24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 37:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Tool.ConnectWise Sample 65559cb35133… — Score 60/100 — Hybrid Analysis","description":"Malicious verdict for sample 65559cb35133…. Malware family: Tool.ConnectWise. Threat score 60/100. 1/27 AV engines flagged this file. 1 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/65559cb35133e5074fd37ef49c43df3e5e091e6b6c51d680e7eecf11b26ca1a3","keywords":["Malicious","Tool.ConnectWise","malware analysis","sandbox report","threat intelligence","65559cb35133e5074fd37ef49c43df3e5e091e6b6c51d680e7eecf11b26ca1a3"],"about":{"@type":"SoftwareApplication","name":"support.client.exe","applicationCategory":["peexe","executable"],"identifier":"65559cb35133e5074fd37ef49c43df3e5e091e6b6c51d680e7eecf11b26ca1a3","additionalType":"Malicious sample"},"threatScore":60,"malwareFamily":"Tool.ConnectWise","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Ta3b,Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; File: "65559cb35133e5074fd37ef49c43df3e5e091e6b6c51d680e7eecf11b26ca1a3.bin") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; File: "65559cb35133e5074fd37ef49c43df3e5e091e6b6c51d680e7eecf11b26ca1a3.bin") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0>" (Indicator: "SHA384"; File: "65559cb35133e5074fd37ef49c43df3e5e091e6b6c51d680e7eecf11b26ca1a3.bin") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; File: "65559cb35133e5074fd37ef49c43df3e5e091e6b6c51d680e7eecf11b26ca1a3.bin") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; File: "65559cb35133e5074fd37ef49c43df3e5e091e6b6c51d680e7eecf11b26ca1a3.bin") Found reference to "rustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; Source: "00000000-00003564.00000000.150586.03480000.00000004.mdmp, 00000000-00003564.00000001.150791.03480000.00000004.mdmp") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; Source: "00000000-00003564.00000000.150586.03480000.00000004.mdmp, 00000000-00003564.00000001.150791.03480000.00000004.mdmp") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; Source: "00000000-00003564.00000000.150586.03480000.00000004.mdmp, 00000000-00003564.00000001.150791.03480000.00000004.mdmp") Found reference to "giCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; Source: "00000000-00003564.00000000.150586.03480000.00000004.mdmp, 00000000-00003564.00000001.150791.03480000.00000004.mdmp") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0>" (Indicator: "SHA384"; Source: "00000000-00003564.00000000.150586.03480000.00000004.mdmp, 00000000-00003564.00000001.150791.03480000.00000004.mdmp") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; Source: "00000000-00003564.00000000.150586.03480000.00000004.mdmp, 00000000-00003564.00000001.150791.03480000.00000004.mdmp") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; Source: "00000000-00003564.00000000.150586.03480000.00000004.mdmp, 00000000-00003564.00000001.150791.03480000.00000004.mdmp")26:Tb0c,Found api reference "CryptMsgGetParam" (Indicator: "CryptMsgGetParam"; File: "65559cb35133e5074fd37ef49c43df3e5e091e6b6c51d680e7eecf11b26ca1a3.bin") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "65559cb35133e5074fd37ef49c43df3e5e091e6b6c51d680e7eecf11b26ca1a3.bin") Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; File: "65559cb35133e5074fd37ef49c43df3e5e091e6b6c51d680e7eecf11b26ca1a3.bin") Found api reference "CertCreateCertificateContext" (Indicator: "CertCreateCertificateContext"; File: "65559cb35133e5074fd37ef49c43df3e5e091e6b6c51d680e7eecf11b26ca1a3.bin") Found api reference "CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; File: "65559cb35133e5074fd37ef49c43df3e5e091e6b6c51d680e7eecf11b26ca1a3.bin") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "65559cb35133e5074fd37ef49c43df3e5e091e6b6c51d680e7eecf11b26ca1a3.bin") Found api reference "CertOpenSystemStoreA" (Indicator: "CertOpenSystemStoreA"; File: "65559cb35133e5074fd37ef49c43df3e5e091e6b6c51d680e7eecf11b26ca1a3.bin") Found api reference "CertFindAttribute" (Indicator: "CertFindAttribute"; File: "65559cb35133e5074fd37ef49c43df3e5e091e6b6c51d680e7eecf11b26ca1a3.bin") Found api reference "CertDeleteCertificateFromStore" (Indicator: "CertDeleteCertificateFromStore"; File: "65559cb35133e5074fd37ef49c43df3e5e091e6b6c51d680e7eecf11b26ca1a3.bin") Found api reference "CertCreateCertificateContext" (Indicator: "CertCreateCertificateContext"; Source: "00000000-00003564.00000001.150791.0022B000.00000002.mdmp") Found api reference "CertDeleteCertificateFromStore" (Indicator: "CertDeleteCertificateFromStore"; Source: "00000000-00003564.00000001.150791.0022B000.00000002.mdmp") Found api reference "CertOpenSystemStoreA" (Indicator: "CertOpenSystemStoreA"; Source: "00000000-00003564.00000001.150791.0022B000.00000002.mdmp") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00003564.00000001.150791.0022B000.00000002.mdmp") Found api reference "CertFindAttribute" (Indicator: "CertFindAttribute"; Source: "00000000-00003564.00000001.150791.0022B000.00000002.mdmp") Found api reference "CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00003564.00000001.150791.0022B000.00000002.mdmp") Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; Source: "00000000-00003564.00000001.150791.0022B000.00000002.mdmp") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00003564.00000001.150791.0022B000.00000002.mdmp") Found api reference "CryptMsgGetParam" (Indicator: "CryptMsgGetParam"; Source: "00000000-00003564.00000001.150791.0022B000.00000002.mdmp")27:T808,Assembly shows XOR instruction xor eax ebp in Stream UID: 387-109-00404F96 Assembly shows XOR instruction xor ecx ebp in Stream UID: 387-109-00404F96 Assembly shows XOR instruction xor eax ebp in Stream UID: 387-282-004099D3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 387-282-004099D3 Assembly shows XOR instruction xor eax ebp in Stream UID: 387-347-00404AE1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 387-347-00404AE1 Assembly shows XOR instruction xor eax ebp in Stream UID: 387-392-004059B3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 387-392-004059B3 Assembly shows XOR instruction xor eax ebp in Stream UID: 387-393-0040585A Assembly shows XOR instruction xor ecx ebp in Stream UID: 387-393-0040585A Assembly shows XOR instruction xor eax ebp in Stream UID: 387-394-004058B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 387-394-004058B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 387-439-00408A92 Assembly shows XOR instruction xor ecx ebp in Stream UID: 387-439-00408A92 Assembly shows XOR instruction xor eax ebp in Stream UID: 387-440-004086AD Assembly shows XOR instruction xor ecx ebp in Stream UID: 387-440-004086AD Assembly shows XOR instruction xor eax ebp in Stream UID: 387-441-0040887A Assembly shows XOR instruction xor ecx ebp in Stream UID: 387-441-0040887A Assembly shows XOR instruction xor eax ebp in Stream UID: 387-442-0040878C Assembly shows XOR instruction xor ecx ebp in Stream UID: 387-442-0040878C Assembly shows XOR instruction xor eax ebp in Stream UID: 387-443-00408417 Assembly shows XOR instruction xor ecx ebp in Stream UID: 387-443-00408417 Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 387-476-0040A495 Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 387-476-0040A495 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 387-476-0040A495 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 387-476-0040A49528:Teec,"" (Indicator: "GetDC"; Source: "00000000-00003564.00000000.150586.03480000.00000004.mdmp, 00000000-00003564.00000001.150791.03480000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003564.00000000.150586.03480000.00000004.mdmp, 00000000-00003564.00000001.150791.03480000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00003564.00000000.150586.03480000.00000004.mdmp, 00000000-00003564.00000001.150791.03480000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003564.00000000.150586.03480000.00000004.mdmp, 00000000-00003564.00000001.150791.03480000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003564.00000000.150586.03480000.00000004.mdmp, 00000000-00003564.00000001.150791.03480000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003564.00000000.150586.03480000.00000004.mdmp, 00000000-00003564.00000001.150791.03480000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00003564.00000000.150586.03480000.00000004.mdmp, 00000000-00003564.00000001.150791.03480000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003564.00000000.150586.03480000.00000004.mdmp, 00000000-00003564.00000001.150791.03480000.00000004.mdmp")34:T5e8,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "65559cb35133e5074fd37ef49c43df3e5e091e6b6c51d680e7eecf11b26ca1a3.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "65559cb35133e5074fd37ef49c43df3e5e091e6b6c51d680e7eecf11b26ca1a3.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "65559cb35133e5074fd37ef49c43df3e5e091e6b6c51d680e7eecf11b26ca1a3.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "65559cb35133e5074fd37ef49c43df3e5e091e6b6c51d680e7eecf11b26ca1a3.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "65559cb35133e5074fd37ef49c43df3e5e091e6b6c51d680e7eecf11b26ca1a3.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003564.00000001.150791.0022B000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003564.00000001.150791.0022B000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003564.00000001.150791.0022B000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003564.00000001.150791.0022B000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003564.00000001.150791.0022B000.00000002.mdmp")35:T1ee7,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003564.00000000.150586.03480000.00000004.mdmp, 00000000-00003564.00000001.150791.03480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"699c182d660b4409680d4282"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$25","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"699c182d660b4409680d4282"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00003564.00000000.150586.03480000.00000004.mdmp, 00000000-00003564.00000001.150791.03480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"699c182d660b4409680d4282"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\" Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"699c182d660b4409680d4282"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"