MALICIOUS — 81008e041967e378adec569969cb18bd3b7312e65da5615861584a03b6498ddc

MALICIOUS — 81008e041967e378adec569969cb18bd3b7312e65da5615861584a03b6498ddc is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepscram family. 6 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 81008e041967e378adec569969cb18bd3b7312e65da5615861584a03b6498ddc
SHA-1: 238eb078f86a91b1c5cc505db34f46d7c20165c9
MD5: a51aa43d3cfb9b572dc7a7ce8128aabe
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 768:eyX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIoqXIfno/ddyjJ76v0AFPuf:egKcR4mjD9r82XIo/gZ
TLSH: T1E032F170B063E349E336BC18504CB9BEA5331C4E0D98975329A1CA0AA86487BD7FE715
Submitted as: 81008e041967e378adec569969cb18bd3b7312e65da5615861584a03b6498ddc
File type: pe · Size: 44136 bytes
Verdict: malicious (100/100) · Family: Prepscram

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Virus.8
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Dropped a malicious payload (Prepscram): CTS.exe - dynamic signal, weight 0.62, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Prepscram!pz (rule Trojan:Win32/Prepscram!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Virus.8 (rule Gen:Variant.Virus.8) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Agent.neyndy (rule Trojan.Win32.Agent.neyndy) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 9 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

7233 behavior events · 3 ATT&CK techniques · 32 dropped files.

Dropped files

C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EDCF682921FE94F4A02A43CD1A28E6B - 13ec23e45e65cbc51f6406e3c5c328e50ad3eb1b4c247b31a31e1d40760ebdf4
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - 3ed9f44e91cad7f86c6377be2e06c22d57fcb3e71152616f3f16d86b0eeb8274
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EDCF682921FE94F4A02A43CD1A28E6B - 4770dc8005ef5a574cb6f1f0f80a96769230a4ac1bc154def2cb77dadec881f2
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - e472ba9fb62976b42045f0d84efa814ed4061b29af0ad01f61e608387fb7f4ad
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\FileSyncHelper.exe - e2304202a8f7f96c88aadbc31a1bd2cc174c6ef217383d40ac16928f6879e670
C:\Windows\CTS.exe - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - 3b2260e23b66b4adbae81c819ca30816a729160bdcc222a3cd9cb21ec9aaaaac
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - 71fe586d2ee5cf59c3fec1a5e4ad1a9b09eed194db62a540915b99e9cfb0c731
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - cd7660dce5e377aeda6269bae6070921752d27e36c711c30621b63a09c31e223
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CD9C747F40EEA288D73938D33144F716 - cd154143ff202fc1513ea411f351ee80754124e664bee2de6097b02be7ec41b4
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - 01158a85c1a6280a30acd98dcfd7fc2998c93de1a181de36adcb3d2bd9b48a2b
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - d9741f3557212c94e45ed20fa7c9d9264a93d10ae721e31f451a304cced6603d
C:\Users\analyst\AppData\Local\Temp\G0kvPy4nQREVlb8.exe - 13c921999e5ff273007a610a8521bbc77d884b41d9cbbd41e045b3497909659c
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe - 80f235f6bee91bf9468e819946ac7009f43b3b18e67b5a5b2ae551aa5011950b
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe - 99959bda1786be262e283b15638fadf8a0c46782949128f6ecd998a3c9a266f9

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D
http://th.symcb.com/th.crl

Embedded IP addresses

4.150.223.113
4.144.132.114
52.123.252.233
4.230.171.124
162.159.142.9
57.155.104.224
40.84.97.4
184.84.165.171
52.110.12.48
52.110.12.15
72.153.5.60
52.148.114.188

More Prepscram samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report