MALICIOUS — 04d9fea21c34794a0a85271630915a603a68ccd905ff9937bff926f3abdf719c

MALICIOUS — 04d9fea21c34794a0a85271630915a603a68ccd905ff9937bff926f3abdf719c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepscram family. 6 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 04d9fea21c34794a0a85271630915a603a68ccd905ff9937bff926f3abdf719c
SHA-1: 600496a50bb3dda967718ff883436e31a481cf3b
MD5: 5d087e56c4bd50f181ce1949dd7a7888
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 768:eyX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIo9reK0oUBCGZE8mBvuYQb:egKcR4mjD9r82crzLUBCGCGB
TLSH: T1D732F1762576E34CE612FC28A0DCBF5EB1432D8D08DD165B25704945ACE88BFD6D2E20
Submitted as: 04d9fea21c34794a0a85271630915a603a68ccd905ff9937bff926f3abdf719c
File type: pe · Size: 44136 bytes
Verdict: malicious (100/100) · Family: Prepscram

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Virus.8
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Prepscram): CTS.exe - dynamic signal, weight 0.62, confidence 0.90
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

8198 behavior events · 3 ATT&CK techniques · 17 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - 839582e8e909039447c175b5adfc19467f1baa53829f0cb7fc1befdc24f74695
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - 33faf7e7ef96d9512a2fc86217ebeef0e56eb75e7bb1bc7d0c2696f12d1fb780
C:\Users\analyst\AppData\Local\Temp\5nHuav9Q3pxe7tp.exe - 3f1302b1ae23f0a75417910f1502fe7557e9078f3256abe5111d66046b5f543e
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - 682c36d13a7564c450d30dd2327afd3accebe3fa6460645085138c18bea5e7e6
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - 6fdd6b62262cfeb040ca602f0b870aff11f490c34d5dafc86bae545626c9147e
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - dbce213b54e3014d02498292503db469a647d2e6c28b751bbe966bf86f830b84
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - ab9c3ab92cc49d202a7c247540e7a7003cd3650fedad3964e0ceaed571396952
C:\Windows\CTS.exe - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe - 8ce86e85f738743f01eebc1de1b7d6d1be3ae7ab298f433155bd61aa18d8c9de
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - 45f87a583d8db6948b9363064827ccd1ae20d208e2dc025fbc50a1136ab6a4a9
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe - e4fbf5f2538b00ae2cb881620d880413060ee3b2fb1eb648dcec15be75365b1f
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe - b882b36b1ef27164f0a60345aa80fce59e5c0a5986477e4616d3bf1a47898dac
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - 7da69268966c685d76002704832686590bbb70569b74660e55ad682f27510172
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe - 49545237b4a0a9f30d4839000704cb77719c34e99dbecef522b6aad4755ede15
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe - bbc695852ef7d1ae815f1a031791242cc743c78710c57cf9b1a967962a56302e

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787860556&P2=404&P3=2&P4=YIvn4emu4M9XhOiA0PePt5wgEaQK3sN6HBb%2f8ZLqEWpyWccOKuT073cWr%2bRFiEuLfhXE7btOue%2blEPd7xxl%2buw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787860620&P2=404&P3=2&P4=OjrSjYQUDi7zNm1CxVs8BkavrFRe98W6xDUCt9fMGwmWSS8kZuYgr9uOPgRbp1wqYjtg28Cikol6hpE%2b2k9Q6w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.89.1.9
4.230.171.124
20.247.185.124
40.84.85.40
74.179.77.204
74.178.240.51
20.42.65.90
20.231.239.246
52.123.129.14
52.123.128.14
20.42.73.28
203.26.79.13
74.179.71.159
40.84.97.4
172.178.240.162
52.110.12.19
52.110.12.42
172.178.240.163
52.148.114.188
72.145.35.109
13.89.179.12
20.42.73.25
52.110.12.56
52.110.12.11

More Prepscram samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report