MALICIOUS — 5248f03ecd3c1b1ca7b1cb903bdde2c5300ffbbc0dbadb6e034d952f5c691061

MALICIOUS — 5248f03ecd3c1b1ca7b1cb903bdde2c5300ffbbc0dbadb6e034d952f5c691061 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepscram family. 12 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 5248f03ecd3c1b1ca7b1cb903bdde2c5300ffbbc0dbadb6e034d952f5c691061
SHA-1: 9c4ec8c29e1555680d95388a75eb43acc2bcfa4e
MD5: 9aee522e764e9d5d797b784efb7f9f56
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 49152:AE1TQABZU8YYGQaW2UdMkny2c2GE1TQABZU8YYGQaW2UdMkny2c2q3CNpn+0Ojjl:nlgjUVnyelgjUVnygpXOwzeP3
TLSH: T1A16A07CE811E1719C63ACA312D40A69DD0B171D02479BD1D0E0B867664E723FFD7A3AA
Submitted as: 5248f03ecd3c1b1ca7b1cb903bdde2c5300ffbbc0dbadb6e034d952f5c691061
File type: pe · Size: 9786760 bytes
Verdict: malicious (100/100) · Family: Prepscram

Detections (12 of 56 engines)

capa (capabilities): capability:collection/keylog
MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Dropper.QQpass-9937642-0
YARA: bartblaze: BB_Clipbanker
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
YARA: Yara-Rules community: YR_AntiVM_Sandbox
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Virus.8
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 25 weighted signals:

ClamAV (daily) flagged Win.Dropper.QQpass-9937642-0 (rule Win.Dropper.QQpass-9937642-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
YARA: bartblaze flagged BB_Clipbanker (rule BB_Clipbanker) - engine signal, weight 0.70, confidence 0.70
Microsoft Defender flagged Trojan:Win32/Prepscram!pz (rule Trojan:Win32/Prepscram!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Virus.8 (rule Gen:Variant.Virus.8) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Agent.neyndy (rule Trojan.Win32.Agent.neyndy) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.55, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.50, confidence 0.70
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 2 external host(s) and 15 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiVM_Sandbox (rule YR_AntiVM_Sandbox) - engine signal, weight 0.40, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
query domain / anti-analysis (rule query domain / anti-analysis) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: https://www.mendeley.com/library, https://service.elsevier.com/app/answers/detail/a_id/22094/kw/migrate/supporthub/mendeley/, http://support.mendeley.com/customer/portal/articles/227955 - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Microsoft Linker - static signal, weight 0.25, confidence 0.55
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 19 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Extracted generic config (14 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

2859 behavior events · 1 ATT&CK techniques · 21 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - 078878794cf3d987599d882cfe6b8f67dd3327171ca1ad93b76fc93e72715ca3
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - 90479fe4db88b4e4bae48d791ac1a97f8b1358d6f056115d1dae1e91d4888ac5
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - bcb9c30d48b5c37893711b29f880e26adf6d2a2e701c3d5143b2bbeea2ec55a8
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\Microsoft.SharePoint.NativeMessagingClient.exe - f08be86b26e29bbf320a3802dad18c5e44811aec5775f6009d708840bbfc0bf1
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - 2b03efc85ee268ee190dcab1e448531debf42580f2919faf5ccace168ab229d7
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\FileSyncConfig.exe - 4425884a1fbbec25329aabed8ab8734f5c9e3cdb80d812fbbf12c4659cda1561
C:\Program Files (x86)\GUT6A3.tmp - 7309416c12893f87fee04b1b49c4aa333ab24b0a3f9360c205737de3b628418a
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - 7ae99904bed699542d5547a913571727ee07387818eca259b3b28e83a192e0f3
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - 390fd76d058c7bde34d3588c253a27275bddb8ea70cb5181a9a21c9456737560
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe - ad3611a327f1608e1c4b3ed6f284c3bbc7770c6aaac6216a1c1243ba749652b4
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - 28d8ecc43def85d937a5f1f4b2103b7730274775e296e844869489d4efd51ed9
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe - 5d41bce90e76112270b57c045c796f08595d244d7512d7142c416b9f8fb470bd
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe - 1b0835a0fe1e96c907cdf51bb1197e8a083c90e15fea8863c3ae56f59d3939de
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\FileSyncHelper.exe - fedce18a1a054d3bb60780bc6b08c841b543a4f9f2d55ff0d0085deb01d1e26b
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe - b65bf213f9541916f5623bf429b52608c503decb2baf097f09484a200d7b6b8c

Embedded URLs

http://www.microsoft.com/exporting
https://www.mendeley.com/library
https://service.elsevier.com/app/answers/detail/a_id/22094/kw/migrate/supporthub/mendeley/
http://support.mendeley.com/customer/portal/articles/227955
http://p.yusukekamiyamane.com/
https://citationstyles.org
https://github.com/Juris-M/citeproc-js
https://plasma.kde.org
https://www.zotero.org/
https://rrchnm.org/
https://www.gmu.edu/
https://www.elsevier.com/legal/elsevier-website-terms-and-conditions
https://www.elsevier.com/legal/privacy-policy
http://citationstyles.org/
https://github.com/citation-style-language/styles
https://csl.mendeley.com
http://creativecommons.org/licenses/by-sa/3.0/
https://www.mendeley.com/guides?dgcid=Mendeley_Desktop_Help-menu-Help-guides
https://www.mendeley.com?dgcid=Mendeley_Desktop_Help-menu-website
https://service.elsevier.com/app/home/supporthub/mendeley/?dgcid=Mendeley_Desktop_Help-menu-FAQ
https://service.elsevier.com/app/contact/supporthub/mendeley?dgcid=Mendeley_Desktop_Help-menu-Contact-Support
https://mendeley.com/reference-management/web-importer/#id_1?dgcid=Mendeley_Desktop_Onboarding-Add-Importer
https://www.mendeley.com/guides/using-citation-editor?dgcid=Mendeley_Desktop_Onboarding-Help-Cite
https://www.mendeley.com/guides/desktop/04-read-highlight-annotate?dgcid=Mendeley_Desktop_Onboarding-Help-Cite
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

www.microsoft.com
www.mendeley.com
service.elsevier.com
support.mendeley.com
p.yusukekamiyamane.com
citationstyles.org
github.com
plasma.kde.org
www.zotero.org
rrchnm.org
www.gmu.edu
www.elsevier.com
csl.mendeley.com
creativecommons.org
mendeley.com
domain.com
www.w3.org
ns.adobe.com
field.cc
nw-umwatson.events.data.microsoft.com
crashpad.chromium.org
augloop-int.officeppe.com
registry.cc
blink.net
arena.cc

Embedded IP addresses

10.3.4.1
5.2.3.5
1.101.3.4
23.02.45.06
25.46.62.85
27.24.53.59
20.42.65.85
52.123.252.223
4.144.132.114
4.230.171.124
172.64.154.167
52.110.12.14
52.110.12.33
162.159.142.9
4.247.188.233
20.42.73.28
72.154.7.107
52.148.114.188
52.110.12.45
52.110.12.16

Registry keys

HKLM\System\CurrentControlSet\Control\Session
HKEY_CURRENT_USER\Software\Classes
HKEY_LOCAL_MACHINE\Software\Classes
hklm\software
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
HKEY_LOCAL_MACHINE\Software\Adobe\Acrobat
HKEY_LOCAL_MACHINE\Software\Adobe\Adobe
HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe
HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Acrobat
HKEY_USERS\[USER_SID]\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.adobe.acrobat.chrome_webcapture
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active
HKEY_LOCAL_MACHINE\Software\Adobe\
HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Installer\
HKEY_CLASSES_ROOT\acrobat2018\DefaultIcon
HKEY_CLASSES_ROOT\acrobat2018\shell\open\command
HKEY_CLASSES_ROOT\acrobat2018\shell\open\ddeexec\application
HKEY_CLASSES_ROOT\acrobat2018
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Edge\NativeMessagingHosts\com.adobe.acrobat.chrome_webcapture
HKEY_CLASSES_ROOT\Installer\Products\68AB67CA3301FFFF7706B0F070721300\SourceList\Net
HKEY_LOCAL_MACHINE\Software\WOW6432Node\Adobe\Acrobat
HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Installer
HKEY_USERS\[USER_SID]\SOFTWARE\Adobe\Adobe

File paths

C:\jenkins\workspace\Desktop_Release_Build\src\ui\MainWindow.cpp
C:\jenkins\workspace\Desktop_Release_Build\src\ui\ImportExportDialogProvider.cpp
C:\jenkins\workspace\Desktop_Release_Build\src\ui\AnnotationsExportSettingsDialog.cpp
C:\jenkins\workspace\Desktop_Release_Build\src\ui\FileListEdit.cpp
C:\jenkins\workspace\Desktop_Release_Build\src\ui\DocumentEditor.cpp
C:\jenkins\workspace\Desktop_Release_Build\src\ui\JSDataStore.cpp
C:\jenkins\workspace\Desktop_Release_Build\src\ui\JSNetworkResponse.cpp
C:\jenkins\workspace\Desktop_Release_Build\src\ui\RecommenderViewPresenter.cpp
C:\jenkins\workspace\Desktop_Release_Build\src\ui\SearchFilterPresenter.cpp
C:\jenkins\workspace\Desktop_Release_Build\src\ui\PeopleTextEdit.cpp
C:\jenkins\workspace\Desktop_Release_Build\src\ui\WebEnginePage.cpp
c:\buildslave\steam_rel_client_win32\build\src\public\tier1\utlstring.h
c:\buildslave\steam_rel_client_win32\build\src\common\crypto_textencode.cpp
c:\buildslave\steam_rel_client_win32\build\src\public\tier1\utlvector.h
c:\buildslave\steam_rel_client_win32\build\src\common\keypair.cpp
c:\buildslave\steam_rel_client_win32\build\src\common\crypto_25519_donna.cpp
D:\SAMSUNG\DeXonPC_Extern\cryptopp_8_2_0\sha_simd.cpp
D:\SAMSUNG\DeXonPC_Extern\cryptopp_8_2_0\rijndael_simd.cpp
D:\a\1\s\Win32\Release\du.pdb
C:\agent\_work\93\s\Win32\Release
c:\src\Tcpview\Release\Tcpview.pdb
D:\B\T\Acrobat\Viewer\win\EXEs\ViewerExe\ChromeSandboxLaunch.cpp
D:\B\T\Imports\Open\Chrome\Chrome\src\base\win\win_util.cc
D:\B\T\Imports\Open\Chrome\Chrome\src\base\file_version_info_win.cc
D:\B\T\Imports\Open\Chrome\Chrome\src\base\files\file_util_win.cc

More Prepscram samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report