MALICIOUS — 77a1214aa4b7e5377653d5691c484184ec992593b951fc33fd76c550e53d7e13
MALICIOUS — 77a1214aa4b7e5377653d5691c484184ec992593b951fc33fd76c550e53d7e13 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Container family. 7 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
77a1214aa4b7e5377653d5691c484184ec992593b951fc33fd76c550e53d7e13 - SHA-1:
aa6731b7c647a700786df4191bb40455ad447b24 - MD5:
6a44618aea65d0da418af3f07ffeef7a - imphash:
38aa7c2ff6ef0e48a9520d6702d08df4 - ssdeep:
12288:uC8SFhNGpW8FhNGpWvrix1c60yTix1c60yqPOV4uOeinggFQF4:1FhNGpW8FhNGpWv0POzAgg2F4 - TLSH:
T1DC4A9E2B001F922DD5F9AF717448CEADA452F40490786F6E41CFE62C80A85E7EEF9452 - Submitted as: 77a1214aa4b7e5377653d5691c484184ec992593b951fc33fd76c550e53d7e13
- File type: pe · Size: 436056 bytes
- Verdict: malicious (100/100) · Family: Container
Detections (7 of 56 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Trojan.Agent-6943819-1
- YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: Virus:Win32/Sivis.A
- Emsisoft (Emergency Kit): Win32.Sivis.A
- Kaspersky (KVRT): Virus.Win32.Agent.es
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 13 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Agent-6943819-1 (rule
Win.Trojan.Agent-6943819-1) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Virus:Win32/Sivis.A (rule
Virus:Win32/Sivis.A) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Win32.Sivis.A (rule
Win32.Sivis.A) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Virus.Win32.Agent.es (rule
Virus.Win32.Agent.es) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule
DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.55, confidence 0.70 - Contacted 2 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
- MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule
UPX) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://creativecommons.org/publicdomain/zero/1.0/, https://www.gnu.org/software/automake/manual/automake.html, http://fsmsh.com/2753 - static signal, weight 0.35, confidence 0.60
- Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
- Dropped 10 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Extracted generic config (4 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
17705 behavior events · 0 ATT&CK techniques · 96 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- windows.msn.com
- officeclient.microsoft.com
- www.msn.com
- odc.officeapps.live.com
- www.bing.com
- assets.msn.com
- th.bing.com
- fe3cr.delivery.mp.microsoft.com
- settings-win.data.microsoft.com
- v10.events.data.microsoft.com
Dropped files
- C:\Program Files\7-Zip\Lang\ga.txt -
e64f8f6999a3912ce17976d90bb405cd5fe1984d63b8ed8f38ebc7e8fecdff86 - C:\Program Files\7-Zip\Lang\bn.txt -
b37619e63a145ad530fc7f2a78ea9746412cd7cf15d9420518197fc12483883f - C:\Program Files\7-Zip\descript.ion -
7d3c67767c01666ca08afcba1b31b2c5745dcd8ef0b25e733e7b2bed652295a6 - C:\$WinREAgent\Backup\ReAgent.xml -
8fd27c70f396edb6f4cde05b4bfd21084ce0d3b6d7770fe545e725d921e507fc - C:\Program Files\7-Zip\Lang\nb.txt -
696ef339d6fa73bea8e9bba6fb7c953d5226c251c6d790ed1bbd3429d6293672 - C:\Program Files\7-Zip\Lang\is.txt -
088a490474e37e7a340b1736a7c011907a4ee30b097f1aa874a64e90f47a8e74 - C:\Program Files\7-Zip\Lang\be.txt -
bb8a56f1fb296bd902a8900646635993e9824c03b3ea423f4b525177178677e2 - C:\Program Files\7-Zip\Lang\mng2.txt -
9ef0e51a9de43a839da4425323d32095f09203e3060144660c51ca1aef8a7638 - C:\Program Files\7-Zip\Lang\en.ttt -
52979c3761ea27571cf92c46f910b0c5f1cad4c98e5ea62f7c758c995a5f6d7a - C:\$Recycle.Bin\S-1-5-21-976637724-599762485-334819845-1001\desktop.ini -
bd52d0a76977b33d1f7189158e0ceea3e30619bd9c6ce4f24580857df556f86b - C:\Program Files\7-Zip\Lang\af.txt -
3cc5ef6494a600fc6cc536a1e87c447793363ac94dcf4376fa6b2ab4d8097556 - C:\Program Files\7-Zip\Lang\mng.txt -
871edc19d8241a32554580f68c1944ebebc60370d1519e266b21ada371891b0a - C:\Program Files\7-Zip\Lang\nn.txt -
9c94db35fc5df64b8b30f2abd47fd30b596d3be0eb466c7245fa027f04af5d78 - C:\Program Files\7-Zip\Lang\br.txt -
66e6d3a0806c17f7b14919871a5548fc98298e6f529118a6dceeb670201be935 - C:\Program Files\7-Zip\Lang\hi.txt -
600d8587b02ade41345a5e1e962d804d46a237869641e62c41fbf8114da2b10d
Embedded URLs
- http://creativecommons.org/publicdomain/zero/1.0/
- https://www.gnu.org/software/automake/manual/automake.html
- http://fsmsh.com/2753
- https://autotools.io/index.html
- http://miller.emu.id.au/pmiller/books/rmch/
- http://ardownload.adobe.com/pub/adobe/reader/win/8.x/8.0/misc/WindowsInstaller-KB893803-v2-x86.exe
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- creativecommons.org
- geocities.com
- www.gnu.org
- fsmsh.com
- autotools.io
- miller.emu.id.au
- ardownload.adobe.com
Embedded IP addresses
- 20.42.65.88
- 4.155.90.37
- 52.123.252.215
- 4.230.171.124
- 20.165.94.54
- 57.155.104.224
- 74.179.77.204
- 52.168.112.66
- 104.18.33.89
- 52.110.12.22
- 52.110.12.11
- 135.233.45.223
- 20.184.175.16
- 52.110.12.10
- 52.110.12.4
File paths
- C:\Windows.old\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim]
- C:\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim][gle=0x00000020]
- C:\Windows.old\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.1120_none_c3e
- C:\Windows.old\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.1_none_eedfed
- X:\SysResetTrace-Tel-Merge.etl,
- C:\$WINDOWS.~BT\Sources\Panther\SysResetTrace-Tel-Merge.etl)
- C:\Windows.old
- C:\.
- C:\Windows.old\Windows\System32\Config\Software.
- C:\\Windows\System32\Config\Software.
More Container samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report