63e2e2c1edd25a97d350db9c50d4dace743a2bc80ae6529b9eb517e2acee9d11

General

Target
ScreenConnect.ClientSetup.msi
Size 11.8MB
Sample260727-xa5gracg38
SHA256 63e2e2c1edd25a97d350db9c50d4dace743a2bc80ae6529b9eb517e2acee9d11
MD5 f28894b51532407b338ab0900557c7d5
SHA1 a1608c07616605200797809d057786dbc0af6cb6
SHA512 236353c952b3d1de4e85e83fbbd3aa47ad6d89f448abd5c9bd269dee6707994dfb14be3f58f294364de23bb1973dbd2caa0f0d2d77024d0e8043963a7df46203
SSDEEP 196608:Peq5KqDBCDkSt8QEWeq5KqDBCDkStOeq5KqDBCDkSt4eq5KqDBCDkStaeq5KqDBa:mq5VDBCDx8QEbq5VDBCDxTq5VDBCDxVn
TLSH
T105C6232267E8D425F1B60B3AEC3686B16B39BD00DF15C40F2364784D6972D91C2A37BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ScreenConnect.ClientSetup.msi
- Size 11.8MB
- SHA256 63e2e2c1edd25a97d350db9c50d4dace743a2bc80ae6529b9eb517e2acee9d11
- MD5 f28894b51532407b338ab0900557c7d5
- SHA1 a1608c07616605200797809d057786dbc0af6cb6
- SHA512 236353c952b3d1de4e85e83fbbd3aa47ad6d89f448abd5c9bd269dee6707994dfb14be3f58f294364de23bb1973dbd2caa0f0d2d77024d0e8043963a7df46203
- SSDEEP 196608:Peq5KqDBCDkSt8QEWeq5KqDBCDkStOeq5KqDBCDkSt4eq5KqDBCDkStaeq5KqDBa:mq5VDBCDx8QEbq5VDBCDxTq5VDBCDxVn
- TLSH
  T105C6232267E8D425F1B60B3AEC3686B16B39BD00DF15C40F2364784D6972D91C2A37BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2