d725a694fcde2bb0d25cdfeab3caf8cd38f64f61e6002caa6b35072dfecc743f

General

Target
ScreenConnect.ClientSetup.msi
Size 13.0MB
Sample260913-pg6pdsywfx
SHA256 d725a694fcde2bb0d25cdfeab3caf8cd38f64f61e6002caa6b35072dfecc743f
MD5 f85409d8165c53babb2e41497c162d74
SHA1 e5d03280fc146795a61258dcbfcea575b04c9df7
SHA512 4e274fda36e34e0998510bc6a93d6abd009ab161d7fc4b5ae4098785da3b4ca65c1aaa570f0d8c21e12022e0a9a1a6f7ff02e7277bdf06e50ba290d95f6bd3a7
SSDEEP 196608:vrnLYG3zDhukOirnLYG3z5rnLYG3z0rnLYG3zTrnLYG3zHrnLYG3zCrnLYG3z9:vbDDDgvibDD5bDD0bDDTbDDHbDDCbDD9
TLSH
T138D6232267FD8918E1F32778FD3991E291367C65DF11C49F2610386E68B1E8092A377B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ScreenConnect.ClientSetup.msi
- Size 13.0MB
- SHA256 d725a694fcde2bb0d25cdfeab3caf8cd38f64f61e6002caa6b35072dfecc743f
- MD5 f85409d8165c53babb2e41497c162d74
- SHA1 e5d03280fc146795a61258dcbfcea575b04c9df7
- SHA512 4e274fda36e34e0998510bc6a93d6abd009ab161d7fc4b5ae4098785da3b4ca65c1aaa570f0d8c21e12022e0a9a1a6f7ff02e7277bdf06e50ba290d95f6bd3a7
- SSDEEP 196608:vrnLYG3zDhukOirnLYG3z5rnLYG3z0rnLYG3zTrnLYG3zHrnLYG3zCrnLYG3z9:vbDDDgvibDD5bDD0bDDTbDDHbDDCbDD9
- TLSH
  T138D6232267FD8918E1F32778FD3991E291367C65DF11C49F2610386E68B1E8092A377B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2