Extracted

• • Target
    FirewallAPI.dll
  • Size 13.0MB
  • SHA256 4618b08c25eb187b77eb923bcb9860a8f0d61faae8ad19aded77cd744522822e
  • MD5 9179704233f1d289dc760b4bcae29c7f
  • SHA1 3f6ff62372d2db75044cfd10be903d12dc29a718
  • SHA512 39899e0620049c40dae379c513dd3b9a1420a51be823c55e1a67b3acfa702538ec0b19b85b00ab4baaae4683179d6d0b69c0e84fb0ea186c5a6212511de53eac
  • SSDEEP 196608:JHxcp9ym3nltDUJV2Hxcp9ym3EHxcp9ym3zHxcp9ym32Hxcp9ym3KHxcp9ym3aHk:bGplpBGpiGpdGpEGpYGpoGp
  • TLSH
    T1B5D622136AF89E67E0B1DB74FF775460A7367D015A22B1EE1214790E2F31A8089A3737
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryexecutionpersistenceprivilege_escalationratrevoked_codesign

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Signed with revoked ConnectWise certificate

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign

  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation

  • Drops file in System32 directory

  behavioral1behavioral2
• • Target
    Lovely.exe
  • Size 87KB
  • SHA256 f8ed4cb272e52b7ef2b1c2672dbc6ace9f3ef752a38ce535265cfab891c9cbff
  • MD5 13072c3b2a5a405b32a60d8cf1631bbc
  • SHA1 6996ab027fe913cccb9f8e26ad0e9491d4a609b1
  • SHA512 337311e0b2c0a22b749930f7212b5040d27c2b997404dc8cecfbbf89c86f2f5d5077d6157090078a8421acaa23850b24f963ba1b984b0600e9b80505bdb125c5
  • SSDEEP 768:HzEI16zcI2eTcvEWm/ljPjOPAxr25znrSh7ANg3CqnZ+6qmmlG0KdFumjDdFWf1:F1H5MiP1zrSh7WwZ3xmlGddFjjDdFWf1
  • TLSH
    T1359339403BE84276FAFA8F749572E0104A79BDAA99B0D6CD2CD5A49F19F3B408321717
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryexecutionpersistenceprivilege_escalationratrevoked_codesign

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Signed with revoked ConnectWise certificate

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign

  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation

  • Drops file in System32 directory

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  behavioral3behavioral4