42e76c75c0b58c86fb8e97463ebadefb661605fba1f91bcf4229086425176293

General

Target
Docusign_Required_Ln_47639_JULY.zip
Size 13.2MB
Sample260728-g47afazepe
SHA256 42e76c75c0b58c86fb8e97463ebadefb661605fba1f91bcf4229086425176293
MD5 8d022818ba1d4db82983d8a0be5e03aa
SHA1 f9975fbf5e26acd7a1b0bcdb6d53955b3a1f9b8b
SHA512 280094caa5af2e20573b10c89807f1f8fc3125101d16e4f127e6cab7efee00860dc803d46c655c66850495ef26844cb40a01f33b71ae0980d9b157f9fba9ff07
SSDEEP 196608:yM53qGN4zUVX5R/xeTim5SRU/ez4PXi4JAzYz0LTYM583kz8H/+5xyPKz0/q7Y0o:ysZ5RxzATClK9hqk0vMAG/f
TLSH
T1D2D633215533B55AA999103C3990F3E3A60AC15CC3F0667BE23AD73CBC96631DB50ADB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Docusign_Required_Ln_47639_JULY.exe
- Size 87KB
- SHA256 f8ed4cb272e52b7ef2b1c2672dbc6ace9f3ef752a38ce535265cfab891c9cbff
- MD5 13072c3b2a5a405b32a60d8cf1631bbc
- SHA1 6996ab027fe913cccb9f8e26ad0e9491d4a609b1
- SHA512 337311e0b2c0a22b749930f7212b5040d27c2b997404dc8cecfbbf89c86f2f5d5077d6157090078a8421acaa23850b24f963ba1b984b0600e9b80505bdb125c5
- SSDEEP 768:HzEI16zcI2eTcvEWm/ljPjOPAxr25znrSh7ANg3CqnZ+6qmmlG0KdFumjDdFWf1:F1H5MiP1zrSh7WwZ3xmlGddFjjDdFWf1
- TLSH
  T1359339403BE84276FAFA8F749572E0104A79BDAA99B0D6CD2CD5A49F19F3B408321717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2
- Target
  FirewallAPI.dll
- Size 13.6MB
- SHA256 08fad81fd4d5b3081369172f4f7cbdb68435df9cf352b4dd6a3a4f3d4769707a
- MD5 dcf0905341240deae7846e94833fc446
- SHA1 7ae1727f7305a67cfa0e8d166c27ccc08f395632
- SHA512 e0ac358df1f8d64eb720312c297931e7150b60c93b2e82a9e28e40176afd5a7232a67136626f87b85921f30a215c3bd4b3e1504fbba29af8caf79238837d6848
- SSDEEP 196608:iyunmfQzyv3mzVDxfT0yunmfQzyvKyunmfQzyv7yunmfQzyvHyunmfQzyvdByun6:iGqdxwGIGVGxGJGOG
- TLSH
  T1AAE6233CF02F7B36FB4934B81552FEA2E535C0D8436362FF6854071BE699420BB925A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral3 behavioral4