6374eb353f02c7b26e00697a32f4a4f613402ca0296f5f10afdb3243f729c1b9

General

Target
file.exe
Size 33.9MB
Sample260831-zhm9jsad35
SHA256 6374eb353f02c7b26e00697a32f4a4f613402ca0296f5f10afdb3243f729c1b9
MD5 a56af1b76500fad38edb4958e6a29399
SHA1 98bf6e4cfe91f5a1154ae0e168437b81318dd24b
SHA512 d3eb2995f86009eb07b74ef0710c6e447361e3dbc83bfb0dd4192cf9a648ac9dbcf5117d5cc1e754df85100aef970a9e5a745679dc719aeacf0d18b2c7109b1f
SSDEEP 786432:iuML+5XoeOvHiwB3sn+h19W25F+wX0ff6yajCs6+4S3NftN:i5WoeeCwDr9WG+tf6fj4ulN
TLSH
T116771256E2FD00E8D5BAC0BCC6575517EBB23459173097EB52A48A692F33BE0AE3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  file.exe
- Size 33.9MB
- SHA256 6374eb353f02c7b26e00697a32f4a4f613402ca0296f5f10afdb3243f729c1b9
- MD5 a56af1b76500fad38edb4958e6a29399
- SHA1 98bf6e4cfe91f5a1154ae0e168437b81318dd24b
- SHA512 d3eb2995f86009eb07b74ef0710c6e447361e3dbc83bfb0dd4192cf9a648ac9dbcf5117d5cc1e754df85100aef970a9e5a745679dc719aeacf0d18b2c7109b1f
- SSDEEP 786432:iuML+5XoeOvHiwB3sn+h19W25F+wX0ff6yajCs6+4S3NftN:i5WoeeCwDr9WG+tf6fj4ulN
- TLSH
  T116771256E2FD00E8D5BAC0BCC6575517EBB23459173097EB52A48A692F33BE0AE3D310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor defense_evasion discovery execution persistence privilege_escalation ransomware rat revoked_codesign
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2