Extracted

• • Target
    a5828e4832274385b9645d39434e8038a31692ed6ba9948c4ec00e87c70097dd
  • Size 2KB
  • SHA256 a5828e4832274385b9645d39434e8038a31692ed6ba9948c4ec00e87c70097dd
  • MD5 9bc11807516fddd62733db096809cb60
  • SHA1 ba84cf32e996fc009453a5ea9f11f40e619bc1b6
  • SHA512 12ce65f353d16b09a0f9a265e3e8cceb4b7c26a6fc0b3555f3aeba0e17c22d3033279c2ab5e9e0fb351443523bc963e9829826737752e6de8b9f1d464152ce99
  • TLSH
    T15441B81FA50AE378857302A6A067AC4DCBD110671B318834BA9CCD8D2F343BDE7A7597
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  backdoordiscoveryexecutionpersistenceprivilege_escalationrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2