MALICIOUS — 73c4aaca4afbe0ede53ba194729e6c968ede278b1f5412c821ada898257b8e05
MALICIOUS — 73c4aaca4afbe0ede53ba194729e6c968ede278b1f5412c821ada898257b8e05 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepscram family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
73c4aaca4afbe0ede53ba194729e6c968ede278b1f5412c821ada898257b8e05 - SHA-1:
e101380e880a90025f630f889515ec065c5fc622 - MD5:
b2ebfe64fa980cd0cad41a5d6a108293 - imphash:
f1a539a5b71ad53ac586f053145f08ec - ssdeep:
24576:SBTkWAQRwodHcsLwk7u7sHcPB9ICvdYrsnr0Yuf:SBoWAQUub7iJICCrE0 - TLSH:
T1F8502309D582AFDBD7A25C4314B1288F0258894B373F7B2AF99104DB7969C0394FA3E4 - Submitted as: 73c4aaca4afbe0ede53ba194729e6c968ede278b1f5412c821ada898257b8e05
- File type: pe · Size: 795520 bytes
- Verdict: malicious (100/100) · Family: Prepscram
Detections (6 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Malware.Zusy-9957983-0
- Detect It Easy (packer/type): DIE:UPX
- Microsoft Defender: Trojan:Win32/Prepscram!pz
- Emsisoft (Emergency Kit): Gen:Variant.Virus.8
- Kaspersky (KVRT): Trojan.Win32.Agent.neyndy
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 9 weighted signals:
- ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule
Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95 - Dropped a malicious payload (Prepscram): b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - dynamic signal, weight 0.80, confidence 0.90
- Microsoft Defender flagged Trojan:Win32/Prepscram!pz (rule
Trojan:Win32/Prepscram!pz) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Variant.Virus.8 (rule
Gen:Variant.Virus.8) - engine signal, weight 0.55, confidence 0.85 - Memory forensics: 4 finding(s), e.g. process hidden from a listing (rule
windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85 - Contacted 39 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
- Detect It Easy (packer/type) flagged DIE:UPX (rule
DIE:UPX) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
2357 behavior events · 1 ATT&CK techniques · 17 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- assets.msn.com
- licensing.mp.microsoft.com
- www.bing.com
- tas02.sls.update.microsoft.com
- fe3cr.delivery.mp.microsoft.com
- v10.events.data.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/13635/files/0ab6299d6490aaa488729ca05236e7e8b356820d3967276dd31be5d952a84ec0 -
0ab6299d6490aaa488729ca05236e7e8b356820d3967276dd31be5d952a84ec0 - /opt/CAPEv2/storage/analyses/13635/files/10b82a86d36b640736ae09af93e1846bfc264c1dd743547454b779cce81f949e -
10b82a86d36b640736ae09af93e1846bfc264c1dd743547454b779cce81f949e - /opt/CAPEv2/storage/analyses/13635/files/e97084f19529d9931d55a7c951426e871e8019dddf72d2fd87a1e0efcbd34a76 -
e97084f19529d9931d55a7c951426e871e8019dddf72d2fd87a1e0efcbd34a76 - /opt/CAPEv2/storage/analyses/13635/files/f40a4d5740fe11145f28dcb4312851cce4b04f65027bea2fb6c246594b3453b8 -
f40a4d5740fe11145f28dcb4312851cce4b04f65027bea2fb6c246594b3453b8 - /opt/CAPEv2/storage/analyses/13635/files/b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 -
b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - /opt/CAPEv2/storage/analyses/13635/files/b80d5235aa1e0282ac6fa6c39f9f67dc572c851168f67b21457f228ad78e0c36 -
b80d5235aa1e0282ac6fa6c39f9f67dc572c851168f67b21457f228ad78e0c36 - /opt/CAPEv2/storage/analyses/13635/files/8539b494abffbdcd24e2c2b7426259e368493b86c9f24712a5cbb50eef3ff265 -
8539b494abffbdcd24e2c2b7426259e368493b86c9f24712a5cbb50eef3ff265 - /opt/CAPEv2/storage/analyses/13635/files/dd2b59eec2fa357c3fc494e71ff042612bb93032e6c2c6d0309b9c1a6be9b29c -
dd2b59eec2fa357c3fc494e71ff042612bb93032e6c2c6d0309b9c1a6be9b29c - /opt/CAPEv2/storage/analyses/13635/files/826413c321374b6ab234961ac4b19860ae23da09d05258cbd85a89ab374e0651 -
826413c321374b6ab234961ac4b19860ae23da09d05258cbd85a89ab374e0651 - /opt/CAPEv2/storage/analyses/13635/files/e33dd595f61f5bb36846bdcb9af7f42f39184f217c1b88c932da6d32a41bba8f -
e33dd595f61f5bb36846bdcb9af7f42f39184f217c1b88c932da6d32a41bba8f - /opt/CAPEv2/storage/analyses/13635/files/f22356d9c6a4c16ef82f391329e9f194623942a317bc54d7e7349d495ecdc7c2 -
f22356d9c6a4c16ef82f391329e9f194623942a317bc54d7e7349d495ecdc7c2 - /opt/CAPEv2/storage/analyses/13635/files/646ccf0a400fc06156ae91a3cb2662247d7fe0886754291596a554e851646839 -
646ccf0a400fc06156ae91a3cb2662247d7fe0886754291596a554e851646839 - /opt/CAPEv2/storage/analyses/13635/files/87a88e5a4ca5b0fa24110530124cc632165f3b41d556d09a32fb388ba43fc489 -
87a88e5a4ca5b0fa24110530124cc632165f3b41d556d09a32fb388ba43fc489 - /opt/CAPEv2/storage/analyses/13635/files/b3f0149c5fa69a0ca9edf4651e07d49b96b57bd500d5e857b50a522b5cfbd316 -
b3f0149c5fa69a0ca9edf4651e07d49b96b57bd500d5e857b50a522b5cfbd316 - /opt/CAPEv2/storage/analyses/13635/files/685d1cd54e736e6d7b56ac31b5c21376b34bf60a185d00b72e2189eac9e981db -
685d1cd54e736e6d7b56ac31b5c21376b34bf60a185d00b72e2189eac9e981db
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786552894&P2=404&P3=2&P4=ZTgPXZBMyRQuK8On5CkDK0uSoDEzJnIlhdmQG1Ep0HP4NfwO%2fwfZjsKMqNeF9ZWL2NNZamDOtUS%2btneIj4QeBA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786552942&P2=404&P3=2&P4=A%2fG8dmAtSUUZVPo7yuJ0pcTCyamxeMZzx7rJgaLM2LnxmUdD%2fZayWFys4vq08OiH0eE64S4heeoJLNmGI2OwlQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded IP addresses
- 142.250.183.46
- 20.50.73.5
- 52.123.252.234
- 57.154.63.210
- 4.230.171.124
- 20.42.179.204
- 52.253.84.76
- 74.179.77.204
- 135.233.95.135
- 20.184.175.10
- 74.178.76.128
- 92.223.78.30
- 20.42.65.84
- 135.233.45.222
- 52.110.12.18
- 52.110.12.28
- 203.26.79.13
- 52.123.252.226
- 74.178.232.29
- 52.123.252.233
- 40.84.85.40
- 52.148.114.188
- 72.154.7.112
- 52.110.12.3
- 52.110.12.10
File paths
- f:\l
More Prepscram samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report