SUSPICIOUS — 7395b66d3fe6deb295bda0090076ea04b6f1fa924c464481f6a4eb8825b8e1cb

SUSPICIOUS — 7395b66d3fe6deb295bda0090076ea04b6f1fa924c464481f6a4eb8825b8e1cb is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (59/100), attributed to the Persistence family. 1 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 7395b66d3fe6deb295bda0090076ea04b6f1fa924c464481f6a4eb8825b8e1cb
• SHA-1: 10ed3346ccf0998fccf9bb6e86bae7131aaa11ff
• MD5: 90e3cc705031ffb13aee9c04a5c505d3
• ssdeep: 48:YMIgZQx1DcVsKVIpQ19Kp1RBRTKItaQ8X3YKx4ZI6NYNDdj6Zaq:YMJZa16LkO9C1wcahX3YKxITNYtdj2aq
• TLSH: T1F516DF1872B82E5FF619902B2A65E6EBF112AD6D22BD1C4D20614647C8351BB086F1CE
• Submitted as: 7395b66d3fe6deb295bda0090076ea04b6f1fa924c464481f6a4eb8825b8e1cb
• File type: script · Size: 2702 bytes
• Verdict: suspicious (59/100) · Family: Persistence

Detections (1 of 50 engines)

• YARA: MalwareAnalyser community pack: TL_Windows_Persistence_RunKey

MITRE ATT&CK

• T1547.001

Why this verdict

The suspicious score of 59/100 is the fusion of 4 weighted signals:

• Obfuscated batch script: persistence (rule script-deobfuscation) - static signal, weight 0.35, confidence 0.75
• YARA: MalwareAnalyser community pack flagged TL_Windows_Persistence_RunKey (rule TL_Windows_Persistence_RunKey) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• Contacted 2 external host(s) at runtime - network signal, weight 0.12, confidence 0.55

Dynamic analysis (linux)

855 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• desktop-hsgcbep
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• ntp.ubuntu.com
• ff02::1:3
• 224.0.0.252
• 169.254.255.255
• 10.240.0.1
• ff02::fb
• 224.0.0.251
• 10.240.0.255
• ff02::16
• 185.125.190.58
• 185.125.190.57
• ff02::1
• ff02::1:2
• ff02::2
• 255.255.255.255

Dropped files

• tmp_tmp.aPN4fS446T - 1f17c00a365524ccbb68a446cab5a2b71d7575df01d0c1c1b04953a81f62949b

Registry keys

• HKCU\Software\Microsoft\Windows\CurrentVersion\UserProfileEngagement
• HKLM\SOFTWARE\Policies\Microsoft\Windows\CloudContent
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE
• HKLM\SOFTWARE\Policies\Microsoft\Windows\OOBE
• HKLM\SOFTWARE\Policies\Microsoft\Windows\OneDrive
• HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager

File paths

• C:\Users\Default\NTUSER.DAT

More Persistence samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report