ea1ec1817755d8b73dbac3c647c50ed2e4ba0ed504281a46449f2ea540d0da0a

General

Target
BigEnthra.ScreenConnect.ClientSetup.msi
Size 14.6MB
Sample260728-npn9msvgpc
SHA256 ea1ec1817755d8b73dbac3c647c50ed2e4ba0ed504281a46449f2ea540d0da0a
MD5 c958487fb4df18172507a0d7c759c1e4
SHA1 9113b0f431b2ac0727213afaf017807420b98252
SHA512 aee8f7e2265c078f9dd8d9111ec61085bcd3c47d0a589b2b739f91b7cfd16fab8b41bf58baec9b3b76194964a5fc61aa07a3b39b564c3dda2447793fe43608f9
SSDEEP 393216:RmkEdQ03NldBmkEdWmkEd1mkEdimkEd6mkEdqmkEd:LE2cx7EAEpEYEEEUE
TLSH
T188F6230573F8A108F1B72A36ED3A56F15C767D22CD62D25E1618364D2AB0EC18EB2737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  BigEnthra.ScreenConnect.ClientSetup.msi
- Size 14.6MB
- SHA256 ea1ec1817755d8b73dbac3c647c50ed2e4ba0ed504281a46449f2ea540d0da0a
- MD5 c958487fb4df18172507a0d7c759c1e4
- SHA1 9113b0f431b2ac0727213afaf017807420b98252
- SHA512 aee8f7e2265c078f9dd8d9111ec61085bcd3c47d0a589b2b739f91b7cfd16fab8b41bf58baec9b3b76194964a5fc61aa07a3b39b564c3dda2447793fe43608f9
- SSDEEP 393216:RmkEdQ03NldBmkEdWmkEd1mkEdimkEd6mkEdqmkEd:LE2cx7EAEpEYEEEUE
- TLSH
  T188F6230573F8A108F1B72A36ED3A56F15C767D22CD62D25E1618364D2AB0EC18EB2737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2