97e72ffb10784a4fc35c084532e21cd2eb49e75d9ccf879492d8e0db27aa331c

General

Target
InviteEcard_loopback.zip
Size 3.8MB
Sample260812-ndcfpsvhlb
SHA256 97e72ffb10784a4fc35c084532e21cd2eb49e75d9ccf879492d8e0db27aa331c
MD5 a030e55b156aec6dfa6eb646d00a2404
SHA1 8fcfb40ba5a83277af48c7e44ecbe92f810d4f43
SHA512 0ac07e763e308413fca90a77a7095d9268a850177e4781b07dd26035ba3cafb8dc7b80c1f986f7d83ed560996ec26f41714422e45aea1c95deeb70e93e71d8ad
SSDEEP 98304:E+eKt5NSNLsyu/fZwgFioDigzLOkuhoXZDif:EbY51yWfZlJLpMoXxif
TLSH
T19D1633E4B5FB17A5E944CD776C51BFF8640EA23C01719B096961DFACBE0AF0A998031C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  EnableLoopback.exe
- Size 87KB
- SHA256 f8ed4cb272e52b7ef2b1c2672dbc6ace9f3ef752a38ce535265cfab891c9cbff
- MD5 13072c3b2a5a405b32a60d8cf1631bbc
- SHA1 6996ab027fe913cccb9f8e26ad0e9491d4a609b1
- SHA512 337311e0b2c0a22b749930f7212b5040d27c2b997404dc8cecfbbf89c86f2f5d5077d6157090078a8421acaa23850b24f963ba1b984b0600e9b80505bdb125c5
- SSDEEP 768:HzEI16zcI2eTcvEWm/ljPjOPAxr25znrSh7ANg3CqnZ+6qmmlG0KdFumjDdFWf1:F1H5MiP1zrSh7WwZ3xmlGddFjjDdFWf1
- TLSH
  T1359339403BE84276FAFA8F749572E0104A79BDAA99B0D6CD2CD5A49F19F3B408321717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign adware spyware
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2
- Target
  FirewallAPI.dll
- Size 5.4MB
- SHA256 54bb61ca3086d170a2b412c59d139676dc30ab2f081fd341cf3e2798cb386980
- MD5 2e0089a78b2ce4c742212a47be88f10e
- SHA1 b5ab806783836e0873ed3bda353f22c9cefa3963
- SHA512 4ac6584ce80e8d7c8e72fb7b661ac50c420e5a4ee6df1463ccd6f7a80397c12ff1af96f4f4a697d6c34bc151bce0b28cc0d21fe543072d540a46f192c258f54f
- SSDEEP 98304:yIJeFosfCjborfFm8tpXi+pO8K8RkGKkOg7:XQqefFvVe8aD/g7
- TLSH
  T1E946F1B2F975211CAA7D1521B1F864E88B1B3A4CB8040F67396CF66E3DD39533E4252E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral3 behavioral4