797fccc3d3ba93c477efcf48767b97517c456914f9753e6ac10be7363ddd5da9

General

Target
e6124dd.msi
Size 13.1MB
Sample260910-3l56bahq7s
SHA256 797fccc3d3ba93c477efcf48767b97517c456914f9753e6ac10be7363ddd5da9
MD5 5bd1fd3aa1610c7c7dcefdca3be6190d
SHA1 ba1b707b101047201342c49d2396c77cc5a3e732
SHA512 6f5b9ac6253d6e49e10f299b7d4157c279bc06fc44c29d22d67b866e856428634f6894be527fb1dd04e6daab7915e7b7013595cecb3efec921b80b255d765173
SSDEEP 196608:9Hxcp9ym3nltDUJVtHxcp9ym3DHxcp9ym3yHxcp9ym3MHxcp9ym3LHxcp9ym3xHk:vGplpeGptGpAGpqGpVGpjGp
TLSH
T155D623116BF89AE9F0F23A34E8766471B17ABC115E22C12E3264791D2C76EC0C963777
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  e6124dd.msi
- Size 13.1MB
- SHA256 797fccc3d3ba93c477efcf48767b97517c456914f9753e6ac10be7363ddd5da9
- MD5 5bd1fd3aa1610c7c7dcefdca3be6190d
- SHA1 ba1b707b101047201342c49d2396c77cc5a3e732
- SHA512 6f5b9ac6253d6e49e10f299b7d4157c279bc06fc44c29d22d67b866e856428634f6894be527fb1dd04e6daab7915e7b7013595cecb3efec921b80b255d765173
- SSDEEP 196608:9Hxcp9ym3nltDUJVtHxcp9ym3DHxcp9ym3yHxcp9ym3MHxcp9ym3LHxcp9ym3xHk:vGplpeGptGpAGpqGpVGpjGp
- TLSH
  T155D623116BF89AE9F0F23A34E8766471B17ABC115E22C12E3264791D2C76EC0C963777
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign adware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2