33a7b824bc687c330c33c1870a9243d2f527c43d63a1fa95b3ad02c12dfe5f81

General

Target
Account_Transcript.zip
Size 12.4MB
Sample260930-w32e5aydjf
SHA256 33a7b824bc687c330c33c1870a9243d2f527c43d63a1fa95b3ad02c12dfe5f81
MD5 a09a20a6fc558fe39af29647f4395a9d
SHA1 9e8a6c0cfad9a0d778e1abd1fc4986a59071991e
SHA512 83775dd39a0e633bc48c8e3e4b8ac2277453f90de3169e61e6993cab17eb658720ca8984e507b260f4e365f604567f58bb6a51b41aa286f7b1225ba68a94ef4c
SSDEEP 393216:YoZC1rnGsdLZHaMH44F8GIuM1ck+38C+uyz0:PAlDPNO+Mt0
TLSH
T1A3D63362675B374F097293F53A378D7F9264FC526C38B9784E8F9EB58422281646CC38
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Account_Transcript/FirewallAPI.dll
- Size 12.9MB
- SHA256 39923ed0e95cd4912c76466a90fcba015752fec7ae5811831acf8cdb1afcf884
- MD5 b33baa05f62c77a4265d1f967ca8de22
- SHA1 7d9dd952ea401150622475e56941ad50b9146782
- SHA512 6307a80e2f04106671f7c33c03c4ed781c87b2bc17a9ca092da1938d2d672100fa4c5d334444bfd155cb1b48df422b7911dacca6e38f52519b68664443e990a4
- SSDEEP 196608:beQJ+08Pr7advdPh47n+yq/reQJ+08Pr7advdPhCeQJ+08Pr7advdPhieQJ+08PS:R+WTuns+WTE+WTk+WT5+WTl+WTl+WT
- TLSH
  T14CD622A2D2AB2E0BBDF933B9665D055B32F0E602D9E0247C7FC99591042F54817F6B0E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  Account_Transcript/Open-Account-Transcript.exe
- Size 87KB
- SHA256 f8ed4cb272e52b7ef2b1c2672dbc6ace9f3ef752a38ce535265cfab891c9cbff
- MD5 13072c3b2a5a405b32a60d8cf1631bbc
- SHA1 6996ab027fe913cccb9f8e26ad0e9491d4a609b1
- SHA512 337311e0b2c0a22b749930f7212b5040d27c2b997404dc8cecfbbf89c86f2f5d5077d6157090078a8421acaa23850b24f963ba1b984b0600e9b80505bdb125c5
- SSDEEP 768:HzEI16zcI2eTcvEWm/ljPjOPAxr25znrSh7ANg3CqnZ+6qmmlG0KdFumjDdFWf1:F1H5MiP1zrSh7WwZ3xmlGddFjjDdFWf1
- TLSH
  T1359339403BE84276FAFA8F749572E0104A79BDAA99B0D6CD2CD5A49F19F3B408321717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral3 behavioral4