26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 38:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T506,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious RiskWare[RemoteAdmin]/ConnectWise Sample f05cd257c23c… — Score 67/100 — Hybrid Analysis","description":"Malicious verdict for sample f05cd257c23c…. Malware family: RiskWare[RemoteAdmin]/ConnectWise. Threat score 67/100. 7/27 AV engines flagged this file. 1 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f05cd257c23cd9b39db02dd7457aaf25584129aac2b5feb7286614f721dadb2f","keywords":["Malicious","RiskWare[RemoteAdmin]/ConnectWise","malware analysis","sandbox report","threat intelligence","f05cd257c23cd9b39db02dd7457aaf25584129aac2b5feb7286614f721dadb2f"],"about":{"@type":"SoftwareApplication","name":"f05cd257c23cd9b39db02dd7457aaf25584129aac2b5feb7286614f721dadb2f.bin","applicationCategory":["peexe","executable"],"identifier":"f05cd257c23cd9b39db02dd7457aaf25584129aac2b5feb7286614f721dadb2f","additionalType":"Malicious sample"},"threatScore":67,"malwareFamily":"RiskWare[RemoteAdmin]/ConnectWise","antivirusDetections":{"malicious":7,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T452,Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; File: "f05cd257c23cd9b39db02dd7457aaf25584129aac2b5feb7286614f721dadb2f.bin") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; File: "f05cd257c23cd9b39db02dd7457aaf25584129aac2b5feb7286614f721dadb2f.bin") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0>" (Indicator: "SHA384"; File: "f05cd257c23cd9b39db02dd7457aaf25584129aac2b5feb7286614f721dadb2f.bin") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; File: "f05cd257c23cd9b39db02dd7457aaf25584129aac2b5feb7286614f721dadb2f.bin") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; File: "f05cd257c23cd9b39db02dd7457aaf25584129aac2b5feb7286614f721dadb2f.bin") file/memory contains long string with (Indicator: "Aes"; File: "f05cd257c23cd9b39db02dd7457aaf25584129aac2b5feb7286614f721dadb2f.bin")28:T5b2,Found api reference "CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; File: "f05cd257c23cd9b39db02dd7457aaf25584129aac2b5feb7286614f721dadb2f.bin") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "f05cd257c23cd9b39db02dd7457aaf25584129aac2b5feb7286614f721dadb2f.bin") Found api reference "CertDeleteCertificateFromStore" (Indicator: "CertDeleteCertificateFromStore"; File: "f05cd257c23cd9b39db02dd7457aaf25584129aac2b5feb7286614f721dadb2f.bin") Found api reference "CertCreateCertificateContext" (Indicator: "CertCreateCertificateContext"; File: "f05cd257c23cd9b39db02dd7457aaf25584129aac2b5feb7286614f721dadb2f.bin") Found api reference "CertOpenSystemStoreA" (Indicator: "CertOpenSystemStoreA"; File: "f05cd257c23cd9b39db02dd7457aaf25584129aac2b5feb7286614f721dadb2f.bin") Found api reference "CryptMsgGetParam" (Indicator: "CryptMsgGetParam"; File: "f05cd257c23cd9b39db02dd7457aaf25584129aac2b5feb7286614f721dadb2f.bin") Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; File: "f05cd257c23cd9b39db02dd7457aaf25584129aac2b5feb7286614f721dadb2f.bin") Found api reference "CertFindAttribute" (Indicator: "CertFindAttribute"; File: "f05cd257c23cd9b39db02dd7457aaf25584129aac2b5feb7286614f721dadb2f.bin") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "f05cd257c23cd9b39db02dd7457aaf25584129aac2b5feb7286614f721dadb2f.bin")29:Tfec,Assembly shows XOR instruction xor eax ebp in Stream UID: 22542-120-00425BF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 22542-120-00425BF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 22542-355-00438863 Assembly shows XOR instruction xor ecx ebp in Stream UID: 22542-355-00438863 Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 22542-366-00439702 Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 22542-366-00439702 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 22542-366-00439702 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 22542-366-00439702 Assembly shows XOR instruction xor eax ebp in Stream UID: 22542-878-0040CB70 Assembly shows XOR instruction xor ecx ebp in Stream UID: 22542-878-0040CB70 Assembly shows XOR instruction xor eax ebp in Stream UID: 22542-940-004361A9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 22542-940-004361A9 Assembly shows XOR instruction xor eax ebp in Stream UID: 22542-941-0042776C Assembly shows XOR instruction xor ecx ebp in Stream UID: 22542-941-0042776C Assembly shows XOR instruction xor eax ebp in Stream UID: 22542-1013-0040EF17 Assembly shows XOR instruction xor ecx ebp in Stream UID: 22542-1013-0040EF17 Assembly shows XOR instruction xor eax ebp in Stream UID: 22542-1016-00427C0C Assembly shows XOR instruction xor ecx ebp in Stream UID: 22542-1016-00427C0C Assembly shows XOR instruction xor eax dword ptr [00448000h] in Stream UID: 22542-1022-00427076 Assembly shows XOR instruction xor eax ebp in Stream UID: 22542-1029-00427ADC Assembly shows XOR instruction xor ecx ebp in Stream UID: 22542-1029-00427ADC Assembly shows XOR instruction xor eax ebp in Stream UID: 22542-1043-00427D2C Assembly shows XOR instruction xor ecx ebp in Stream UID: 22542-1043-00427D2C Assembly shows XOR instruction xor eax ebp in Stream UID: 22542-1046-0042BCAF Assembly shows XOR instruction xor ecx ebp in Stream UID: 22542-1046-0042BCAF Assembly shows XOR instruction xor eax ebp in Stream UID: 22542-1084-0040EEB5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 22542-1084-0040EEB5 Assembly shows XOR instruction xor eax ebp in Stream UID: 22542-1107-004278A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 22542-1107-004278A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 22542-1142-00436E08 Assembly shows XOR instruction xor ecx ebp in Stream UID: 22542-1142-00436E08 Assembly shows XOR instruction xor eax ebp in Stream UID: 22542-1143-00436A23 Assembly shows XOR instruction xor ecx ebp in Stream UID: 22542-1143-00436A23 Assembly shows XOR instruction xor eax ebp in Stream UID: 22542-1144-00436BF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 22542-1144-00436BF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 22542-1145-00436B02 Assembly shows XOR instruction xor ecx ebp in Stream UID: 22542-1145-00436B02 Assembly shows XOR instruction xor eax ebp in Stream UID: 22542-1146-0043678D Assembly shows XOR instruction xor ecx ebp in Stream UID: 22542-1146-0043678D Assembly shows XOR instruction xor eax ebp in Stream UID: 22542-1873-00424C1B Assembly shows XOR instruction xor ecx ebp in Stream UID: 22542-1873-00424C1B Assembly shows XOR instruction xor eax ebp in Stream UID: 22542-1950-00427CCA Assembly shows XOR instruction xor ecx ebp in Stream UID: 22542-1950-00427CCA Assembly shows XOR instruction xor edx dword ptr [00448000h] in Stream UID: 22542-1957-004271F6 Assembly shows XOR instruction xor eax ebp in Stream UID: 22542-1962-0042784F Assembly shows XOR instruction xor ecx ebp in Stream UID: 22542-1962-0042784F Assembly shows XOR instruction xor eax ebp in Stream UID: 22542-1963-004279AA Assembly shows XOR instruction xor ecx ebp in Stream UID: 22542-1963-004279AA Assembly shows XOR instruction xor eax ebp in Stream UID: 22542-1965-00427A7B Assembly shows XOR instruction xor ecx ebp in Stream UID: 22542-1965-00427A7B2a:Teec," Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a42d79176ddc38ec40f8c8c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"