MALICIOUS — 7dd8fba9a4f6d54091167d7fbf7913b6b001249fa8e4d4bcb10292bc49ecc2bc
MALICIOUS — 7dd8fba9a4f6d54091167d7fbf7913b6b001249fa8e4d4bcb10292bc49ecc2bc is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Sivis family. 7 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
7dd8fba9a4f6d54091167d7fbf7913b6b001249fa8e4d4bcb10292bc49ecc2bc - SHA-1:
6309eaa58fd0147f0db154a26af63449311e5e10 - MD5:
4ae739f9fe1689fd6fdda65667e5cd61 - imphash:
b10d16eedb1085ef7262dfc4ab03be6f - ssdeep:
1536:KEq3GcO95XUdeHXUde5lwle3hhbiZsdEq3GcO95XUdeHXUde5lwle3hhbiZseEqN:KEqgNbiZsdEqgNbiZseEqgNbiZsNa - TLSH:
T1BF474DCF1128A65EE1E0486F052CB4FF44C6E8726F74404A76C497F4446483BA67FBAA - Submitted as: 7dd8fba9a4f6d54091167d7fbf7913b6b001249fa8e4d4bcb10292bc49ecc2bc
- File type: pe · Size: 329339 bytes
- Verdict: malicious (100/100) · Family: Sivis
Detections (7 of 56 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Malware.Genpack-9881499-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Detect It Easy (packer/type): DIE:UPX
- Microsoft Defender: Virus:Win32/Sivis.A
- Emsisoft (Emergency Kit): Win32.Sivis.A
- Kaspersky (KVRT): Virus.Win32.Agent.es
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 14 weighted signals:
- ClamAV (daily) flagged Win.Malware.Genpack-9881499-0 (rule
Win.Malware.Genpack-9881499-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Virus:Win32/Sivis.A (rule
Virus:Win32/Sivis.A) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Win32.Sivis.A (rule
Win32.Sivis.A) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Virus.Win32.Agent.es (rule
Virus.Win32.Agent.es) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - Contacted 2 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
- Detect It Easy (packer/type) flagged DIE:UPX (rule
DIE:UPX) - engine signal, weight 0.35, confidence 0.70 - MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule
UPX) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://d.symcb.com/rpa0, http://s.symcb.com/universal-root.crl0, https://d.symcb.com/rpa0@ - static signal, weight 0.35, confidence 0.60
- Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
- Dropped 10 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule
windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
16922 behavior events · 0 ATT&CK techniques · 98 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- settings-win.data.microsoft.com
- config.edge.skype.com
- officeclient.microsoft.com
- windows.msn.com
- www.msn.com
- odc.officeapps.live.com
- licensing.mp.microsoft.com
- assets.msn.com
- www.bing.com
- watson.events.data.microsoft.com
- edge.microsoft.com
- v10.events.data.microsoft.com
Dropped files
- C:\Program Files\7-Zip\Lang\ext.txt -
40f37bef77accb2eb4ce0c44cc34d77cb6ea6301c996f33fd4e1975bc2b05576 - C:\Program Files\7-Zip\7-zip32.dll -
1d54381d57297297b8e0ad68d1e0d5bca970875ac2612c11ce7219ba89226b3a - C:\Program Files\7-Zip\Lang\is.txt -
78e5300396608d797309a6f2d5386161c7bc26058ce86c6f5f117d0123edcc35 - C:\$WinREAgent\Backup\boot.sdi -
4d3d9896928bbe04f281112243c121616045a923b3522be9cdfc07653ed76dc0 - C:\Program Files\7-Zip\Lang\mr.txt -
23ec2baefddd1f287ccae159bffff2fe1f4dab9690656d68e2ace25da2d66f33 - C:\Program Files\7-Zip\Lang\he.txt -
4e6c5fbe998e996f9fdc532b4714d5d74bb85ce7825c8bc0427571f207b763e3 - C:\Program Files\7-Zip\Lang\ko.txt -
935b38d7999a936dfc0795676dbaaa0c63cfb5bbb7ddfc77ace8ffcf0a4f21f8 - C:\Program Files\7-Zip\Lang\ps.txt -
2286c68e0da728d5709b3b38006d8f2dba34943731492f34539b17de13df0870 - C:\Program Files\7-Zip\Lang\mk.txt -
36b7232c18b975502a83240bef827593b75d188e48cdf381866befababd3f158 - C:\Program Files\7-Zip\Lang\hu.txt -
d7d7cf5d82354aa427a143c09cdea74df277d457659a7b4164354d5c854ac1da - C:\Program Files\7-Zip\Lang\mng2.txt -
31343efadea992f13a7d72178a0bdffaa91a13ec1dc9dcdd69422dd6355e018d - C:\Program Files\7-Zip\7-zip.chm -
07f4e751de466d81bee9b13fe40373a7b06bbe015538ad6778fbc8013fb131cf - C:\$WinREAgent\Rollback.xml -
bcef6eeacbd8f57a245ed63d5684f3016f43d5cd6d9bd6aaf67ef4f6941d29f5 - C:\Program Files\7-Zip\Lang\cs.txt -
41a462a5314191ac8c0765fafa30d8a1506af8686af1a15a7afa13bb26d04315 - a11e4fd1ce51cca07f3f0cc001833b5f1933fde194ec483827334a0817338285 -
a11e4fd1ce51cca07f3f0cc001833b5f1933fde194ec483827334a0817338285
Embedded URLs
- https://www.digicert.com/CPS0
- http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
- http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
- http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@
- http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
- http://www.digicert.com/ssl-cps-repository.htm0
- https://d.symcb.com/rpa0
- http://s.symcb.com/universal-root.crl0
- https://d.symcb.com/rpa0@
- http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
- http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
- http://creativecommons.org/publicdomain/zero/1.0/
- http://www.verisign.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- crl3.digicert.com
- crl4.digicert.com
- www.digicert.com
- cacerts.digicert.com
- d.symcb.com
- s.symcb.com
- ts-crl.ws.symantec.com
- ts-aia.ws.symantec.com
- creativecommons.org
- geocities.com
- go.microsoft.com
- directory.verisign.com
- www.verisign.com
Embedded IP addresses
- 57.155.104.224
- 4.207.44.64
- 4.144.132.114
- 4.230.171.124
- 135.234.160.246
- 52.110.12.16
- 52.110.12.25
- 184.84.165.171
- 52.110.12.14
- 4.150.223.115
- 184.84.165.136
- 52.110.12.47
Registry keys
- HKCU\SOFTWARE\Microsoft\Internet
File paths
- X:\windows\system32\sysreset.exe
- C:\Windows.old\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim]
- C:\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim]
- C:\Windows.old\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.1120_none_c3e
- C:\Windows.old\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.1_none_eedfed
- X:\SysResetTrace-Tel-Merge.etl,
- C:\$WINDOWS.~BT\Sources\Panther\SysResetTrace-Tel-Merge.etl)
- C:\Windows\System32\GettingStarted.exe
- C:\Program
- X:\windows\system32\Dism\SiloedPackageProvider.dll.
- X:\windows\system32\Dism\MetaDeployProvider.dll.
- C:\Windows
- C:\$WINDOWS.~BT\NewOS\Windows
- C:\,
- C:\inetpub
- C:\Windows.old\inetpub,
- C:\SkyDriveTemp
- C:\Windows.old\SkyDriveTemp,
- C:\Recovery
- C:\Windows.old\Recovery,
- C:\Windows.old\Recovery]
- C:\Recovery\ReAgentOld.xml)
- C:\Windows.old]
- C:\Reset_SafeToDelete_OverwriteSpaceFile_0.tmp]
- C:\Windows\System32\ResetEngine.exe
More Sivis samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report