MALICIOUS — 74e5737a0bae8752a0c86726f8a8b030fb227c086f99a7c96a75990ef7794940

MALICIOUS — 74e5737a0bae8752a0c86726f8a8b030fb227c086f99a7c96a75990ef7794940 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100). 6 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 74e5737a0bae8752a0c86726f8a8b030fb227c086f99a7c96a75990ef7794940
SHA-1: bef18290cb49efb7aaae3c96f45222b75c4b8201
MD5: 4eff8e9e6eb10018e2f6c6aca57e72e9
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 3072:hfrehmNcrY3uxYKyGYfs2TPRjzpf3Ggv8PFBPGCCFHFINZd:hfrehFr/xYKyGYfs6pj1fd6FBPx+lINf
TLSH: T13941F87B9B073214EA7A2A0768D60D9C7CDA7D010F6B3873669D8C507B110AB6381F5B
Submitted as: 74e5737a0bae8752a0c86726f8a8b030fb227c086f99a7c96a75990ef7794940
File type: pe · Size: 189440 bytes
Verdict: malicious (100/100)

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): BC.Win.Virus.Ransom-9157.A
Microsoft Defender: Virus:Win32/Nabucur.A
Emsisoft (Emergency Kit): Win32.Virlock.Gen.4
Trellix Stinger (McAfee): W32/VirRansom
Kaspersky (KVRT): Virus.Win32.PolyRansom.a

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged BC.Win.Virus.Ransom-9157.A (rule BC.Win.Virus.Ransom-9157.A) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Virus:Win32/Nabucur.A (rule Virus:Win32/Nabucur.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Virlock.Gen.4 (rule Win32.Virlock.Gen.4) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/VirRansom (rule W32/VirRansom) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.PolyRansom.a (rule Virus.Win32.PolyRansom.a) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 4 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.text (rule high-entropy-sections:.text) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Dropped 17 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

16562 behavior events · 3 ATT&CK techniques · 39 dropped files.

Dropped files

C:\ProgramData\xiocAsMc\yKgEskQE.inf - 601b5f13366ea53c49a80e3ea147722b311a1681ad0e42695ba8f11da0d99b55
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Users\analyst\AppData\Local\Temp\tsk_d917400db68b426e - 6918f0f8f0461f866a849fc691fa5de86db117554fc09c6497f9df363eb483d6
C:\Users\analyst\AppData\Local\Temp\xoYccQww.bat - f93d53fe37b96c12b63f3f6c249d21441593e99acd2eeaa2879763a3d6273074
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.exe - 52558f065f82db97cff9f64ef17a86ac7e96d3430e56da427353a092c98fc929
C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.exe - 1a62618e14fce0197ae1da1dfae71bd29dd7eaf10402d937f2c54c3f47d07448
C:\Users\analyst\AppData\Local\Temp\lwIwwMgI.bat - 9628923d42814da71755d8278c0eb693431fc92cc821721fc915deff8cf37f78
C:\Users\analyst\rSwIoccE\vcIYEIkQ.exe - 22ebcff40179745a0b85455541e8f8863dcb113a2fa6d90734692c2480de9ab3
C:\Users\analyst\AppData\Local\Temp\JkowAUoo.bat - 5ca4c5a8c1d217bbf0d4afa747cab57eedd0b4f8fa0f137d8273302c51cf5b30
C:\Users\analyst\AppData\Local\Temp\UMAMIQUw.bat - d5509edc8d092188a0b57c05a650801f7b65a87555182b496283297e16cd0206
C:\Users\analyst\rSwIoccE\vcIYEIkQ - 374b72d4842f1a0ba77a158f0a8e50725c99c8f3a306c185490abc1e04752fcb
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.exe - a19ac703cddcf01a12117e04cc4a0c35c0cba2fa63f2dc19399fff7bd715a221
C:\Users\analyst\AppData\Local\Temp\qwUS.ico - bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620
C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png - d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.exe - 6743fbf0fc3c5b0a9dfdb443dcd4519b0d7ce5ae4cf9fc887a305a4b594cf3d6

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://google.com/
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
oneclient.sfx.ms

Embedded IP addresses

104.46.162.229
52.253.84.76
52.123.252.244
4.230.171.124
200.87.164.69
200.119.204.12
190.186.45.170
135.234.160.245
57.155.104.224
4.150.223.103
52.148.114.188
57.154.63.210
52.123.129.14
92.223.78.30
52.110.12.22
72.145.35.103
52.110.12.11
172.172.255.217

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report