MALICIOUS — 7c496526660d2c754b080b77b7e2be61971b04758a7b75a4643ad2947cfcdfbe

MALICIOUS — 7c496526660d2c754b080b77b7e2be61971b04758a7b75a4643ad2947cfcdfbe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the AntiDebug family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 7c496526660d2c754b080b77b7e2be61971b04758a7b75a4643ad2947cfcdfbe
SHA-1: 63b09d1b3a37af151594901a04313ce277a37341
MD5: c0a0d70a31739a7e443995b8f7d09417
imphash: 0b978ec7715483bec18fb1fc3a2a737a
ssdeep: 3072:6jr87S7Gnz55EoV4n4Fdj0cmgsrYOa0C:/Zl25ed4hrHo
TLSH: T19C3FBEDD492AA7C5C6B6DB325F10591C2423F0AA1FBE340C3D83D82E79E285B687845D
Submitted as: 7c496526660d2c754b080b77b7e2be61971b04758a7b75a4643ad2947cfcdfbe
File type: pe · Size: 152088 bytes
Verdict: malicious (99/100) · Family: AntiDebug

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Trojan.GenericKD.37912197
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 28 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
Dropped 15 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

2366 behavior events · 1 ATT&CK techniques · 15 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe - 5965f7b32cb1faf642fc85b6ad0d94095c7301d406c1ffa90ad7bac4ccb24b74
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - 72cc1200107ed75a84ec34f175a2e93780a3aa85e5f76b7fb861746b01f46bd8
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - 5c254404c30cedc6d8c27432f0885fb87f4eedcbf55f1e490d2bd16cc8ff29a5
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe - e2b9e241003cebb6caf83b1f8128dbca3c61cf9dcf9c58201000363ba005193c
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - 6020e96d88532a4a04b68072a7f222092e9c50237390303cd04e61f2a94c588d
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe - d966e4cabdc50942c1e4f79160eff035de4f29ece6540373a037c9554e66b408
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - 564b1f3792eb240aec39acf28f38023c1eabdef80e757cf6984a3a06f42df934
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe - 8bdcec4d0ebe11da42ed6e6848485f74b5046655e37994c5e524125407a4782b
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe - 5d1437342d20aa10628dfadf6d42a03937234ecb50caf0312ab45bf480568dc5
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - 6c951ec46f4e20d61fd42a576cfef35d00494339437cf90564330e65ad2eacd3
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - 259ef88c40b0d06a3cd5ed77a80577ab17a62fceb8efe9682d04f88c5fa85efa
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - c83bee7bef604d68a7d7995685af60182ac1988f368f2aeebb7db7c26653dda4
C:\Windows\CTS.exe - ff52d994f38f49789547cf1efe7c6a6535162c2ee1c405dadd229a6be1cf23a3
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - 3186c5287cbf71c7778020dfdee3fc83d6cd59a014f57133fe2b012b9c05bb5d
C:\Users\analyst\AppData\Local\Temp\SGBStlQ6KVmTVPi.exe - dbf6d4b65f6b88e3f01721c59a760debb53b1e1269cbeed99beaddecb70378f8

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787805635&P2=404&P3=2&P4=VhmnGARlVfJFNX2Qg3%2f3zEw413j%2fhlF0HoaK%2bEWV55utKeJqYwHfSxjRctyHxmajZkiV6kBouPN%2bLHXtY91rXw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787805730&P2=404&P3=2&P4=Oo%2b7pxDdyD9KqufVcQf%2fH7MBSVVN9gpQN5EOzDsq0HZGCvKVfecAXQ8htSg6JJEMmhyKV4sI4r92CMl9iXy43Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

52.182.141.63
52.123.252.195
48.211.4.16
4.230.171.124
20.247.184.142
52.123.252.204
135.233.95.144
74.178.240.51
52.168.112.67
74.179.77.204
20.184.175.22
52.123.129.14
20.112.250.133
52.123.128.14
203.26.79.13
135.234.160.245
52.148.114.188
74.179.71.159
52.123.252.223
104.208.16.94
4.150.223.98
125.56.205.17
125.56.205.32
72.154.7.113
135.233.95.80

More AntiDebug samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report