SUSPICIOUS — 46734e9a47a2226dbe1c55e0d7c4ebf1892b1d79a5f7a933dea57ec2acfe3f5a

SUSPICIOUS — 46734e9a47a2226dbe1c55e0d7c4ebf1892b1d79a5f7a933dea57ec2acfe3f5a is a unknown sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (40/100), attributed to the Persistence family. 1 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 46734e9a47a2226dbe1c55e0d7c4ebf1892b1d79a5f7a933dea57ec2acfe3f5a
• SHA-1: e81b38197cd8b3b09784bb37f74a013e82ff4137
• MD5: 4414fb0a02a94f1b71e1cefb3c8bb34c
• ssdeep: 3:ctm2KD9so3KRfyM1K7eDoKECk02QkyidJfNJRpE2J5xAIWO78qZMGlmKDyn:cCtuH1j0KECk025yidJ1JRq23f/8qVlQ
• TLSH: T1980C801956ECFE1DF30D10960507CB79D643158425DDF418553445D1ED3353551CD025
• Submitted as: 46734e9a47a2226dbe1c55e0d7c4ebf1892b1d79a5f7a933dea57ec2acfe3f5a
• File type: unknown · Size: 165 bytes
• Verdict: suspicious (40/100) · Family: Persistence

Detections (1 of 51 engines)

• YARA: MalwareAnalyser community pack: TL_Windows_Persistence_RunKey

MITRE ATT&CK

• T1547.001

Why this verdict

The suspicious score of 40/100 is the fusion of 2 weighted signals:

• YARA: MalwareAnalyser community pack flagged TL_Windows_Persistence_RunKey (rule TL_Windows_Persistence_RunKey) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60

Registry keys

• HKCU\Software\Microsoft\Windows\CurrentVersion\Run

File paths

• C:\Users\analyst\AppData\Local\Temp\VBUEQQRMKRNCAYO\service.exe

More Persistence samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report