MALICIOUS — 466ce5472a891395af7debee3a92ae095d047b8d1dc7f503077239ab88ab4946

MALICIOUS — 466ce5472a891395af7debee3a92ae095d047b8d1dc7f503077239ab88ab4946 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepscram family. 6 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 466ce5472a891395af7debee3a92ae095d047b8d1dc7f503077239ab88ab4946
SHA-1: d13b1c8bfe0a96470049a52b9745565fb7b5a95e
MD5: 96039c3371dc7582e0b9c818a7deb2df
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 98304:wK5ia3BluVJNcxmB8FLmKx43h/nif0BOLKT4CETzWGDZUP7SD3ck5dO2:HiQBcOMB81Ah/oE7mzWGDZUuf
TLSH: T109633325D9B696CEC3556C022604D9FD015FA29C04BB416E3BBD6CCA649B02F3FBD809
Submitted as: 466ce5472a891395af7debee3a92ae095d047b8d1dc7f503077239ab88ab4946
File type: pe · Size: 4781440 bytes
Verdict: malicious (100/100) · Family: Prepscram

Detections (6 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Virus.8
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Prepscram): b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - dynamic signal, weight 0.80, confidence 0.90
Memory forensics: 4 finding(s), e.g. RWX/private injected region in svchost.exe (pid 932) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Prepscram!pz (rule Trojan:Win32/Prepscram!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Virus.8 (rule Gen:Variant.Virus.8) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 37 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

47204 behavior events · 2 ATT&CK techniques · 17 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/13610/files/57b29e036189471e30ff6cf628920beba3114927ec13259850b109dcc5cd8706 - 57b29e036189471e30ff6cf628920beba3114927ec13259850b109dcc5cd8706
/opt/CAPEv2/storage/analyses/13610/files/60d3415becb4d5d7e0685ca89eed29ffe39c328152bf2a440d8e75d9df129457 - 60d3415becb4d5d7e0685ca89eed29ffe39c328152bf2a440d8e75d9df129457
/opt/CAPEv2/storage/analyses/13610/files/157d3431173c8485307f3d2a4375ae18173f9fb48fd31b5120beb594bbf5e4e6 - 157d3431173c8485307f3d2a4375ae18173f9fb48fd31b5120beb594bbf5e4e6
/opt/CAPEv2/storage/analyses/13610/files/c9bd7feb723d53a5e889accb9e626274af978f5d163778856f1ca814eef34110 - c9bd7feb723d53a5e889accb9e626274af978f5d163778856f1ca814eef34110
/opt/CAPEv2/storage/analyses/13610/files/9e77f486066e2eb02d38f26e553d4b18b6ea4ce6884e2679b8f742c807f6bb36 - 9e77f486066e2eb02d38f26e553d4b18b6ea4ce6884e2679b8f742c807f6bb36
/opt/CAPEv2/storage/analyses/13610/files/b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
/opt/CAPEv2/storage/analyses/13610/files/7c463800bc649ace581d6e212c3b0d5a0e06a0bbd178380dbe0bcdffc0ff4f69 - 7c463800bc649ace581d6e212c3b0d5a0e06a0bbd178380dbe0bcdffc0ff4f69
/opt/CAPEv2/storage/analyses/13610/files/3f233de176bf315dae1b8f056a3f8a5288cc58c1a486f678cc2837980851278b - 3f233de176bf315dae1b8f056a3f8a5288cc58c1a486f678cc2837980851278b
/opt/CAPEv2/storage/analyses/13610/files/914b4618f716583b51f44506cbe18fec95d3c35ccc1116880f6c4bab7e5f93a5 - 914b4618f716583b51f44506cbe18fec95d3c35ccc1116880f6c4bab7e5f93a5
/opt/CAPEv2/storage/analyses/13610/files/6f54e863ed38ca74f8076ccc78d7dc2c4d395f98f0c87f5fdec42d4f74f210c6 - 6f54e863ed38ca74f8076ccc78d7dc2c4d395f98f0c87f5fdec42d4f74f210c6
/opt/CAPEv2/storage/analyses/13610/files/18b1629d8f4adb27a77f01e855436f5235865f66e5a6a35c57aa955ed843570d - 18b1629d8f4adb27a77f01e855436f5235865f66e5a6a35c57aa955ed843570d
/opt/CAPEv2/storage/analyses/13610/files/75938273c7000d17bb7e502ead321bd47b14215aa1752ab2aeb3a53e410a08e9 - 75938273c7000d17bb7e502ead321bd47b14215aa1752ab2aeb3a53e410a08e9
/opt/CAPEv2/storage/analyses/13610/files/8b3098bdac7e6592579e8ee6563493379a745f3a9a0ac863ae549e12088ca89d - 8b3098bdac7e6592579e8ee6563493379a745f3a9a0ac863ae549e12088ca89d
/opt/CAPEv2/storage/analyses/13610/files/b370522c93844bac18e31f59a1c951cb0b222daae3309b84cad1c95b265c2326 - b370522c93844bac18e31f59a1c951cb0b222daae3309b84cad1c95b265c2326
/opt/CAPEv2/storage/analyses/13610/files/72200164d7d74044bcd9726df123d9c5a4ca964afa43f24add15db2adca4a1e7 - 72200164d7d74044bcd9726df123d9c5a4ca964afa43f24add15db2adca4a1e7

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786552229&P2=404&P3=2&P4=j1rHvh8M4Olgz%2bfGOMlrhNVNlwpBJ%2fLnApPbEuKOidaus3B8HHTFQcmfbTpi7fOKwkQ71ECtRlodZ6kThpDblw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786552300&P2=404&P3=2&P4=WjGNBDohYgEN76pK5EL9gH0QKW8L%2bUpCmE%2bgd3WGbo9k0aveHCe5i2l8%2fW55eWEcqwG7ztLceffNYevoAMbM9w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

q.es

Embedded IP addresses

172.215.188.232
40.79.167.10
172.217.25.195
20.247.185.124
4.247.188.224
4.230.171.124
74.178.76.128
52.168.117.174
74.178.76.54
4.150.223.100
57.155.101.212
135.233.45.223
4.150.223.108
40.79.141.153
203.26.79.13
74.178.76.44
172.178.240.163
72.154.7.99
92.223.78.30
52.148.114.188
135.233.95.80
52.110.12.55

File paths

u:\u]
L:\5E
h:\j^

More Prepscram samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report