426d3d0be15bd53a3cb96f8ea27556db32f1372c98390a5bda9188449d20e1c5

General

Target
MS+Meet+Voice+Recordings.vbs
Size 5KB
Sample260908-wyjdrawtft
SHA256 426d3d0be15bd53a3cb96f8ea27556db32f1372c98390a5bda9188449d20e1c5
MD5 6160234c3d5578f161d4e8ccb360ae2b
SHA1 7aa6566b89e093c8f4b0bb054cdd491eaf40dc3a
SHA512 435eae40d68fecafac6c5d9a04d0f5dbb1d2d106ebdd5a7011710f2698f6f896ad1424b6f7af5add002969e3b7a8f09b042eb72c1e64673af66e2484fce03795
SSDEEP 96:N3TwOFIEAfjNDJb7yE24/gmA5XNFAS4aNV23tJWMJWnOsArvBNKt5gdRJb:arlBDJHm4/gF9RutJWMJWnUne0Jb
TLSH
T156C17446E613DF398579429AB5267F0EFED0266741006038F84CC94BEF38AFADA451B8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  MS+Meet+Voice+Recordings.vbs
- Size 5KB
- SHA256 426d3d0be15bd53a3cb96f8ea27556db32f1372c98390a5bda9188449d20e1c5
- MD5 6160234c3d5578f161d4e8ccb360ae2b
- SHA1 7aa6566b89e093c8f4b0bb054cdd491eaf40dc3a
- SHA512 435eae40d68fecafac6c5d9a04d0f5dbb1d2d106ebdd5a7011710f2698f6f896ad1424b6f7af5add002969e3b7a8f09b042eb72c1e64673af66e2484fce03795
- SSDEEP 96:N3TwOFIEAfjNDJb7yE24/gmA5XNFAS4aNV23tJWMJWnOsArvBNKt5gdRJb:arlBDJHm4/gF9RutJWMJWnUne0Jb
- TLSH
  T156C17446E613DF398579429AB5267F0EFED0266741006038F84CC94BEF38AFADA451B8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery execution persistence privilege_escalation rat revoked_codesign
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2