56c5c731cc432e827c7c13017100778ffc5b6d5dcfcd55881f2950959a156f20

General

Target
InstallerBundle.zip
Size 27.0MB
Sample260808-k8y2eaxwft
SHA256 56c5c731cc432e827c7c13017100778ffc5b6d5dcfcd55881f2950959a156f20
MD5 3867c81e894aaf086288e979eca74d63
SHA1 6d99ae1cf2533832ed66ac7c77e5367e69ed61ac
SHA512 39d7c137862f730aca892ab1a2eb36ea946dd49d8404385aa12e2848340d7fba41780f6018840036b21dd19c9abae5295fbbdc86a89a159cb73a0f1a36efebfd
SSDEEP 786432:z8to7mJplB4HUEZhFwXW8/8j2K2LSXCBATde4u2iOpf:otoSJplGHU8hFe9/PLSSQ5
TLSH
T1D2573303E14EC14CCF4B20595269F4488BAEA866F17D6BB7E94CDF4E43B705701EBA68
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  release/DocuSignSetup.exe
- Size 27.6MB
- SHA256 db1733ee6d803df64f07e100da0a78d4a7b61c66a85497b8dd045b1b7e112cbe
- MD5 aab3cbfe3ca2b8de5140ea893c07bda2
- SHA1 f17a653059178f5e76e18f161b0c76cff0f1263a
- SHA512 4c50492a04b96798460c313d6435f0f48cc3d65b2747336bf4cdaabcfe38426bce822576211f490e7fe2930dcd05968c9a19616b1f9aa138bc356eaa6ae640ea
- SSDEEP 786432:+jCAjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdn:+jC+px56Bu61eGv1pjg6pd
- TLSH
  T125573322B1948039E7F71132A539E520AE7DFE246320C5AFE7C8AD1D2EB148157F7726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence privilege_escalation ransomware revoked_codesign
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2