHA256 6aba72d89fdc0cf61e5b51cb1cd05ab32861d71433581ff8dab81c594f473928
- MD5 363df012f6c186f2a0885281e374a868
- SHA1 ac41f5ffc0c2d08422faaeeda49c60e46bc69571
- SHA512 14ca7ad7e20d00c07729624a74f559a432d03eecc398023c7e9190f69d9d6504db0787868e54d8454bd264e3bc7f98639a674858e485780c48b82dbc2090eab4
- SSDEEP 196608:EHxcp9ym3nltDUJVEHxcp9ym3DHxcp9ym33Hxcp9ym3eHxcp9ym39Hxcp9ym3THk:iGplpPGptGphGpsGpvGp9Gp
- TLSH
  T1A1D623116BF89668F0F22A35E876A0B1E5377D125E22D12E2324791E2C75EC0C9B3777
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign adware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2