MALICIOUS — 34b552621778d75d91a3bd3f2e1d1bc632b6c719dbeaf774a6ded4a83aa9389d
MALICIOUS — 34b552621778d75d91a3bd3f2e1d1bc632b6c719dbeaf774a6ded4a83aa9389d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (70/100), attributed to the Container family. 2 of 29 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
34b552621778d75d91a3bd3f2e1d1bc632b6c719dbeaf774a6ded4a83aa9389d - SHA-1:
49b06806504e6025369546865487aad7504e09cd - MD5:
babfee25a6bc1acc7657a0da494069f0 - imphash:
5e6955ab958f0427686406bc5d4d6248 - ssdeep:
49152:Ok3m4nPMW3DKzb6mNegP36BAZBfxDY26w:x3m4nPMWibf3P36OvDY0 - TLSH:
T11A583A8D023FA723D3B6CE2418249EAE4761B0D525BD755C2A07713FE4624A3FC712A9 - Submitted as: 34b552621778d75d91a3bd3f2e1d1bc632b6c719dbeaf774a6ded4a83aa9389d
- File type: pe · Size: 1647848 bytes
- Verdict: malicious (70/100) · Family: Container
Detections (2 of 29 engines)
- YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
MITRE ATT&CK
Why this verdict
The malicious score of 70/100 is the fusion of 5 weighted signals:
- Contacted 20 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
- YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule
DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.35, confidence 0.70 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60 - enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dynamic analysis (windows)
0 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- settings-win.data.microsoft.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
Embedded URLs
- http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
- http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
- http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
- http://office.microsoft.com
- http://www.w3.org/1999/XSL/Transform
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787903196&P2=404&P3=2&P4=ZSRKUS4RNQ%2bUNIhDlLGhfLTLqIVz5KU5L3HPhtcoCTkFGvdW%2fBKgJ2LmR7PlZNmUCAXyAu4FzffrWNe0bWIBKA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- crl.microsoft.com
- www.microsoft.com
- office.microsoft.com
- www.w3.org
Embedded IP addresses
- 20.42.179.204
- 4.207.44.67
- 52.123.252.227
- 57.155.104.224
- 52.253.84.76
- 4.230.171.124
- 74.179.77.204
- 135.232.92.97
- 20.42.73.25
- 20.231.239.246
- 52.123.128.14
- 52.123.252.243
- 203.26.79.13
- 172.66.2.5
- 135.233.45.223
- 72.154.7.16
- 20.165.94.46
- 52.148.114.188
- 52.110.12.16
- 52.110.12.1
Registry keys
- HKEY_LOCAL_MACHINE\%s.
- HKCU\Software\Microsoft\Office\15.0\Common\InstallRoot[AdvertiseCount]
- HKLM\Software\Microsoft\Office\15.0\Common\InstallRoot[AdvertiseCount]
- HKCU\%s.
- HKLM\%s.
File paths
- P:\Target\x86\ship\msicustomactions\x-none\ocfxca.pdb
- D:\:l:p:
- R:\:f:p:z:
- D:\:
- P:\Target\x86\ship\msicustomactions\x-none\finishlicensing.pdb
- X:\:`:d:h:l:p:t:x:
- E:\delivery\Dev\wix36_soc\build\ship\x86\wixca.pdb
- e:\delivery\dev\wix36_soc\src\ca\wixca\dll\osinfo.cpp
- e:\delivery\dev\wix36_soc\src\ca\wixca\dll\secureobj.cpp
- e:\delivery\dev\wix36_soc\src\ca\wixca\dll\serviceconfig.cpp
- e:\delivery\dev\wix36_soc\src\ca\wixca\dll\shellexecca.cpp
- e:\delivery\dev\wix36_soc\src\ca\wixca\dll\test.cpp
- e:\delivery\dev\wix36_soc\src\ca\wixca\dll\xmlconfig.cpp
- e:\delivery\dev\wix36_soc\src\ca\wixca\dll\xmlfile.cpp
- e:\delivery\dev\wix36_soc\src\ca\wcautil\wcautil.cpp
- e:\delivery\dev\wix36_soc\src\ca\wcautil\wcascript.cpp
- e:\delivery\dev\wix36_soc\src\ca\wcautil\wcalog.cpp
- e:\delivery\dev\wix36_soc\src\ca\wcautil\wcawrap.cpp
- e:\delivery\dev\wix36_soc\src\ca\wcautil\qtexec.cpp
- e:\delivery\dev\wix36_soc\src\ca\wcautil\wcawow64.cpp
- e:\delivery\dev\wix36_soc\src\dutil\strutil.cpp
- e:\delivery\dev\wix36_soc\src\dutil\memutil.cpp
- e:\delivery\dev\wix36_soc\src\dutil\procutil.cpp
- e:\delivery\dev\wix36_soc\src\dutil\proc2utl.cpp
- e:\delivery\dev\wix36_soc\src\dutil\fileutil.cpp
More Container samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report