SUSPICIOUS — 3f7705fdbfc8318da09b23617b83829e0d0a98e2e07bcbd69705db3496c6366d
SUSPICIOUS — 3f7705fdbfc8318da09b23617b83829e0d0a98e2e07bcbd69705db3496c6366d is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (53/100). 0 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
3f7705fdbfc8318da09b23617b83829e0d0a98e2e07bcbd69705db3496c6366d - SHA-1:
e1415269d48dbfce4dd8c3837f581487e3cbd5dd - MD5:
030e73385b908cf916abf0c2cca519d9 - imphash:
7f0abc7bdb97ab0c2d9ea608f62e4e53 - ssdeep:
3072:en77v00hEoDEtauarj6UuNiJbz9a2MNUa8b32tvhOEA1RJCir86SrSrvrIa34:e740IKrgiJbh2Ua8T2t0EyL+tao - TLSH:
T13D3E0265CB9AEAC6FEA58C4B5C82CD1D45B391B891F9B6460CDA001D5CD00B329FA1FC - Submitted as: 3f7705fdbfc8318da09b23617b83829e0d0a98e2e07bcbd69705db3496c6366d
- File type: pe · Size: 139975 bytes
- Verdict: suspicious (53/100)
Detections (0 of 56 engines)
No engine flagged this sample.
MITRE ATT&CK
Why this verdict
The suspicious score of 53/100 is the fusion of 3 weighted signals:
- Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Embedded network infrastructure: http://nsis.sf.net/NSIS_Error - static signal, weight 0.35, confidence 0.60
- Dropped 4 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Dynamic analysis (windows)
1144 behavior events · 0 ATT&CK techniques · 5 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- update.googleapis.com
- desktop-hsgcbep
- login.live.com
- v20.events.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
- edge.microsoft.com
- watson.events.data.microsoft.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
Dropped files
- C:\Users\analyst\AppData\Local\Temp\nspE30E.tmp\System.dll -
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca - C:\Users\analyst\AppData\Local\Temp\nspE30E.tmp\StdUtils.dll -
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e - C:\Users\analyst\AppData\Local\Temp\nspE30E.tmp\modern-wizard.bmp -
2079f7a3eba60e0d9ee827a7208aa052a71b384873b641de5e299aeb8e733109 - C:\Users\analyst\AppData\Local\Temp\nspE30E.tmp\UAC.dll -
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08 - C:\Users\analyst\AppData\Local\Temp\nspE30E.tmp\nsDialogs.dll -
1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
Embedded URLs
- http://nsis.sf.net/NSIS_Error
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- nsis.sf.net
Embedded IP addresses
- 52.168.117.171
- 4.144.132.114
- 4.230.171.124
- 135.233.45.221
- 52.110.12.33
- 52.110.12.30
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report