MALICIOUS — 23671f15553b3b4c39d1acf8b382dae25a5166dafcdddfbdce55311e3cfe236a

MALICIOUS — 23671f15553b3b4c39d1acf8b382dae25a5166dafcdddfbdce55311e3cfe236a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the PolyRansom family. 6 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 23671f15553b3b4c39d1acf8b382dae25a5166dafcdddfbdce55311e3cfe236a
SHA-1: e1419eb134249e01bfd9bd525f83090ed111ba01
MD5: b89fa9f671c54adbcb9940ccdf5b4ab6
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 6144:qcE8DsqmgFig7YxdxL0nDh3+orGAYVisoK03teGOVSM:qcjDsdg7axLqRwyXM
TLSH: T1C6465B378C3F328BE6180B5B98A2521C12E62135BF58E6D4C99E15A3C597ACF53104FB
Submitted as: 23671f15553b3b4c39d1acf8b382dae25a5166dafcdddfbdce55311e3cfe236a
File type: pe · Size: 296960 bytes
Verdict: malicious (100/100) · Family: PolyRansom

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): BC.Win.Virus.Ransom-9157.A
Microsoft Defender: Virus:Win32/Nabucur.A
Emsisoft (Emergency Kit): Win32.Virlock.Gen.4
Trellix Stinger (McAfee): W32/VirRansom
Kaspersky (KVRT): Virus.Win32.PolyRansom.a

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged BC.Win.Virus.Ransom-9157.A (rule BC.Win.Virus.Ransom-9157.A) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Virus:Win32/Nabucur.A (rule Virus:Win32/Nabucur.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Virlock.Gen.4 (rule Win32.Virlock.Gen.4) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/VirRansom (rule W32/VirRansom) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.PolyRansom.a (rule Virus.Win32.PolyRansom.a) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.text (rule high-entropy-sections:.text) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Dropped 17 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

32783 behavior events · 3 ATT&CK techniques · 30 dropped files.

Dropped files

C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.exe - 3bbf3fb14823a0f9bd676d796006a74d01b77f1d690295a316a5d5dbc01ad4d6
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Users\analyst\AppData\Local\Temp\gkEK.exe - f3d1ccaa51e984dd25a8001af0853b4317913477d74a4d58c638bf7b7e7d700a
C:\ProgramData\xiocAsMc\yKgEskQE.inf - 1fc6c9b6e29ebc15d1f1e6dfa4a4a85d68fa2ff8c89c3389ef1c462352ed8638
C:\Users\analyst\AppData\Local\Temp\gMEO.exe - 80d3f7a883187a2a6c39bb079c4db2046c8f6b731f25e018ae113bd9413e384c
C:\Users\analyst\rSwIoccE\vcIYEIkQ - a5143eff41bde930988610560facc987e40c6ecc25fbbdd16a15fd694d69c8ad
C:\Users\analyst\rSwIoccE\vcIYEIkQ.exe - 72863c7390b19607deb57937bae4404e314fd90f40bb7779d4f62a29097594ab
C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.exe - 741048277fade1c0de61d1a53a58b639c6af605dda1fcd855a0c224c4ce07b64
C:\Users\analyst\AppData\Local\Temp\OgEQ.exe - 862559f18d07b1c0f9783918deee734eb696a90c89e075b50ecd9dd16093da5f
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.exe - 87ca3071ae37873a1994f323a1d7f1115363a7d0e13e3f4f0ce1791ee9be5c58
C:\ProgramData\Microsoft\User Account Pictures\guest.bmp - dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d
C:\Users\analyst\AppData\Local\Temp\aooS.ico - bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620
C:\Users\analyst\AppData\Local\Temp\pip3.exe - 7adc240140487929587aac46639aae378c76dc41d9ed32b8b63e3cc8ee862536
C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png - d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698
C:\Users\analyst\rSwIoccE\vcIYEIkQ.inf - 4c40fb398cab46dd7e6acee3717dbe72f7b668ef7b812818d712f7e33ee24041

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://google.com/
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.207.44.76
52.123.252.236
4.144.132.223
4.230.171.124
200.87.164.69
200.119.204.12
85.210.196.11
190.186.45.170
20.42.179.204
20.184.175.8
13.89.179.15
72.154.7.102
52.148.114.188
52.110.12.44
52.110.12.21

More PolyRansom samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report