7a64f51ad67677b7d0aeab9c5b0e6844bcf6f3d0b0970fbf8d9f3052b6be152d

General

Target
DocuSignSetup.bat
Size 11.6MB
Sample260808-2dv5psff57
SHA256 7a64f51ad67677b7d0aeab9c5b0e6844bcf6f3d0b0970fbf8d9f3052b6be152d
MD5 6eb3349842db62405fe6eaafd808df74
SHA1 35267f9bf33ed3c337a3dbcf8319e4b8773de93a
SHA512 ba71c829fafb44b49f034158555cf7cb92f2d4a614f8575c32333e8dde6f199256b207bbb4d8bc5aeffc38f8e71fdcdc467db999848f9267f4ea674e478b4563
SSDEEP 49152:UWpsS4Fe/lrTJAAsVIdoL3Q3vUv/FFT0e4d8eKzXKulM8MleKwVGcKBv/iNyeK5p:z
TLSH
T1D1C6233A89466BDF0B1576A561097D026DD827635F41232EEB8C416138E86B0CF7EEFC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  DocuSignSetup.bat
- Size 11.6MB
- SHA256 7a64f51ad67677b7d0aeab9c5b0e6844bcf6f3d0b0970fbf8d9f3052b6be152d
- MD5 6eb3349842db62405fe6eaafd808df74
- SHA1 35267f9bf33ed3c337a3dbcf8319e4b8773de93a
- SHA512 ba71c829fafb44b49f034158555cf7cb92f2d4a614f8575c32333e8dde6f199256b207bbb4d8bc5aeffc38f8e71fdcdc467db999848f9267f4ea674e478b4563
- SSDEEP 49152:UWpsS4Fe/lrTJAAsVIdoL3Q3vUv/FFT0e4d8eKzXKulM8MleKwVGcKBv/iNyeK5p:z
- TLSH
  T1D1C6233A89466BDF0B1576A561097D026DD827635F41232EEB8C416138E86B0CF7EEFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery execution persistence privilege_escalation ransomware revoked_codesign spyware
- Boot or Logon Autostart Execution: Port Monitors
  Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
  persistence
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2