21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T506,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious RiskWare[RemoteAdmin]/ConnectWise Sample 966ce68b2eae… — Score 60/100 — Hybrid Analysis","description":"Malicious verdict for sample 966ce68b2eae…. Malware family: RiskWare[RemoteAdmin]/ConnectWise. Threat score 60/100. 3/26 AV engines flagged this file. 1 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/966ce68b2eae61e5528a9f7a8cca097d1d1c8d698dd2006d8a45605c29894459","keywords":["Malicious","RiskWare[RemoteAdmin]/ConnectWise","malware analysis","sandbox report","threat intelligence","966ce68b2eae61e5528a9f7a8cca097d1d1c8d698dd2006d8a45605c29894459"],"about":{"@type":"SoftwareApplication","name":"966ce68b2eae61e5528a9f7a8cca097d1d1c8d698dd2006d8a45605c29894459.bin","applicationCategory":["peexe","executable"],"identifier":"966ce68b2eae61e5528a9f7a8cca097d1d1c8d698dd2006d8a45605c29894459","additionalType":"Malicious sample"},"threatScore":60,"malwareFamily":"RiskWare[RemoteAdmin]/ConnectWise","antivirusDetections":{"malicious":3,"total":26},"behavioralIndicators":{"malicious":1,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T5a2," Microsoft Corporation\"","id":"static-18","level":"informative","mitre_attack_id":"T1027.002","name":"Matched Compiler/Packer signature","origin":"Static Parser","relevance":10,"sources":[{"report_id":"6a3a8193c4918e12aa0dfd1a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"966ce68b2eae61e5528a9f7a8cca097d1d1c8d698dd2006d8a45605c29894459.bin\")","id":"string-167","level":"informative","mitre_attack_id":"T1543","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a3a8193c4918e12aa0dfd1a","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 25996-644-00401AAC","id":"stream-4","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"6a3a8193c4918e12aa0dfd1a","report_type":"sandbox"}]},{"category":"General","description":"$24","id":"registry-17","level":"informative","mitre_attack_id":"T1112","name":"Accesses System Certificates Settings","origin":"Registry Access","relevance":10,"sources":[{"report_id":"6a3a8193c4918e12aa0dfd1a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"966ce68b2eae61e5528a9f7a8cca097d1d1c8d698dd2006d8a45605c29894459.bin\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"966ce68b2eae61e5528a9f7a8cca097d1d1c8d698dd2006d8a45605c29894459.bin\")\n Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; File: \"966ce68b2eae61e5528a9f7a8cca097d1d1c8d698dd2006d8a45605c29894459.bin\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"966ce68b2eae61e5528a9f7a8cca097d1d1c8d698dd2006d8a45605c29894459.bin\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"966ce68b2eae61e5528a9f7a8cca097d1d1c8d698dd2006d8a45605c29894459.bin\")","id":"string-85","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to enumerate process and/or its information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a3a8193c4918e12aa0dfd1a","report_type":"sandbox"}]},{"category":"External Systems","description":"3/26 Antivirus vendors marked sample as malicious (11% detection rate)","id":"avtest-0","level":"suspicious","name":"Sample was identified as malicious by at least one Antivirus engine","origin":"External System","sources":[{"report_id":"6a3a8193c4918e12aa0dfd1a","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"966ce68b2eae61e5528a9f7a8cca097d1d1c8d698dd2006d8a45605c29894459.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"966ce68b2eae61e5528a9f7a8cca097d1d1c8d698dd2006d8a45605c29894459.bin\")","id":"string-226","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a3a8193c4918e12aa0dfd1a","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"\" (Indicator: \"SHA384\"; File: \"966ce68b2eae61e5528a9f7a8cca097d1d1c8d698dd2006d8a45605c29894459.bin\")\n Found reference to \"Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0\" (Indicator: \"SHA384\"; File: \"966ce68b2eae61e5528a9f7a8cca097d1d1c8d698dd2006d8a45605c29894459.bin\")\n Found reference to \"8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1\" (Indicator: \"SHA384\"; File: \"966ce68b2eae61e5528a9f7a8cca097d1d1c8d698dd2006d8a45605c29894459.bin\")","id":"string-138","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to use Cryptographic classes","origin":"File/Memory","relevance":2,"sources":[{"report_id":"6a3a8193c4918e12aa0dfd1a","report_type":"sandbox"}]},{"category":"General","description":"\"966ce68b2eae61e5528a9f7a8cca097d1d1c8d698dd2006d8a45605c29894459.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","id":"static-153","level":"informative","name":"Uses 32 bit executable PE","origin":"Static Parser","sources":[{"report_id":"6a3a8193c4918e12aa0dfd1a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"966ce68b2eae61e5528a9f7a8cca097d1d1c8d698dd2006d8a45605c29894459.bin\")\n Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; File: \"966ce68b2eae61e5528a9f7a8cca097d1d1c8d698dd2006d8a45605c29894459.bin\")","id":"string-83","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerate files on disk (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a3a8193c4918e12aa0dfd1a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"966ce68b2eae61e5528a9f7a8cca097d1d1c8d698dd2006d8a45605c29894459.bin\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"966ce68b2eae61e5528a9f7a8cca097d1d1c8d698dd2006d8a45605c29894459.bin\")","id":"string-164","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve the fully qualified path of module (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a3a8193c4918e12aa0dfd1a","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature \"INDICATOR_RMM_ConnectWise_ScreenConnect_CERT\" matched file \"sample.bin\" as \"Detects ConnectWise Control (formerly ScreenConnect) by (default) certificate. Review RMM Inventory\"","id":"yara-553","level":"suspicious","name":"Yara Signature Match - Indicators","origin":"YARA Signature","relevance":9,"sources":[{"report_id":"6a3a8193c4918e12aa0dfd1a","report_type":"sandbox"}]},{"category":"General","description":"Error: A certificate was explicitly revoked by its issuer. (0x800b010c)","id":"certificate-1","level":"malicious","mitre_attack_id":"T1553.002","name":"The input sample is signed with an invalid certificate","origin":"Certificate Data","relevance":10,"sources":[{"report_id":"6a3a8193c4918e12aa0dfd1a","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$2e","id":"string-602","level":"informative","mitre_attack_id":"T1573","name":"Able to use Microsoft's Enhanced Cryptographic Provider","origin":"File/Memory","relevance":1,"sources":[{"report_id":"6a3a8193c4918e12aa0dfd1a","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"GetModuleFileNameA@KERNEL32.dll at 25996-345-00402F55","id":"stream-131","level":"suspicious","mitre_attack_id":"T1106","name":"Contains ability to retrieve the fully qualified path of module","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"6a3a8193c4918e12aa0dfd1a","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"966ce68b2eae61e5528a9f7a8cca097d1d1c8d698dd2006d8a45605c29894459.bin\" claimed CRC 117521 while the actual is CRC 97076","id":"static-0","level":"suspicious","mitre_attack_id":"T1027","name":"CRC value set in PE header does not match actual value","origin":"Static Parser","relevance":10,"sources":[{"report_id":"6a3a8193c4918e12aa0dfd1a","report_type":"sandbox"}]},{"category":"General","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"966ce68b2eae61e5528a9f7a8cca097d1d1c8d698dd2006d8a45605c29894459.bin.exe\"","id":"target-2","level":"informative","name":"An application crash occurred","origin":"Monitored Target","sources":[{"report_id":"6a3a8193c4918e12aa0dfd1a","report_type":"sandbox"}]},{"category":"General","description":"\"