63473458bffa7660a28b518b3d6988e2fd3598b7d24640638e3de371f1fd229c

General

Target
31072026_0336_AdobeInstaller.vbs.iso
Size 366KB
Sample260731-d596yaan4v
SHA256 63473458bffa7660a28b518b3d6988e2fd3598b7d24640638e3de371f1fd229c
MD5 6cf42cf6fdaba28210de50c754c58d07
SHA1 a5a821f6804716e1121b7b0e42149912b6754c8f
SHA512 3c4ba264ab9a831fe30a6fa52bf5cea85ca9ae9518d357b2791cc3780ea3d40c158cd1a87c57415995f0e65dbe075bd2d9400ac79cafe2097dd155dc455d0d91
SSDEEP 96:58bAEluABpnFnSEYf5MkJreGAf/LDALdePHRG:ff60E0PeGKjDALde0
TLSH
T11984934B6B40826AF36987B643E2F45C9673F04364F1612BB12ED4671FE39A18F413A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  AdobeInstaller.vbs
- Size 1KB
- SHA256 21cd87454bb73dd2f91fd686d94275b6656bc733c2c3e4f96e555052745dd7d5
- MD5 c3257c42e5dfdb06ad790b5065295d37
- SHA1 f0e632ad3f9084c848245a85911a6f909dd2f8a9
- SHA512 681389461c9567f79485a6732bf8be13963f45db73e2cde70dae6f90eb38d861e033e299390955d54a07fcce69c819acd665ff864ce6302a289b702a61612f11
- TLSH
  T12E31868FA900C325735181A392E3F40DD9B3C4577801B027F61ED8575F61AB19F59793
- MD5 SHA1 SHA512 TLSH
Score

8^/10

backdoor discovery execution persistence privilege_escalation rat revoked_codesign
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Deletes itself
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2