MALICIOUS — 18e33ad737465bd90232f4119b50e505bed043fff96561c406380fac3b615c69

MALICIOUS — 18e33ad737465bd90232f4119b50e505bed043fff96561c406380fac3b615c69 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepscram family. 6 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 18e33ad737465bd90232f4119b50e505bed043fff96561c406380fac3b615c69
SHA-1: bd6ecb556c89d32295865b5239269b314071acde
MD5: 489dd3a038a38e1b1aea5a7b9b9e3ffb
imphash: 0b978ec7715483bec18fb1fc3a2a737a
ssdeep: 6144:sZl2PGbyjHI4Q0+ncV3lkNr10TXO/yEqgaews69oa5f/uDM0QSyNK+eo:smPayjo4Q02l0bccgae89H/nHNeo
TLSH: T1CC4912ED492B6382C6A2CA235F005D1E5823F0B61FBD364C39839CAF789246F54B552D
Submitted as: 18e33ad737465bd90232f4119b50e505bed043fff96561c406380fac3b615c69
File type: pe · Size: 412184 bytes
Verdict: malicious (100/100) · Family: Prepscram

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Virus.5
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Prepscram!pz (rule Trojan:Win32/Prepscram!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Virus.5 (rule Gen:Variant.Virus.5) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Agent.neyndy (rule Trojan.Win32.Agent.neyndy) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
Dropped 19 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

2441 behavior events · 1 ATT&CK techniques · 19 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - 8cb04d6f2626de169c79b2fe2c88cbbe5be5a727ddb45939666492f82e9a9784
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - 422edd1bbeae9b3f1d23646fda5b58b13756d0f7e743d8e52f1315b8cc107524
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe - a3a36ac65701c390ca6712346474d6c5fc810ccb73023cdd1f05aa50026302e6
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\FileSyncConfig.exe - 1c323bdcc0d092779ff007538d1e7a1bb334b079e40b8abdfa2f03f0055e7e3b
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe - bc026428f5cf10f1eb8a14645f81705f6dbf6fa0e3f97dc8ae3555fd250a7e59
C:\Users\analyst\AppData\Local\Temp\qyaKHoFTY0OAQhg.exe - 1aa3927c7985386d42759656665c7b422ee226df16a19446af6d9a6613b8ae9b
C:\Windows\CTS.exe - ed4b824eaa8cba890b9fa625231d1faa1820eda535c4d8603cf243672969b365
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - f4b36ba3baa2fed76b967556997db6d26edb9657ca05140e3522a4f95a2f603c
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - 1a4f691fe095b35e80ec9261f220ddf0fcbadb7306b8faaf95ec59baba570091
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\FileSyncHelper.exe - bc83f0ba762409d70beb8adbd7a269ff3225b5d7d34c2b80c634014e42e1aae1
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - ed9694225304bb8300615548feee6b701d2fc94b9b3234a411aa4794f016f13f
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - 58cca5d6a3fead26a19e81d17eed8fb927611b73f674ec6c2b5d6c08b28c7ca1
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - d1bcaeb293e7de6769263f108b7d3a98dfa5d78bed9c921e0269c218c1ad3acf
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe - 928a64b0c8e684428ff28d9279a50d2767051d19995e018c194db9a2411185a6
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - 52ddc6ee31325069e6d3f725d800d30975b5ce421d67765a31d58853f01b3b69

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.97
52.123.252.220
4.230.171.124
20.42.179.192
85.210.193.152
135.233.95.135
135.232.92.137
4.150.223.110
74.178.240.61
52.253.84.76
4.207.44.65
20.184.175.7
52.168.117.171
72.145.35.99
92.223.78.30
52.148.114.188
52.110.12.19
52.110.12.28

More Prepscram samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report