b4348f7a82c75c29e4739ffcd7ede62cfa06ac6cab93500d95510be951d12263

General

Target
DOCSX_eStmt_20262992_859438.msi
Size 12.9MB
Sample260727-y4h2aadb33
SHA256 b4348f7a82c75c29e4739ffcd7ede62cfa06ac6cab93500d95510be951d12263
MD5 bfb971ffa5d75ad1510169551b960ba7
SHA1 3624bcd787adb2c2a83fbd9907bf6c269c00fa59
SHA512 1a56536af61e1cd842943ed7c7106b12e9d204dbd7ab4a43f8763f42409960744b14de9e0e93bbd4801d5976733cd1526f919fcd50f70163f5d02e0a4db04fe6
SSDEEP 196608:vnLYG3znhukO4rnLYG3z5rnLYG3z/rnLYG3zBrnLYG3zQrnLYG3zjrnLYG3zD:/DDngv4bDD5bDD/bDDBbDDQbDDjbDDD
TLSH
T1E2D6233267FD0918E1F36778ED3A91E291367C959F12D08F2610786E6871E8097A373B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  DOCSX_eStmt_20262992_859438.msi
- Size 12.9MB
- SHA256 b4348f7a82c75c29e4739ffcd7ede62cfa06ac6cab93500d95510be951d12263
- MD5 bfb971ffa5d75ad1510169551b960ba7
- SHA1 3624bcd787adb2c2a83fbd9907bf6c269c00fa59
- SHA512 1a56536af61e1cd842943ed7c7106b12e9d204dbd7ab4a43f8763f42409960744b14de9e0e93bbd4801d5976733cd1526f919fcd50f70163f5d02e0a4db04fe6
- SSDEEP 196608:vnLYG3znhukO4rnLYG3z5rnLYG3z/rnLYG3zBrnLYG3zQrnLYG3zjrnLYG3zD:/DDngv4bDD5bDD/bDDBbDDQbDDjbDDD
- TLSH
  T1E2D6233267FD0918E1F36778ED3A91E291367C959F12D08F2610786E6871E8097A373B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2