82425d0578018a3b269c3a80bbbac8bb92d1312cafbdd290afda3af59c7a3a12

General

Target
svchost.msi
Size 9.5MB
Sample261027-nnec2scw2w
SHA256 82425d0578018a3b269c3a80bbbac8bb92d1312cafbdd290afda3af59c7a3a12
MD5 392e6208ffc72344155c67ea8fcd7b25
SHA1 86fa586abdf6c674502b099feee9f377c67312ed
SHA512 5cc4a4952aed3779ba844e2e63be419bf0b87748d6571eacc0097d2b5d77be4d3cbcf0f836dcf498fe928473a446ed2c4455218023fa5527b0d6d0ae49184116
SSDEEP 98304:0wJ4t1h0cG5FGJRPxow8OfwJ4t1h0cG5vwJ4t1h0cG5RwJ4t1h0cG5rwJ4t1h0cW:dWh0cGwOWh0cGCWh0cG4Wh0cGeWh0cG
TLSH
T19FA6232523FD801AE8F75A7DED3682F45972BE64CE22C11E9328BD0D2974D4096727B3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  svchost.msi
- Size 9.5MB
- SHA256 82425d0578018a3b269c3a80bbbac8bb92d1312cafbdd290afda3af59c7a3a12
- MD5 392e6208ffc72344155c67ea8fcd7b25
- SHA1 86fa586abdf6c674502b099feee9f377c67312ed
- SHA512 5cc4a4952aed3779ba844e2e63be419bf0b87748d6571eacc0097d2b5d77be4d3cbcf0f836dcf498fe928473a446ed2c4455218023fa5527b0d6d0ae49184116
- SSDEEP 98304:0wJ4t1h0cG5FGJRPxow8OfwJ4t1h0cG5vwJ4t1h0cG5RwJ4t1h0cG5rwJ4t1h0cW:dWh0cGwOWh0cGCWh0cG4Wh0cGeWh0cG
- TLSH
  T19FA6232523FD801AE8F75A7DED3682F45972BE64CE22C11E9328BD0D2974D4096727B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2