Extracted

• • Target
    Mortgage Plan Document.pdf.lnk
  • Size 2KB
  • SHA256 e8bb6e8b34df6f4931d0b4fa3a6a11645a9a41b5498903823811533673e7a99f
  • MD5 f0fa4b71b2842c857610b2358195ea11
  • SHA1 c70ed80af93b3bd4725f404eebc6054887601d90
  • SHA512 732fbfd78459024e9d988cd9c335e8d742e2b32ca8c878899815274ee640777bae8fa6a0f40a7f5da3ae0094c51712ec5c28fded8494d2c330a4bd7ecdb41fa2
  • TLSH
    T1CE418A240EEA10D8E2B34B3257EEF7F24667F8546D2DA6F8114085840B71AD0EC76F3A
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionpersistenceprivilege_escalationratrevoked_codesign

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Signed with revoked ConnectWise certificate

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Boot or Logon Autostart Execution: Authentication Package

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation

  • Drops file in System32 directory

  behavioral1behavioral2