MALICIOUS — 219a5973f456b3bd0f4e95b09a586de187acf1586964437e306e156e14a03b42

MALICIOUS — 219a5973f456b3bd0f4e95b09a586de187acf1586964437e306e156e14a03b42 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AutoRun family. 8 of 25 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 219a5973f456b3bd0f4e95b09a586de187acf1586964437e306e156e14a03b42
SHA-1: f1d60096e23f300b47ce0c9a351d078df55be638
MD5: 1a5af2669f05c46a0349262efcb6e29c
imphash: 01392ca861cf87b8d28ad9ea90016bb4
ssdeep: 49152:qLg4s/IabjKoh9WsRrRokp88xmN3Aek03noj45wlDT:48IabjKoh9WsRrRokqeUJF3noxD
TLSH: T1465D18C4621AD742C1F9AB1D7D744B9D60A2F0A4313D8C08EE87F06D1DFAA2358A4E5D
Submitted as: 219a5973f456b3bd0f4e95b09a586de187acf1586964437e306e156e14a03b42
File type: pe · Size: 2706868 bytes
Verdict: malicious (100/100) · Family: AutoRun

Detections (8 of 25 engines)

capa (capabilities): capability:collection/keylog
MalwareAnalyser heuristics (entropy/packer): ASPack
YARA: JPCERT/CC: JPCERT_Emotet
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Microsoft Defender: Worm:Win32/AutoRun!pz
Emsisoft (Emergency Kit): Trojan.Runner.BP
Kaspersky (KVRT): Worm.Win32.AutoRun.vx

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

Dropped a malicious payload: bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - dynamic signal, weight 0.80, confidence 0.90
Memory forensics: 6 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 2672) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Worm:Win32/AutoRun!pz (rule Worm:Win32/AutoRun!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Runner.BP (rule Trojan.Runner.BP) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Worm.Win32.AutoRun.vx (rule Worm.Win32.AutoRun.vx) - engine signal, weight 0.55, confidence 0.85
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 35 external host(s) at runtime (11 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_Emotet (rule JPCERT_Emotet) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.symauth.com/cps0, http://www.symauth.com/rpa04, http://www.symauth.com/cps09 - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: ASPack, high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

21056 behavior events · 1 ATT&CK techniques · 83 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/7534/files/32acc1bc543116cbe2cff10cb867772df2f254ff2634c870aef0b46c4b696fdb - 32acc1bc543116cbe2cff10cb867772df2f254ff2634c870aef0b46c4b696fdb
/opt/CAPEv2/storage/analyses/7534/files/9c224f94a50e08e0c125d48da29aad1d6c6b2e56cb9ce84f5c3d5cc7c55464ac - 9c224f94a50e08e0c125d48da29aad1d6c6b2e56cb9ce84f5c3d5cc7c55464ac
/opt/CAPEv2/storage/analyses/7534/files/38dddae6dd243ca0ba7b2c7f55515cc5e292a59d32c335c1d73076d8c7864442 - 38dddae6dd243ca0ba7b2c7f55515cc5e292a59d32c335c1d73076d8c7864442
/opt/CAPEv2/storage/analyses/7534/files/3a20652c7bf0205167d4eda4599feccb6c73d70d5872bcd98588aa1944515b1d - 3a20652c7bf0205167d4eda4599feccb6c73d70d5872bcd98588aa1944515b1d
/opt/CAPEv2/storage/analyses/7534/files/5141023ecc1f524e2e96d4d5ccc7121158549a719ee43b03911a52bd216110a6 - 5141023ecc1f524e2e96d4d5ccc7121158549a719ee43b03911a52bd216110a6
/opt/CAPEv2/storage/analyses/7534/files/0e03675850241d06080af9ec470649ca4a006222c4ff5d1b05029f1751fecf91 - 0e03675850241d06080af9ec470649ca4a006222c4ff5d1b05029f1751fecf91
/opt/CAPEv2/storage/analyses/7534/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
/opt/CAPEv2/storage/analyses/7534/files/0d798b3f5262d36c2a66553e4d3e5d89b7de50461acf8226b0486126cabd7cb6 - 0d798b3f5262d36c2a66553e4d3e5d89b7de50461acf8226b0486126cabd7cb6
/opt/CAPEv2/storage/analyses/7534/files/fd62a563044b6e7bf60a182091e5c78d42f8d6fab3637bab2990d4346be36932 - fd62a563044b6e7bf60a182091e5c78d42f8d6fab3637bab2990d4346be36932
/opt/CAPEv2/storage/analyses/7534/files/a544eff590ea98ba6ed4bea09d41fa7c968a445702405e5711ad4d541d1ccbf7 - a544eff590ea98ba6ed4bea09d41fa7c968a445702405e5711ad4d541d1ccbf7
/opt/CAPEv2/storage/analyses/7534/files/67799854eedc89cfeb12dc4d324efe3e00af3b8665579d42dd6b4d98dfb24089 - 67799854eedc89cfeb12dc4d324efe3e00af3b8665579d42dd6b4d98dfb24089
/opt/CAPEv2/storage/analyses/7534/files/b68cc5ddcf1979c57125089d525ba76d89f1cd3f43db7b60a2cc1f6c1f6e3fcc - b68cc5ddcf1979c57125089d525ba76d89f1cd3f43db7b60a2cc1f6c1f6e3fcc
/opt/CAPEv2/storage/analyses/7534/files/069c94fc956203adffa26a29c7504721608ed7898fbcbc4f1f11b12093d5892a - 069c94fc956203adffa26a29c7504721608ed7898fbcbc4f1f11b12093d5892a
/opt/CAPEv2/storage/analyses/7534/files/43020a4a789de8844a68bcfebbb79d04a7857c8817524b2aff337df226dfea72 - 43020a4a789de8844a68bcfebbb79d04a7857c8817524b2aff337df226dfea72
/opt/CAPEv2/storage/analyses/7534/files/920fb0937f8a9d345830865059b6ae3f35ab6803ad4cffef4447473ec18e17a0 - 920fb0937f8a9d345830865059b6ae3f35ab6803ad4cffef4447473ec18e17a0

Embedded URLs

http://crl.thawte.com/ThawteTimestampingCA.crl0
http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
http://crl.verisign.com/pca3.crl0
https://www.verisign.com/cps0
http://logo.verisign.com/vslogo.gif04
http://www.symauth.com/cps0
http://www.symauth.com/rpa04
http://crl.verisign.com/pca3-g5.crl0
http://www.symauth.com/cps09
http://evcs-crl.ws.symantec.com/evcs.crl0
http://evcs-aia.ws.symantec.com/evcs.cer0
http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://office.microsoft.com/0
https://armmf.adobe.com/arm-manifests/win/
http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows
http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Windows
http://watson.microsoft.com/dw/dcp.asp
http://watson.microsoft.com/dw/watsoninfo.asp
http://schemas.microsoft.com/SMI/2005/WindowsSettings

Embedded domains

crl.thawte.com
ts-aia.ws.symantec.com
ts-crl.ws.symantec.com
crl.verisign.com
www.verisign.com
logo.verisign.com
www.symauth.com
evcs-crl.ws.symantec.com
evcs-aia.ws.symantec.com
crl.microsoft.com
www.microsoft.com
office.microsoft.com
armmf.adobe.com
www.adobe.com
watson.microsoft.com
microsoft.com
msn.com
schemas.microsoft.com
crl.certum.pl
repository.certum.pl
www.certum.pl
ccsca2021.crl.certum.pl
subca.repository.certum.pl
subca.crl.certum.pl

Embedded IP addresses

1.7.2.0
11.0.07.79
26.2.5.2
13.89.179.12
52.123.252.229
4.230.171.124
40.84.97.4
52.253.84.76
135.232.92.97
74.178.76.128
4.150.223.108
135.234.160.244
92.223.78.30
52.110.12.1
52.110.12.52
52.123.252.212
74.178.76.44
4.150.223.105
20.50.201.195
203.26.79.13
72.153.5.136
52.148.114.188
52.110.12.40
52.110.12.44

Registry keys

HKCU\Software
HKCU\Software\Policies
HKLM\Software
HKLM\Software\Policies
HKCU\Software\Microsoft\Shared\OfficeUILanguage
HKLM\Software\Microsoft\Windows
HKLM\Software\Microsoft\Office\11.0\Registration
HKEY_CLASSES_ROOT\Software\Adobe\Acrobat\Exe
HKLM\SOFTWARE\RegisteredApplications

File paths

d:\_Bld\10657\7994\Sources\obj\Win32\Release\EvaluationContainer.NetFX40.csproj\Microsoft.Mashup.Container.NetFX40.pdb
f:\CB\ARM_Sustaining\BuildResults\bin\Win32\Release\AdobeARMHelper.pdb
X:\:`:
X:\:`:d:h:l:p:@;D;H;L;P;T;X;\;`;
X:\:`:d:h:p:t:x:
X:\:`:d:h:l:p:t:x:
T:\:h:
P:\Target\x86\ship\dw\x-none\dw20.pdb
T:\:d:l:t:
X:\:l:p:t:x:
E:\build\workdir\LinkTarget\Executable\minidump_upload.pdb
E:\build\workdir\LinkTarget\Executable\gengal.pdb
E:\build\workdir\LinkTarget\Executable\odbcconfig.pdb
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin1.inl
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl

More AutoRun samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report