MALICIOUS — 3245260b9529abc8404606685139d69326149566f07606fd09a6c568ca563c6e

MALICIOUS — 3245260b9529abc8404606685139d69326149566f07606fd09a6c568ca563c6e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepscram family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 3245260b9529abc8404606685139d69326149566f07606fd09a6c568ca563c6e
SHA-1: b8df2cdff75a23255d3fa61e740eb14cbf1e0d21
MD5: 93b73beaf4c3988a976b36eddd7fc025
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 768:eyX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIoXhgtTR6JvxIR623iLSou:egKcR4mjD9r82SWF6fIEJLSp
TLSH: T18831F2B4B42AC348D735FC14F1C5BA9EA0336D8704EC56AB25B1D906BC5047BC2EBA60
Submitted as: 3245260b9529abc8404606685139d69326149566f07606fd09a6c568ca563c6e
File type: pe · Size: 42341 bytes
Verdict: malicious (100/100) · Family: Prepscram

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Prepscram): CTS.exe - dynamic signal, weight 0.62, confidence 0.90
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 21 external host(s) at runtime (19 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

2345 behavior events · 1 ATT&CK techniques · 17 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - 47b14667cfdbdabd17e16d78194cc289283da2a460fd70a815eb730d97a2b924
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - 0b2b7f24f333acee87f139c20917edf90f40c0b14d73d2b71e9b8e39cffb286d
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe - 9446b0bf88b3840e8d28cb00bb2b5f875d731b2519c997038ec33d8ed4667624
C:\Users\analyst\AppData\Local\Temp\4Sl5dA38NFFOYZY.exe - aa1ac852e04d25561edc08a4c28035d097b6c10b22c1cf466e5d93a89397d927
C:\Windows\CTS.exe - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe - ccc977ba906f62aa1c3d4080103ae53cded3b3acd92b3f3ed624398dbbfce725
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - fb4e178a8dbee9f2660d61e5a0e8f94bf88e192734a977d56f2ea8810dd7c7f0
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe - 4f5c495fc1ce73d51658a908d8b210d9243ececa1fe63e978fb2613c511bc248
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - 49e962075e8334a1de68f23d2bbfad6651d1088989bfb4a8dff51c7906f98258
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - b9d5879a16b3d417a24b3a7496bc5aa1f0152c09080c27f8044b42ae0787d6a1
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe - 4bee64d5a235751969190cec5769ae69a80b27626a4eb382ac268e15fbb96be4
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - f41bac6ebcf7de5770664e739471be36d608de5b4d7831fe9471d3fe8591c333
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - 4375a0ab2063f9ec5aef524b44c97625d4cf9ff5e858d2ad7012e654219903b7
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - 0169178f5559a45792e9376cc920933087d012f44e348158e4bb25e674d12a72
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe - 7d0aab7842983b0568f7fa0a5a99dc7eb542fc002d41623e22e3a6efe18f7564

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787793975&P2=404&P3=2&P4=NSqPtCMXJiRbWc2OR%2fUnPyBy80LNPpAZ3WW%2fQp%2fLtHI4HOn4AgB5nYjWwvgAF0e%2b%2bqxAYs4DlCaE%2bl%2fz1WA8nQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787794042&P2=404&P3=2&P4=YufDkNSZlIOlDfGWYt5MyBRJ7qc%2bNIAultPD4WOyrodXjRtkXv8USMm4pxUyJyVV3u6j6YVQXAH8b%2boxXIt%2bIQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

52.123.252.197
20.42.72.131
52.230.59.222
4.230.171.124
20.42.179.204
74.178.76.128
4.150.223.115
74.178.76.54
74.178.240.61
20.112.250.133
52.123.129.14
52.123.128.14
135.234.160.246
203.26.79.13
52.110.12.56
52.110.12.54
52.148.114.188
74.179.71.159
72.154.7.97
52.110.12.5
52.110.12.42

More Prepscram samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report