26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 35:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4d4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious RiskWare[RemoteAdmin]/ConnectWise Sample c32422d1dfca… — Score 59/100 — Hybrid Analysis","description":"Malicious verdict for sample c32422d1dfca…. Malware family: RiskWare[RemoteAdmin]/ConnectWise. Threat score 59/100. 2/28 AV engines flagged this file. 1 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c32422d1dfca2bc7d040a1a572b7b00b2cdf17147f351d98ba453c51588cf524","keywords":["Malicious","RiskWare[RemoteAdmin]/ConnectWise","malware analysis","sandbox report","threat intelligence","c32422d1dfca2bc7d040a1a572b7b00b2cdf17147f351d98ba453c51588cf524"],"about":{"@type":"SoftwareApplication","name":"support.client.exe","applicationCategory":["peexe","executable"],"identifier":"c32422d1dfca2bc7d040a1a572b7b00b2cdf17147f351d98ba453c51588cf524","additionalType":"Malicious sample"},"threatScore":59,"malwareFamily":"RiskWare[RemoteAdmin]/ConnectWise","antivirusDetections":{"malicious":2,"total":28},"behavioralIndicators":{"malicious":1,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5b2,Found api reference "CertOpenSystemStoreA" (Indicator: "CertOpenSystemStoreA"; File: "c32422d1dfca2bc7d040a1a572b7b00b2cdf17147f351d98ba453c51588cf524.bin") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "c32422d1dfca2bc7d040a1a572b7b00b2cdf17147f351d98ba453c51588cf524.bin") Found api reference "CertFindAttribute" (Indicator: "CertFindAttribute"; File: "c32422d1dfca2bc7d040a1a572b7b00b2cdf17147f351d98ba453c51588cf524.bin") Found api reference "CryptMsgGetParam" (Indicator: "CryptMsgGetParam"; File: "c32422d1dfca2bc7d040a1a572b7b00b2cdf17147f351d98ba453c51588cf524.bin") Found api reference "CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; File: "c32422d1dfca2bc7d040a1a572b7b00b2cdf17147f351d98ba453c51588cf524.bin") Found api reference "CertCreateCertificateContext" (Indicator: "CertCreateCertificateContext"; File: "c32422d1dfca2bc7d040a1a572b7b00b2cdf17147f351d98ba453c51588cf524.bin") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "c32422d1dfca2bc7d040a1a572b7b00b2cdf17147f351d98ba453c51588cf524.bin") Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; File: "c32422d1dfca2bc7d040a1a572b7b00b2cdf17147f351d98ba453c51588cf524.bin") Found api reference "CertDeleteCertificateFromStore" (Indicator: "CertDeleteCertificateFromStore"; File: "c32422d1dfca2bc7d040a1a572b7b00b2cdf17147f351d98ba453c51588cf524.bin")28:T83c,Assembly shows XOR instruction xor eax ebp in Stream UID: 29604-109-00404F96 Assembly shows XOR instruction xor ecx ebp in Stream UID: 29604-109-00404F96 Assembly shows XOR instruction xor eax ebp in Stream UID: 29604-282-004099D3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 29604-282-004099D3 Assembly shows XOR instruction xor eax ebp in Stream UID: 29604-347-00404AE1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 29604-347-00404AE1 Assembly shows XOR instruction xor eax ebp in Stream UID: 29604-392-004059B3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 29604-392-004059B3 Assembly shows XOR instruction xor eax ebp in Stream UID: 29604-393-0040585A Assembly shows XOR instruction xor ecx ebp in Stream UID: 29604-393-0040585A Assembly shows XOR instruction xor eax ebp in Stream UID: 29604-394-004058B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 29604-394-004058B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 29604-439-00408A92 Assembly shows XOR instruction xor ecx ebp in Stream UID: 29604-439-00408A92 Assembly shows XOR instruction xor eax ebp in Stream UID: 29604-440-004086AD Assembly shows XOR instruction xor ecx ebp in Stream UID: 29604-440-004086AD Assembly shows XOR instruction xor eax ebp in Stream UID: 29604-441-0040887A Assembly shows XOR instruction xor ecx ebp in Stream UID: 29604-441-0040887A Assembly shows XOR instruction xor eax ebp in Stream UID: 29604-442-0040878C Assembly shows XOR instruction xor ecx ebp in Stream UID: 29604-442-0040878C Assembly shows XOR instruction xor eax ebp in Stream UID: 29604-443-00408417 Assembly shows XOR instruction xor ecx ebp in Stream UID: 29604-443-00408417 Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 29604-476-0040A495 Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 29604-476-0040A495 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 29604-476-0040A495 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 29604-476-0040A49529:Teec,"\" (Indicator: \"SHA384\"; File: \"c32422d1dfca2bc7d040a1a572b7b00b2cdf17147f351d98ba453c51588cf524.bin\")\n Found reference to \"Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0\" (Indicator: \"SHA384\"; File: \"c32422d1dfca2bc7d040a1a572b7b00b2cdf17147f351d98ba453c51588cf524.bin\")\n Found reference to \"8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1\" (Indicator: \"SHA384\"; File: \"c32422d1dfca2bc7d040a1a572b7b00b2cdf17147f351d98ba453c51588cf524.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a13480c9e4e729b4e0dfc98"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\" Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a13480c9e4e729b4e0dfc98"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"