MALICIOUS — 608b88c0dfe6c9a814e16afcb2ad14be7ce4d744a221efb02edae02408e89426

MALICIOUS — 608b88c0dfe6c9a814e16afcb2ad14be7ce4d744a221efb02edae02408e89426 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepscram family. 6 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 608b88c0dfe6c9a814e16afcb2ad14be7ce4d744a221efb02edae02408e89426
SHA-1: 8697ba889fd8f314f6ab79ebd18a769cfa3dcb97
MD5: 75b172750d84b25d94c2c34db176f80c
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 768:eyX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIoKt5xhIBmxbxGM6QuAQG/A:egKcR4mjD9r82Dfraib7Qd
TLSH: T1C631F13436E6D704E331FC14704CF5EDA11278891C69878B19A08A0FBEA4967C3FA7A5
Submitted as: 608b88c0dfe6c9a814e16afcb2ad14be7ce4d744a221efb02edae02408e89426
File type: pe · Size: 42341 bytes
Verdict: malicious (100/100) · Family: Prepscram

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Prepscram): CTS.exe - dynamic signal, weight 0.62, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Prepscram!pz (rule Trojan:Win32/Prepscram!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Rootkit.25 (rule Gen:Variant.Rootkit.25) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Agent.neyndy (rule Trojan.Win32.Agent.neyndy) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

2431 behavior events · 1 ATT&CK techniques · 21 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - 7457c6d192c9f369d0fd127e1a537ddfe46b54371f3ceaa935286a42615a09eb
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe - 5b4fd57ebfa2e2881fbfad422efec6c8f86d3e51353c9ab90fc0f85ad1888c49
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe - d63499c857d1ca2afca29b90b53bf4b8bc024737feb9062913e23671e70e850d
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe - 53fa8b7a959b04d38e49a1ba5539c976e1a6326029a2da83320644b3c50106e2
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - 82170e27c650d3b5cc9c16096ed35791432964fc1e35e3b64481c06d52d83bcd
C:\Windows\CTS.exe - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - 0a27ce5272d323e0b8ab515419b8440f1d2a7e96781876b2b329302b260ac304
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - 43e701da9401b94dfae2f370e47afc76c8235e90a2211d571cebd95a7651381a
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\FileCoAuth.exe - 3ec2ee1bdec04804e1921e86f8ac48cef34fa7a0fb35bcd0706b5062b3af7143
C:\Users\analyst\AppData\Local\Temp\EaqwLdr2KNizfid.exe - 1e54d725e1481634b89b9afbc3f9bca3fd81f3d742e3de68eeada2addce1ac78
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - 29559e57ac104a962953e1f9cf2df9468d992349369f11b22c3069f662febd32
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - 5bd6691e64db0cec174e5800dffb3a970c4cf025146cd91e251c300a4e764398
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - d137b4cbdb19cd907fff3836e4ddda36b994f3608f2d33f23dd01394f108836d
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - e2d58cefe20de283411ac90c3ecc03c4746af5ed52a9034df30716523575cf1a
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\FileSyncHelper.exe - e89bd3dd66e2a8da7f0234b154ef9aff2b738a45f9a370a33dc9f4a529f694cf

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

4.150.223.107
52.123.252.238
4.230.171.124
57.154.63.210
4.144.132.223
135.232.92.97
4.150.223.114
74.178.240.61
20.42.73.25
20.165.94.63
52.110.12.2
52.110.12.44
72.145.35.103
52.148.114.188
52.110.12.21
52.110.12.42

More Prepscram samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report