21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 32:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4d4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious RiskWare[RemoteAdmin]/ConnectWise Sample 02c6d4de3aa8… — Score 67/100 — Hybrid Analysis","description":"Malicious verdict for sample 02c6d4de3aa8…. Malware family: RiskWare[RemoteAdmin]/ConnectWise. Threat score 67/100. 7/26 AV engines flagged this file. 1 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/02c6d4de3aa8feee3ac76efc66d092ad115b95eb93d1b025c547df241f218adb","keywords":["Malicious","RiskWare[RemoteAdmin]/ConnectWise","malware analysis","sandbox report","threat intelligence","02c6d4de3aa8feee3ac76efc66d092ad115b95eb93d1b025c547df241f218adb"],"about":{"@type":"SoftwareApplication","name":"support.client.exe","applicationCategory":["peexe","executable"],"identifier":"02c6d4de3aa8feee3ac76efc66d092ad115b95eb93d1b025c547df241f218adb","additionalType":"Malicious sample"},"threatScore":67,"malwareFamily":"RiskWare[RemoteAdmin]/ConnectWise","antivirusDetections":{"malicious":7,"total":26},"behavioralIndicators":{"malicious":1,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T854,"\" (Indicator: \"SHA384\"; File: \"02c6d4de3aa8feee3ac76efc66d092ad115b95eb93d1b025c547df241f218adb.bin\")\n Found reference to \"Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0\" (Indicator: \"SHA384\"; File: \"02c6d4de3aa8feee3ac76efc66d092ad115b95eb93d1b025c547df241f218adb.bin\")\n Found reference to \"8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1\" (Indicator: \"SHA384\"; File: \"02c6d4de3aa8feee3ac76efc66d092ad115b95eb93d1b025c547df241f218adb.bin\")","id":"string-138","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to use Cryptographic classes","origin":"File/Memory","relevance":2,"sources":[{"report_id":"6a4f949c8e2a2afc48007074","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\" Microsoft Corporation\"","id":"static-18","level":"informative","mitre_attack_id":"T1027.002","name":"Matched Compiler/Packer signature","origin":"Static Parser","relevance":10,"sources":[{"report_id":"6a4f949c8e2a2afc48007074","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"GetCommandLineA@KERNEL32.dll at 47782-3390-00426512","id":"stream-118","level":"suspicious","mitre_attack_id":"T1106","name":"Contains ability to retrieve the command-line string for the current process","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"6a4f949c8e2a2afc48007074","report_type":"sandbox"}]},{"category":"General","description":"Error: A certificate was explicitly revoked by its issuer. (0x800b010c)","id":"certificate-1","level":"malicious","mitre_attack_id":"T1553.002","name":"The input sample is signed with an invalid certificate","origin":"Certificate Data","relevance":10,"sources":[{"report_id":"6a4f949c8e2a2afc48007074","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"02c6d4de3aa8feee3ac76efc66d092ad115b95eb93d1b025c547df241f218adb.bin\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"02c6d4de3aa8feee3ac76efc66d092ad115b95eb93d1b025c547df241f218adb.bin\")","id":"string-661","level":"informative","mitre_attack_id":"T1497.002","name":"Able to identify virtual environment by using user activity (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a4f949c8e2a2afc48007074","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"02c6d4de3aa8feee3ac76efc66d092ad115b95eb93d1b025c547df241f218adb.bin\")","id":"string-249","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to retrieve file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a4f949c8e2a2afc48007074","report_type":"sandbox"}]},{"category":"General","description":"$2b","id":"api-176","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to retrieve function addresses","origin":"API Call","relevance":1,"sources":[{"report_id":"6a4f949c8e2a2afc48007074","report_type":"sandbox"}]},{"category":"General","description":"\"02c6d4de3aa8feee3ac76efc66d092ad115b95eb93d1b025c547df241f218adb.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","id":"static-146","level":"informative","name":"PE file contains Debug data directory","origin":"Static Parser","sources":[{"report_id":"6a4f949c8e2a2afc48007074","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$2c","id":"api-126","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"6a4f949c8e2a2afc48007074","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$2d","id":"string-64","level":"informative","mitre_attack_id":"T1106","name":"Input file contains API references not part of its Import Address Table (IAT)","origin":"File/Memory","relevance":10,"sources":[{"report_id":"6a4f949c8e2a2afc48007074","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"