MALICIOUS — 159c1431138792202e0ff42b4325e4625328480ae008b7df51e97b225464f102

MALICIOUS — 159c1431138792202e0ff42b4325e4625328480ae008b7df51e97b225464f102 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepscram family. 6 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 159c1431138792202e0ff42b4325e4625328480ae008b7df51e97b225464f102
SHA-1: 5b9fbeed924b6384ef84ea8f93da985c76e5baad
MD5: f1470fd674c973d074bdcde064b6ba1e
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 768:eyX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIoBh5gUlqsotMtLrspo:egKcR4mjD9r82MrBlHotM5rspo
TLSH: T13C31F174B426D308E227FC3DE0CDB5AE902269460C6D23EB59E09505AC6447FD6F3B18
Submitted as: 159c1431138792202e0ff42b4325e4625328480ae008b7df51e97b225464f102
File type: pe · Size: 42341 bytes
Verdict: malicious (100/100) · Family: Prepscram

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Prepscram): CTS.exe - dynamic signal, weight 0.62, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Prepscram!pz (rule Trojan:Win32/Prepscram!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Rootkit.25 (rule Gen:Variant.Rootkit.25) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Agent.neyndy (rule Trojan.Win32.Agent.neyndy) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

2446 behavior events · 1 ATT&CK techniques · 21 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\FileSyncHelper.exe - 109a70bb28cbd32dde1374771764a5a809958fb546696c0d27d830263cf66e51
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - 61d1687799a2aff09a0f2ae68282753c72d03a69291dc5dbcc2bb1b95d2cd60c
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe - b77a6c62095624ff23ca42e585c7fc4603583e95bea51e745e24cd944f076be7
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - 6336347516e8b842abdd9b0387ee14bbcdea819e0acc1e17cfeadc0a372aa165
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe - 390669da371890a26d0b4100155877999c3e2dd78a884af19917f6d5e56f8bce
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\Microsoft.SharePoint.NativeMessagingClient.exe - 87d2bb9c695b814c03c9e68c990dde16cd1336d216f24c8f3a4ab3c853a0ceb8
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\FileCoAuth.exe - 2b8c9f204687bfc76482d22200b9851123ded1dff729fd4a89f6a6461f4a35f6
C:\Windows\CTS.exe - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - c357ec100a8e397f61718c0bdd15750bd08a7d7c0a5faf038071955a56693abe
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe - 6f74d9e5736a8d83b289ecaed162036c156012565ff7bbe04433543ca105868d
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - 00f408e60cbabd161ee120ba2dc246dac7af7ab5351c4b4640cec1210fa17cd4
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - 41a009dbf474b48e790f980625b336230a1c70d641ac97f863104aed6783a2cd
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe - 6e4b676fa8d2e10b915891f907ad31ed58116c0c7d4ca4e124537e0a16d70be5
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - 739cd1271baa636f604a33d0c0902d219cef33d0ad3fef9c7a2c7e04b0870aff
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe - 4f2c4a3855974bcac9df901afa949a930a143f0b5e0281df1821b71c7297fd0e

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

20.184.175.11
52.253.84.76
52.123.252.219
4.230.171.124
52.110.12.18
52.110.12.45
85.210.196.11
4.150.223.102
72.145.35.104
52.148.114.188
52.110.12.8
52.110.12.40

More Prepscram samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report