MALICIOUS — 79bc86d996da2ad6397dd6596563eafbb15ac960e674ead6cdc374ca76a47ea9

MALICIOUS — 79bc86d996da2ad6397dd6596563eafbb15ac960e674ead6cdc374ca76a47ea9 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepscram family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 79bc86d996da2ad6397dd6596563eafbb15ac960e674ead6cdc374ca76a47ea9
SHA-1: 5da10c2e25e2e2a4cdd31c2ccddd701549cc681b
MD5: 50367c1bfc8948e2bc76acb4de6b0412
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 3072:5KcWmjRrzpIoIZITofmOTUCQNCyvICvxPff6:SMNImwU3fvICvxPX6
TLSH: T1D33C12B577326311E3B4E83A68E064EDC5176D8F49C40167BEA1841E2940D3BC9FAA3D
Submitted as: 79bc86d996da2ad6397dd6596563eafbb15ac960e674ead6cdc374ca76a47ea9
File type: pe · Size: 117432 bytes
Verdict: malicious (100/100) · Family: Prepscram

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Prepscram): CTS.exe - dynamic signal, weight 0.62, confidence 0.90
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

2348 behavior events · 1 ATT&CK techniques · 17 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - ef3b34a1e27cb9a47c8968912b0c6731528f8fd86d88047ee026e5e8f0007ce0
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - b0bfa5594a112758f22263c5e6502e579d62260029e749bf612771cf7a567484
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - b09699b99aa8dbb9b6f72f0a0b4dfdeee2fc4708469199a495c669aeb26a5898
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - d700e9513969d9004fc7d706f0530bdbf0dd9225249b36838b541fef867a4f76
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe - f98aaa7d7081fe543b06d511c8780fbb6153e8cf4899c81a6fc4b5fd65a24264
C:\Windows\CTS.exe - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe - 40d1c4b795604fb7475998173fce2c33d9a03217a71a0373c1df128b6ca86a6a
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - e9f12cd09dac45ccabf57e8ff6eff9535ec60b88224995a1cfcb6537072e5fa6
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe - 1edf3a31013098cc7da90bb5346f50ff8e7bc14740ac858d38477b6cdb9edf62
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - 43e6fde2fa9e9c819997fbc164fd8632114c8a1a14c8d5fe6015511ed71fc6e7
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - 18a4b9fcd4458c6732b549edfd9ececd82c1d012c412b3e51399dd740d239052
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe - 099b7a04e3d0c073657dd4fce27738f50b6373b8fb2d7f5ac4e898908e13c2b9
C:\Users\analyst\AppData\Local\Temp\gcJFghQbA9vFspc.exe - 6469f3d612baa47d3a64239946db7d0b36ea917b6a5ea844a19a07b12e71aaaa
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe - f6e82e1634b515ec7d7795087c0bfb0cf65f2f8705543a0a9ffe22809665636e
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - 2e8dbcda2a1752f90efc6d76923a0fbda3073894137292212a6a422216917f64

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787782842&P2=404&P3=2&P4=GCgIN%2bd3CYdcO1L%2fnprCrypZAHXxuwgDP2BbNpk55FYvuy3On%2fTWuTdFOeC1bU9qCB6Y0zP6UNzQLy1s11bV9A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787782905&P2=404&P3=2&P4=kA04mrZmmxs8SzpZhtl%2brqPG%2fycb1Z8F92PR9RiJAS7w0EbUuQAe8VNvgoBrQ5v1r9hnRlRAbqSq7xTZqftzBg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.42.73.28
52.123.252.239
172.215.188.225
57.155.101.212
4.230.171.124
4.144.132.114
135.232.92.137
135.233.95.135
51.132.193.104
20.231.239.246
40.99.133.226
52.123.128.14
52.123.129.14
4.207.44.73
203.26.79.13
135.233.45.221
52.148.114.188
52.123.252.236
135.232.92.34
72.154.7.109
20.42.65.84
4.150.223.107
52.110.12.46
52.110.12.55

More Prepscram samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report