MALICIOUS — 7e0fa388b4ada3754e419cb05bbda25b5c4f832372cb795709a884348ea87870

MALICIOUS — 7e0fa388b4ada3754e419cb05bbda25b5c4f832372cb795709a884348ea87870 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Zusy family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 7e0fa388b4ada3754e419cb05bbda25b5c4f832372cb795709a884348ea87870
SHA-1: 6fa0ded2e4ab87ba79ebfe88dbbf824f3bc3e18c
MD5: 722863846e0a348e561be2f5f95ed972
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 12288:S3RYegODhxlpplBMzoseH6eDNJnslCpKrE4uB/W6g0RYLy3X5KWAlQDgbs7:ShY4hxlpplBMzS6MJslCp2TC/WTQYCMg
TLSH: T19F4D23326407B345D449FD0572D67B6C22911C18384EE5468FD8FB05AABF4A33DE8ACA
Submitted as: 7e0fa388b4ada3754e419cb05bbda25b5c4f832372cb795709a884348ea87870
File type: pe · Size: 579808 bytes
Verdict: malicious (99/100) · Family: Zusy

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Virus.8
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Prepscram): CTS.exe - dynamic signal, weight 0.62, confidence 0.90
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 23 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

2448 behavior events · 1 ATT&CK techniques · 17 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe - b1b3a11bc9be14377e31bc4ac0209ec105a2cd16d819acf5f3dd22cf14f6656f
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe - 78fdad604a6e5f6137442f6446c5e8b25fc277262d4e02be1a0f732e83ba699a
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe - 64d22b6c746ccbc23ea5f30d59f7ec7c665379954b9d9c8d81335f4f866ebe73
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe - 1ae00b510da4e4949a67b5625cff0cc807e622b842eba489185b3927bb07eec4
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - 55d00f31ea47789f89e990f5d1c77c83304cb496e639ee813d328ef9d33a6330
C:\Windows\CTS.exe - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - 1b41be1908b9e4d670c6c837d1f6e7ee7c0068b77894f2dbbb333588264f9b91
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - d910423f145eee78f0827a48d3f0cd1870dc2d3d9a36b55a717d14a33561ccaa
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - b8ed1c7c8bc2a02a6d03260e6f6626765f43d183358767d2eebf4f947ae3edb7
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - 1e0c24e334152bc7f7362c6927b932fea766c956b7b4633a42976fd3ce6c5760
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe - cf24bc1a4dd7c6f356d8db93bcc8fcfb27cd3167498746ad32b827abdb8274d5
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - 303e10439907dfa3b91cc74509ec110f04256cba240321534672e91f0b7feeec
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - ba2201ffd3fa5c7c651902fa8ba2a61e8ac85c75ec92c712f1cd946e06f459c0
C:\Users\analyst\AppData\Local\Temp\21MoS1Z3ppGov4u.exe - 9182203cb5c38673d9032a24721cc47cbcc3d3b42750541464ef777d9ac24050
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - a1187047c2ed28aa6d766bdc8c93f2ab6e82b521325267a8ad358dea093332d8

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787813448&P2=404&P3=2&P4=nc8YQd6mqn8OtREZO2ux9V55oMssqYRCbLoNkJ6F%2btb5K8GgOvO3wa1drSFQhNmacJWqAxo19XTa2uYtHpuDdQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787813470&P2=404&P3=2&P4=GWFvXEJMP6IauwTBnx4PplHOObnbA%2fuTOSkIHmsRiFctZw%2bdJpUQ7zfgpwVe1TNgEdsvLfN7eisupGqLZJOa6w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

aefd.nelreports.net

Embedded IP addresses

20.42.65.90
20.247.184.197
48.211.4.16
4.230.171.124
74.179.77.204
74.178.240.51
52.168.112.66
20.76.201.171
40.99.133.210
52.123.128.14
203.26.79.13
4.150.223.113
135.233.95.80
51.132.193.105
135.233.45.222
52.110.12.42
52.110.12.11
52.148.114.188
125.56.205.121
125.56.205.32
72.153.5.96
52.110.12.2
52.110.12.30

File paths

n:\:

More Zusy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report