Extracted

• • Target
    Docusign-8901123adobe-reader07zuillnirusi.bat
  • Size 735B
  • SHA256 d63a6524fd2805a69f62b34263583994318a4850a38c4aebf4b7ece9168da8b0
  • MD5 ce4f2d7344b782016ab0dbb01fa8c281
  • SHA1 7215e588246aa7eaf4efb80d318d05f4d3eeba62
  • SHA512 19955564fd0e254fd87474378688a5543ea13b19cd9f5eea0e5730153648c04d25709476d7768b8b17c78813579fc6209d56bd925170ff9f64b41ceb67ac1147
  • TLSH
    T1F7011A1352D025758DDB9795F4564342BC6E2456D2061103737D8830DD902FFDFE8DA5
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  backdoordiscoveryexecutionpersistenceprivilege_escalationrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation

  • Drops file in System32 directory

  behavioral1behavioral2