MALICIOUS — 1ee2343753891f0c3430a97e66dd932acdb98d5d9ee55916549dd882d82f17f7

MALICIOUS — 1ee2343753891f0c3430a97e66dd932acdb98d5d9ee55916549dd882d82f17f7 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the PolyRansom family. 6 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 1ee2343753891f0c3430a97e66dd932acdb98d5d9ee55916549dd882d82f17f7
SHA-1: ebf748efe021b1148df73bc5117aa80f03ea352a
MD5: 5d3c0f3c7c6cde07763e89f85c31203e
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 3072:FvWs22CuiIQ8tEUH8Ue2Rss+9f36KkTNk/OgM1XIjXeI78KbmS2pntjH:gGCuiMq+b1sPLjM+TbwVh
TLSH: T153414A65861B32D3D6FA477CAF18593C2D43EAC7223D9927B029C55F37AAA13E1060C1
Submitted as: 1ee2343753891f0c3430a97e66dd932acdb98d5d9ee55916549dd882d82f17f7
File type: pe · Size: 197120 bytes
Verdict: malicious (100/100) · Family: PolyRansom

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): BC.Win.Virus.Ransom-9157.A
Microsoft Defender: Virus:Win32/Nabucur.A
Emsisoft (Emergency Kit): Win32.Virlock.Gen.4
Trellix Stinger (McAfee): W32/VirRansom
Kaspersky (KVRT): Virus.Win32.PolyRansom.a

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged BC.Win.Virus.Ransom-9157.A (rule BC.Win.Virus.Ransom-9157.A) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Virus:Win32/Nabucur.A (rule Virus:Win32/Nabucur.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Virlock.Gen.4 (rule Win32.Virlock.Gen.4) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/VirRansom (rule W32/VirRansom) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.PolyRansom.a (rule Virus.Win32.PolyRansom.a) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.text (rule high-entropy-sections:.text) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Dropped 13 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

11704 behavior events · 3 ATT&CK techniques · 32 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\JiswkEsM.bat - a4eb5c9892f8832b378b94ada5b0c34b3264cba66ee8835f2fc77a8cb4bbbd75
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Users\analyst\rSwIoccE\vcIYEIkQ - 40f414cdb4c80234227b1de3801243b2b77d794e309dbef4147795165a0bf0b0
C:\Users\analyst\AppData\Local\Temp\tsk_f100636cd01a4f9f - 6973a2aae66bbb99f2b57f2ef160182825fa5305444511ca1eca4e1b0b38528b
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.exe - 90d7a0e4f29ceaf0b0d2ad7a49cc87eeafd62742423c833b54dad9a5a16bfe5e
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.exe - e4d803ffb7eba014de2556a547fdd488e928e1ce7bb1727758156a7e1bd96ea8
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.exe - dcc0271285fb43bb7c209c574ab1853987ae1618456141df96d497aa37a7546a
C:\ProgramData\xiocAsMc\yKgEskQE - 596b77851ae8cbc68fc4d4e1623daa244ac2222365e0f228a056e5c8badd2938
C:\Users\analyst\AppData\Local\Temp\QIYM.ico - bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620
C:\Users\analyst\AppData\Local\Temp\jiIkMEEg.bat - f488c9fe9ff8e23f1f9ea7e758958d4bb9907dfdcf663d2f278d83cf24e9d28a
C:\ProgramData\xiocAsMc\yKgEskQE.exe - 07121595ae347ad2e26679e58e6d4ab9214a9bcde338fa360d1bd2a4165c9187
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.exe - 21b6453fca98e843111859ec0d8674e1f342945c76731bee23014959677a68be
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png - d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698
C:\Users\analyst\rSwIoccE\vcIYEIkQ.inf - 1872208960ff0e47a7e4a0a7432558720f345e312961fe4f607c698f9366afb5
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png - 5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://google.com/
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.184.175.18
20.247.185.124
40.84.97.4
4.230.171.124
57.154.63.210
40.79.163.154
74.178.76.54
20.165.94.63
20.42.179.192
200.87.164.69
200.119.204.12
52.110.12.1
52.110.12.50
190.186.45.170
4.150.223.102
4.150.223.105
52.148.114.188
172.178.240.161
52.110.12.55
52.110.12.42
72.145.35.102

More PolyRansom samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report