hxxps://abrigel[.]screenconnect[.]com/Bin/ScreenConnect[.]ClientSetup[.]exe?e=Access&y=Guest&c=Abrigel&c=Abrigel[.]com&c=&c=01&c=&c=&c=&c=&data=05|02|ana[.]isabel[.]martins@novobanco[.]pt|e20595a8eb804794806a08df02b34280|10338048193a4298abea3596ae88b05e|0|0|639232641066876210|Unknown|TWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ==|0|||&sdata=M6klH/WUNiHAEWYA7zHj+3VLGSq/gmDBhk0Rh8ez8q0=&reserved=0

General

Target
https://abrigel.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest&c=Abrigel&c=Abrigel.com&c=&c=01&c=&c=&c=&c=&data=05|02|[email protected]|e20595a8eb804794806a08df02b34280|10338048193a4298abea3596ae88b05e|0|0|639232641066876210|Unknown|TWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ==|0|||&sdata=M6klH/WUNiHAEWYA7zHj+3VLGSq/gmDBhk0Rh8ez8q0=&reserved=0
Sample260901-1f6hsabn31

Score

8^/10

Malware Config

Targets

- Target
  https://abrigel.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest&c=Abrigel&c=Abrigel.com&c=&c=01&c=&c=&c=&c=&data=05|02|[email protected]|e20595a8eb804794806a08df02b34280|10338048193a4298abea3596ae88b05e|0|0|639232641066876210|Unknown|TWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ==|0|||&sdata=M6klH/WUNiHAEWYA7zHj+3VLGSq/gmDBhk0Rh8ez8q0=&reserved=0
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1