5d21ca06ff3ab295db8cce49765963ea9702b51245908d74ad7726afee763542

General

Target
23082026_1626_18082026_Acrobat_Reader_EN_Setup.vbs.zip
Size 1KB
Sample260823-txvdhsybna
SHA256 5d21ca06ff3ab295db8cce49765963ea9702b51245908d74ad7726afee763542
MD5 7e9cf4aed283e50329d7c8bd538f214b
SHA1 f8a616fd33922213f7fe257620f184875fcc6d9e
SHA512 3ae2865bca582b5512f5c880cb4dff262bccbcfe211361dcaafaed35c916b2d56c6ae44c9f99c60edbd387c63f7b7f7c400860e59d1c4dcf0075b7097dae10a8
TLSH
T17C31FA4F9EC008E4CAAE9EA6F4B7B316830E56C056046B57D7E1EAF7B4895247B0413E
MD5 SHA1 SHA512 TLSH

Score

8^/10

Malware Config

Targets

- Target
  Acrobat_Reader_EN_Setup.vbs
- Size 3KB
- SHA256 e1c06253455b3d75bb45f329c39a7173e732468c7aab723c56db8fe54ea3f79c
- MD5 69fdb944ac8fb6053052395e42b3f71f
- SHA1 630608414f188151dacb749da1d2da6fdd5820c5
- SHA512 83d1940c5bdd742bda0ab947fd482fcc446bd546bd8616f069749cc5b5ff5897990c120484ba2c3785668dc299380b3ab9cfec85d298f38c9fd312c63a5bc95e
- TLSH
  T1C281B813BB07DB508773859AD1D7640CC2AD723B261828397C9CC5550F3679A62D1ECF
- MD5 SHA1 SHA512 TLSH
Score

8^/10

backdoor defense_evasion discovery execution persistence privilege_escalation rat revoked_codesign
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2