678c33f1b533441e2f8511894a29820eecd1bfac95ca18aac34235ca754ccf39

General

Target
Morpho_Transcript-Docusign.bat
Size 11.5MB
Sample260910-wz4fbaeb65
SHA256 678c33f1b533441e2f8511894a29820eecd1bfac95ca18aac34235ca754ccf39
MD5 11a33107e427364a1d0205dd82096f05
SHA1 b58fa464b1a2aea011f9c5397672c319065230dc
SHA512 e71c48b18770be48cdeaca4dcfffedaf898f1f4c985fc739fd4a95ccc7f02a9d5efdde1574a0c1a97e76aba7907e0d16d1f5c6a99206817fbb679f4044abdda1
SSDEEP 49152:qR6peJPVssUSNOzq7cBJv5xFQ72aWO01Bl0ThoW4kGOQki3u9wrK3AOiuubL937j:D
TLSH
T145C622725A51BFEF4B2C6A04401A3F225EB01B63AB14756CFE88249215D9751CF2EBFC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Morpho_Transcript-Docusign.bat
- Size 11.5MB
- SHA256 678c33f1b533441e2f8511894a29820eecd1bfac95ca18aac34235ca754ccf39
- MD5 11a33107e427364a1d0205dd82096f05
- SHA1 b58fa464b1a2aea011f9c5397672c319065230dc
- SHA512 e71c48b18770be48cdeaca4dcfffedaf898f1f4c985fc739fd4a95ccc7f02a9d5efdde1574a0c1a97e76aba7907e0d16d1f5c6a99206817fbb679f4044abdda1
- SSDEEP 49152:qR6peJPVssUSNOzq7cBJv5xFQ72aWO01Bl0ThoW4kGOQki3u9wrK3AOiuubL937j:D
- TLSH
  T145C622725A51BFEF4B2C6A04401A3F225EB01B63AB14756CFE88249215D9751CF2EBFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery execution persistence privilege_escalation ransomware revoked_codesign spyware
- Boot or Logon Autostart Execution: Port Monitors
  Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
  persistence
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2