MALICIOUS — 7d655d022c6c8eb5c9acf334f3cb648cde9ff620aaad6a844bfc8cfa605e6904.ps1
MALICIOUS — 7d655d022c6c8eb5c9acf334f3cb648cde9ff620aaad6a844bfc8cfa605e6904.ps1 is a script sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (70/100), attributed to the AntiVM family. 4 of 53 detection engines flagged it, exhibiting 4 ATT&CK techniques.
Identification
- SHA-256:
7d655d022c6c8eb5c9acf334f3cb648cde9ff620aaad6a844bfc8cfa605e6904 - SHA-1:
e413aba28b4b0c1bab3273b953a474541e87cba3 - MD5:
97bc731cef959bb6809e47ed905ffc03 - ssdeep:
49152:GOi3+k6B9wiLXTKKuaRGw66Q7b0AI/saq14VpEUCOg3a5:r - TLSH:
T1FA6A8D1D073F99497A262307AC03613A29CC1E45ECAD13C5216E3B8F999B993D6B03DD - Submitted as: 7d655d022c6c8eb5c9acf334f3cb648cde9ff620aaad6a844bfc8cfa605e6904.ps1
- File type: script · Size: 9411000 bytes
- Verdict: malicious (70/100) · Family: AntiVM
Detections (4 of 53 engines)
- capa (capabilities): capability:execution/powershell
- YARA: Yara-Rules community: YR_AntiVM_Sandbox
- Microsoft Defender: Trojan:PowerShell/Nemucod.SLRP!MTB
- Emsisoft (Emergency Kit): Trojan.GenericKD.79825626
MITRE ATT&CK
Why this verdict
The malicious score of 70/100 is the fusion of 3 weighted signals:
- Obfuscated powershell script: dynamic-exec, encoded-command, defense-evasion (layers: base64) (rule
script-deobfuscation) - static signal, weight 0.55, confidence 0.75 - execute via PowerShell (rule
execute via PowerShell) - capa signal, weight 0.40, confidence 0.80 - YARA: Yara-Rules community flagged YR_AntiVM_Sandbox (rule
YR_AntiVM_Sandbox) - engine signal, weight 0.35, confidence 0.70
Dynamic analysis (windows)
17994 behavior events · 2 ATT&CK techniques · 18 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
Dropped files
- C:\Users\analyst\Desktop\O2w7KIGW\pcicapi.dll -
2dfdc169dfc27462adc98dde39306de8d0526dcf4577a1a486c2eef447300689 - C:\Users\analyst\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\O2w7KIGW.lnk -
40d14fbadfdc275f44258067a73cb2a2f7e17c699f5f4561e1b629e115f88cb6 - C:\Users\analyst\Desktop\O2w7KIGW\PCICL32.DLL -
b6d4ad0231941e0637485ac5833e0fdc75db35289b54e70f3858b70d36d04c80 - C:\Users\analyst\Desktop\O2w7KIGW\nsm_vpro.ini -
4bfa4c00414660ba44bddde5216a7f28aeccaa9e2d42df4bbff66db57c60522b - C:\Users\analyst\Desktop\O2w7KIGW\service.exe -
275e5b085534f64313b50cbdcb08ecd59c57d21c96bb937f140ee92a3d27f792 - C:\Users\analyst\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache -
7fde5f252aeff032e05bc43e7efb8edbab51cf4cb321e9ebfe790e04c92087b6 - C:\Users\analyst\AppData\Local\Temp\__PSScriptPolicyTest_mklw1xfp.q5y.psm1 -
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 - C:\Users\analyst\Desktop\O2w7KIGW\msvcr100.dll -
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18 - C:\Users\analyst\Desktop\O2w7KIGW\HTCTL32.DLL -
6562585009f15155eea9a489e474cebc4dd2a01a26d846fdd1b93fdc24b0c269 - C:\Users\analyst\Desktop\O2w7KIGW\TCCTL32.DLL -
6ffe12cdfe0a36dec4b4a40ecdafb4097b1af7c340b0fcecf9f5c67b7fa8b299 - C:\Users\analyst\Desktop\O2w7KIGW\client32.ini -
75a545bcc883896828a6cce8871de6e167db552cebdd6c2da63b14064e8fe36c - C:\Users\analyst\Desktop\O2w7KIGW\PCICHEK.DLL -
0cff893b1e7716d09fb74b7a0313b78a09f3f48c586d31fc5f830bd72ce8331f - C:\Users\analyst\Desktop\O2w7KIGW\AudioCapture.dll -
2cc8ebea55c06981625397b04575ed0eaad9bb9f9dc896355c011a62febe49b5 - C:\Users\analyst\Desktop\O2w7KIGW\nskbfltr.inf -
d96856cd944a9f1587907cacef974c0248b7f4210f1689c1e6bcac5fed289368 - C:\Users\analyst\Desktop\O2w7KIGW\NSM.LIC -
53b4a9603905e7838842694a90549362d9ec25b6d22e1c4f3d6c14e040c7a76c
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787748252&P2=404&P3=2&P4=TjcwcSdGZhBc%2f4fcpzElti7HOarPKGwAKHlnj2t%2fjNemCzfabUcSRYf9XQ6ZKxegZq3OeKfZSjsvQ5TgwTGQ9Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787748340&P2=404&P3=2&P4=nQqsOma1cVvtv15ETb53FaAjAXcXw0XwoZLR%2fOOQLjcYhBC1gm7EnuNamuiSxUCIe7fyB5hfHa5mKrbhpUHZiA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded IP addresses
- 20.184.175.5
- 52.123.252.247
- 52.230.60.54
- 57.155.104.224
- 74.179.77.204
- 4.230.171.124
- 20.42.73.24
- 74.178.240.51
- 135.233.95.144
- 135.232.92.137
- 20.231.239.246
- 52.123.252.229
- 40.103.64.242
- 52.123.129.14
- 203.26.79.13
- 135.233.45.223
- 74.178.232.29
- 52.148.114.188
- 135.234.160.245
- 20.184.175.6
- 52.182.143.212
- 52.110.12.25
- 72.153.5.60
- 52.110.12.31
- 20.184.175.16
More AntiVM samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report