b4b9fa7c5472840a6d122c5550fbc6aa346c58361d6dc38e1f53894ca3387329

General

Target
Adobe_Updater%20.msi
Size 14.5MB
Sample260910-ppjvlawyfy
SHA256 b4b9fa7c5472840a6d122c5550fbc6aa346c58361d6dc38e1f53894ca3387329
MD5 162e5f309e7c5a14127559d1bf6b6a99
SHA1 22699607e330f5d824da769d27cb0f82a52f3f71
SHA512 4e815cde354086c708f0be09989992a7bc37bb4d2692fe96a33c0e5ac2c8df0acf7b7748f3bfb08d2bdb612215ad46d30775ef9b2eeb06cfe2d057df42459e89
SSDEEP 393216:EmkEdQ03NldumkEd8mkEd8mkEdZmkEdvmkEdjmkEd:ME2cxCEqEGExErEfE
TLSH
T18DE6230573F8A109F1B32A3AED3955F19C7B7C228D62D15E1658364E1AB0EC19AB3733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Adobe_Updater%20.msi
- Size 14.5MB
- SHA256 b4b9fa7c5472840a6d122c5550fbc6aa346c58361d6dc38e1f53894ca3387329
- MD5 162e5f309e7c5a14127559d1bf6b6a99
- SHA1 22699607e330f5d824da769d27cb0f82a52f3f71
- SHA512 4e815cde354086c708f0be09989992a7bc37bb4d2692fe96a33c0e5ac2c8df0acf7b7748f3bfb08d2bdb612215ad46d30775ef9b2eeb06cfe2d057df42459e89
- SSDEEP 393216:EmkEdQ03NldumkEd8mkEd8mkEdZmkEdvmkEdjmkEd:ME2cxCEqEGExErEfE
- TLSH
  T18DE6230573F8A109F1B32A3AED3955F19C7B7C228D62D15E1658364E1AB0EC19AB3733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2