MALICIOUS — 01b571247526975e41c23d47b51703b672117e065bbd6c7fa97c5543b52e5c80

MALICIOUS — 01b571247526975e41c23d47b51703b672117e065bbd6c7fa97c5543b52e5c80 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AutoRun family. 11 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 01b571247526975e41c23d47b51703b672117e065bbd6c7fa97c5543b52e5c80
SHA-1: 0d3c2d601e5aea46d7c0cea770b3c164ac9de7b4
MD5: bb69340503990d67dc5e96ab16af1884
imphash: 01392ca861cf87b8d28ad9ea90016bb4
ssdeep: 49152:P6P9zWmTr3iItboeisbPxsNBk9/fw2BwfmM0fV:SPXsNi9Xwgwfot
TLSH: T1B2585BCD0219BF91E1768BC06C446EDCE0E5B4F9637A6A4C0943C03F97A60EBBD69095
Submitted as: 01b571247526975e41c23d47b51703b672117e065bbd6c7fa97c5543b52e5c80
File type: pe · Size: 1696674 bytes
Verdict: malicious (100/100) · Family: AutoRun

Detections (11 of 55 engines)

capa (capabilities): capability:collection/keylog
MalwareAnalyser heuristics (entropy/packer): ASPack
ClamAV (daily): Win.Malware.Dqan-9886282-0
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Worm:Win32/AutoRun!pz
Emsisoft (Emergency Kit): Gen:Heur.Mint.Autorunner.1
Trellix Stinger (McAfee): W32/Worm-GBW!BB6934050399
Kaspersky (KVRT): Worm.Win32.AutoRun.vx

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Dqan-9886282-0 (rule Win.Malware.Dqan-9886282-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 26 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: ASPack, high-entropy-sections:.text, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 26 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

25170 behavior events · 1 ATT&CK techniques · 27 dropped files.

Dropped files

C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jfr.exe - 3e27cc6407fc7d7b6e26495c6ff849c23cf3b6e9c8a885ea742ad7b3109af536
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\ktab.exe - 51e57fdf672acec905dc11fb467293a6c1251683cb92e769d451e46b9e0e92d6
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\ktab.exe - eb7f5100d0b3755f6adfb2839fe26b55ff256b6d6bfb243a193b5fdc05eef3fe
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\klist.exe - 691d17e37e437020538994c7eb904ca1b37d41c7a4a781e58afe324e74460b72
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\java.exe - b7900a8700105e57892966a969bc4b66698aa99fd738c24d3ae5ee445c23ad98
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jrunscript.exe - 3c6d62569a6dbad19d57ab33039ea0626a3eaf4386fa8b207c136957b26005ab
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jabswitch.exe - c4c65264e0d3b9b31c5262259ec4b8af6ec62a1fff918a98910aabf17f015959
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccessinspector.exe - 440b91baf1dc3fcf903d5fc7e996230b2187ba1f343ba4b68308ae37abd2df7d
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\javaw.exe - 8336ed90227ca383e16600410311dc47639f3abbf9cb4e36ef4148cf1e8adbe9
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\java.exe - 8c435a45123e88410f42259fcb3b303b5f60ce00e01d8d4a9c5bd342bf51e184
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\keytool.exe - 599e533da3261e2fc678ccc3393bb90cafa7ce620196168b9c5cb41a4e48099b
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccessinspector.exe - a7487ee88d94f322148489c818cc861ee1e77ec31ce5b5e7b5e999c0d5acf6f6
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\javaw.exe - 00293b1fc4c093b570c7a9433fb5b16b188e938061cacf6f7a35721a6f346acb
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccesswalker.exe - 38355c7d7b50ce81ad858eb27343b555d200c2ae3abca3e13cf9d9526eb087bd

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787832052&P2=404&P3=2&P4=dWAYKuKFOmbOm7uCeXPhjzHcpDKPOBZgDo8BafLoz6waaPmG%2fgBVjwhT9Gm5IOA64J%2bD2z%2fahsUnFDhJi0hQDA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787832114&P2=404&P3=2&P4=Uwie14dbtoQK9HsSjPa4wrsNN83TCevn9f8cL9ltui6xH6ssqmkN9HvCR3BgRxMTXY0heFNSQJ%2fgbwLle8K2iQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

crl.microsoft.com
www.microsoft.com
office.microsoft.com
outlook.network

Embedded IP addresses

20.50.201.205
52.123.252.236
52.123.252.193
57.155.104.224
4.230.171.124
4.144.132.223
74.179.77.204
74.179.71.159
135.233.95.135
20.184.175.6
203.26.79.13
20.184.175.1
52.123.129.14
20.112.250.133
52.123.128.14
135.233.45.223
52.110.12.56
52.110.12.20
52.148.114.188
72.154.7.97
52.123.252.216
52.123.252.244
40.79.197.34
13.89.179.15
52.110.12.55

Registry keys

HKEY_LOCAL_MACHINE\Software\Classes\{0}.

File paths

d:\dbs\el\oc\target\x86\ship\postc2rcross\x-none\msohtmed.pdb
X:\:`:d:h:l:p:t:x:
T:\:h:
T:\:d:l:t:
f:\dd\Tools\devdiv\FinalPublicKey.snk
F:\Office\Target\x86\ship\postc2r\x-none\msqry32.pdb
H:\:c:
W:\:l:
T:\:a:i:n:v:{:
X:\:l:p:t:x:

More AutoRun samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report