990112dc9c2c6e10da4c546e46f8afcea844444dd31e5dfff8c8ae9b07575a5b

General

Target
AR Statement.js
Size 6KB
Sample260730-l5ph8sgn9s
SHA256 990112dc9c2c6e10da4c546e46f8afcea844444dd31e5dfff8c8ae9b07575a5b
MD5 729b7b79134094f33f6852460c3800e8
SHA1 04d33031076c70715886525aeb5a9aeb73cf69b9
SHA512 644a4daaff83dca55a1ad038cd31f2d1fefc8ff05a672b038ea2111cd8a29cd77b0b339e07df3d16f7c89dc8b63ae0df76abcb1bdb26c9c57a0824b02c68a66b
SSDEEP 192:kl1Om1Ysn3FkrxR59RxL7NSfjpE4ODr4RXWE3ybcetvTUhmwVby:GFpnExRPBU1E4OO3JSUXy
TLSH
T169E122892FE06265162E1FBB7D7F92CCD16764DD688848AFF21069F05CD0232D9A1B35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  AR Statement.js
- Size 6KB
- SHA256 990112dc9c2c6e10da4c546e46f8afcea844444dd31e5dfff8c8ae9b07575a5b
- MD5 729b7b79134094f33f6852460c3800e8
- SHA1 04d33031076c70715886525aeb5a9aeb73cf69b9
- SHA512 644a4daaff83dca55a1ad038cd31f2d1fefc8ff05a672b038ea2111cd8a29cd77b0b339e07df3d16f7c89dc8b63ae0df76abcb1bdb26c9c57a0824b02c68a66b
- SSDEEP 192:kl1Om1Ysn3FkrxR59RxL7NSfjpE4ODr4RXWE3ybcetvTUhmwVby:GFpnExRPBU1E4OO3JSUXy
- TLSH
  T169E122892FE06265162E1FBB7D7F92CCD16764DD688848AFF21069F05CD0232D9A1B35
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery execution persistence privilege_escalation ransomware rat revoked_codesign adware spyware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2 behavioral3 behavioral4