d35b0028eea41fb0ca83ec68cd5fa749918c0be2191d93a66808095c94438a64

General

Target
ScreenConnect.ClientSetup.exe
Size 12.2MB
Sample260826-vecanazxht
SHA256 d35b0028eea41fb0ca83ec68cd5fa749918c0be2191d93a66808095c94438a64
MD5 ff92ad7903dec3812e85f45bc7503d3a
SHA1 4a8812ab3bb0377510c397e954daaa7e8d69de70
SHA512 d21dc8094cf68b20f383824d4269ab5487a01fb2d6c1d62b99556b762ed5871035c7db6d6adce45922a6ffc94553c8c1e3415a658b9555055169f240e4bc5e49
SSDEEP 196608:+ofefP1xy9srq4aE7b/ww3caMUxy9srq4aE7b/w/xy9srq4aE7b/wzxy9srq4aEM:+DpWE//53cPUpWE//0pWE//epWE//M
TLSH
T1FCD61212B3E566B5D0BF0A39D87A56A56631BC045B52C7BF13A4B92D2C32BC09E31373
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ScreenConnect.ClientSetup.exe
- Size 12.2MB
- SHA256 d35b0028eea41fb0ca83ec68cd5fa749918c0be2191d93a66808095c94438a64
- MD5 ff92ad7903dec3812e85f45bc7503d3a
- SHA1 4a8812ab3bb0377510c397e954daaa7e8d69de70
- SHA512 d21dc8094cf68b20f383824d4269ab5487a01fb2d6c1d62b99556b762ed5871035c7db6d6adce45922a6ffc94553c8c1e3415a658b9555055169f240e4bc5e49
- SSDEEP 196608:+ofefP1xy9srq4aE7b/ww3caMUxy9srq4aE7b/w/xy9srq4aE7b/wzxy9srq4aEM:+DpWE//53cPUpWE//0pWE//epWE//M
- TLSH
  T1FCD61212B3E566B5D0BF0A39D87A56A56631BC045B52C7BF13A4B92D2C32BC09E31373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery execution persistence privilege_escalation ransomware rat revoked_codesign
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2