MALICIOUS — 5c1a906f2d0713700cd03db70f179324b8582279d54b3ceef8958022e4e4a515

MALICIOUS — 5c1a906f2d0713700cd03db70f179324b8582279d54b3ceef8958022e4e4a515 is a html sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100), attributed to the Wacatac family. 1 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 5c1a906f2d0713700cd03db70f179324b8582279d54b3ceef8958022e4e4a515
SHA-1: 3fcc3bcbf6cff4cd7607d77f2be8bdb6ec5de02d
MD5: 0f4d3ce2c9f72f457d95654f4323aa00
ssdeep: 768:tIRIOITIwIgInKZgNDgIwIGI5IvJ7SJIRIOITIwIgIOKZgNDfIwIGI5IVJ7SZWhS:tIRIOITIwIgInKZgNDgIwIGI5IvJ7SJ4
TLSH: T19932E882F28A8CD797DDDB905C907D304CD66D2F5530AC899C5CEBA07AAEB6130588C7
Submitted as: 5c1a906f2d0713700cd03db70f179324b8582279d54b3ceef8958022e4e4a515
File type: html · Size: 44604 bytes
Verdict: malicious (93/100) · Family: Wacatac

Detections (1 of 51 engines)

Microsoft Defender: Trojan:Script/Wacatac.B!ml

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 93/100 is the fusion of 7 weighted signals:

Memory forensics: 3 finding(s), e.g. RWX/private injected region in MRT.exe (pid 8624) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Script/Wacatac.B!ml (rule Trojan:Script/Wacatac.B!ml) - engine signal, weight 0.55, confidence 0.85
Obfuscated javascript script: dynamic-exec, defense-evasion (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
Contacted 37 external host(s) at runtime (6 HTTP) - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://ogp.me/ns/fb#, http://www.asilmutlu.com/wp-content/uploads/2016/08/word-image-15.png, https://prajwaldesai.com/wp-content/uploads/2017/05/SCCM-Secondary-Site-Installation-Snap12.jpg - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (6 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

277 behavior events · 1 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://ogp.me/ns/fb#
http://www.asilmutlu.com/wp-content/uploads/2016/08/word-image-15.png
https://prajwaldesai.com/wp-content/uploads/2017/05/SCCM-Secondary-Site-Installation-Snap12.jpg
http://reviziontaiwan.weebly.com/1/post/2017/06/sccm-configuration-manager-trace-log-tool.html
https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
https://www.google.com/recaptcha/api.js
http://twitter.com/share?url=http://reviziontaiwan.weebly.com/1/post/2017/06/sccm-configuration-manager-trace-log-tool.html
http://reviziontaiwan.weebly.com/blog/sccm-configuration-manager-trace-log-tool&is_mobile=&r=3&is_light=1
https://www.weebly.com/signup?utm_source=internal&utm_medium=footer
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice/files/15f5d388-aefb-49dc-ba9c-bc58b098ac43?P1=1785380283&P2=404&P3=2&P4=D46CEEFtrsyl5RDbtzVgpPLHeJzhZq4jKfnJYrUEhx6Cq5fQH4ciWZ8vGpp9EUSexC8y6YRs8NXQK3b8KzWN0g%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ogp.me
www.asilmutlu.com
prajwaldesai.com
reviziontaiwan.weebly.com
cdn2.editmysite.com
fonts.googleapis.com
cdn1.editmysite.com
ajax.googleapis.com
www.weebly.com
www.google.com
twitter.com
google-analytics.com
test.name
ec.editmysite.com
connect.facebook.net
tter.com
inference.location.live.net
oneclient.sfx.ms

Embedded IP addresses

23.40.52.85
4.150.223.114
52.123.252.212
20.190.167.18
184.84.165.171
150.171.22.17
52.230.60.54
4.230.171.124
135.232.92.97
4.247.188.224
74.178.76.128
20.42.65.90
135.233.45.222
20.184.175.11
135.233.95.80
23.40.52.174
23.33.238.102
151.101.30.172
13.89.179.12
72.154.7.248
23.198.40.44
184.84.165.136
23.46.179.27
203.26.79.13
4.207.44.75

More Wacatac samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report