MALICIOUS — 891bdca7aff9ed72a52fdd0621a764f756d861265b3b127bdbf483375c4dab4f

MALICIOUS — 891bdca7aff9ed72a52fdd0621a764f756d861265b3b127bdbf483375c4dab4f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Cryptinject family. 5 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 891bdca7aff9ed72a52fdd0621a764f756d861265b3b127bdbf483375c4dab4f
SHA-1: b50449882f8eb388958ad2b322dfb8f39c1bb5ba
MD5: 0aa4fac3cdf840a3069618e7482cbac6
imphash: a9192bab5c7c795c7488b69a1853f9c2
ssdeep: 196608:N46ob5tOcEC7fFLOyomFHKnPj46ob5tOcEC7fFLOyomFHKnP646ob5tOcEC7fFLS:NqltDFOqltDFDqltDFO
TLSH: T1726EC0EA1640B787E1B0CB60BC14558D902278C472BFADEEF243052F37E65AF554A12E
Submitted as: 891bdca7aff9ed72a52fdd0621a764f756d861265b3b127bdbf483375c4dab4f
File type: pe · Size: 13585478 bytes
Verdict: malicious (100/100) · Family: Cryptinject

Detections (5 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Cryptinject-9890994-0
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Trojan:Win32/CryptInject!pz
Kaspersky (KVRT): Virus.Win32.Lamer.ks

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Malware.Cryptinject-9890994-0 (rule Win.Malware.Cryptinject-9890994-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/CryptInject!pz (rule Trojan:Win32/CryptInject!pz) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.ks (rule Virus.Win32.Lamer.ks) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 1 external host(s) and 19 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1622, T1082 - dynamic signal, weight 0.40, confidence 0.75
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.pinkworld.com, http://www.youporn.com, http://www.redtube.com - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dropped 23 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

94085 behavior events · 2 ATT&CK techniques · 38 dropped files.

Dropped files

C:\Windows\System32\vcruntime140.dll - e5bd2315d14de48763ce68d08d7f5bb2619bd9896f9411da55c447e50f58127f
C:\Windows\WindowsUpdate.log - f985841ce406026007c7d3e2fc7087649594529bd859eec18f5edbc53553f40c
C:\Windows\System32\NOISE.DAT - 1a0e2092d3b970c1ef7ae36de59fc0058c57f5c6256da359406ae445fca9ab3c
C:\Windows\win.ini - c24b8122f7b16e2ff039b1e53f8d510a53f4077d753ce5e2bfd05485a811c71b
C:\Windows\pyw.exe - 10134cb3966f04d1ff0e9445959b1509735f29a5d6edaa8d8c50401d648ca0c8
C:\Windows\System32\msvcp140_atomic_wait.dll - 7b3f6df64bbeaa6b79c906a543da7aeb72c807f2b65dc1daae78767c51f369f9
C:\Windows\DtcInstall.log - 217a19cf7178e17ecf742261872f31c0effbd4ab48029ca67077f57a0d2d247b
C:\Windows\PFRO.log - 34fd027227782f00dcfde2f8e6f29f28c651c66306f7eec6202efa98bf3310fa
C:\Windows\setuperr.log - 0b23a9ff7d598706163c46170855322a4bb863402811de7641dae0a6c7c0d787
C:\Windows\System32\mfcm140u.dll - 30de471e41bd9128a55670a8bfb95439907acaccf60bd527d39c8951d0ce6e3a
C:\Windows\py.exe - 35b48073b4fa2716229d8e9f84e571ba36bc38e618478b3f23eececfc6c19dd7
C:\Windows\setupact.log - ecae2185d73020ba395f289b22f0d3aaab61f3d0c3b8f057c0ff24a8f99eca98
C:\Windows\System32\msclmd.dll - 049c23017455ddd8814ce1b12390c0a35af21883d693b3fe90451b2f9011d82e
C:\Windows\System32\license.rtf - 60b8503fde5d786103f70eb3456eee743aa9d2fc8c9b41018322953c70859db5
C:\Windows\SysmonDrv.sys - b13608b151e9ea60805ae847f68d668a06f1261cb7bfbeb9788a08868a7df0f9

Embedded URLs

http://www.pinkworld.com
http://www.youporn.com
http://www.redtube.com
http://www.assparade.com/
http://www.freeav.com/
http://www.antispyware.com/
http://www.antivirus.com/
http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://203.26.79.13/filestreamingservice//files/afb4c1e7-5ab6-4274-bbe6-fa4639876844/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/afb4c1e7-5ab6-4274-bbe6-fa4639876844?P1=1787350513&P2=404&P3=2&P4=hPXnleCiB9KFQ4NRbqYeeghmod3YwFu3rr9u1dSWiMPau3fH8ayNmoxsXeGYw0HQYtbTaDTHKbjAVSOC%2b0lU%2bA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf?P1=1787354299&P2=404&P3=2&P4=ElLaAGSqvHE%2fud1oOy9cHTUmePvNSsovOeUG0kb6%2bBU6%2b%2bMYS0cpPMllI2X7kLzG0p4YKwEcdFNAK2Q5UFj2GA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com

Embedded domains

www.pinkworld.com
www.youporn.com
www.redtube.com
www.assparade.com
www.freeav.com
www.antispyware.com
www.antivirus.com
crl.microsoft.com
www.microsoft.com
office.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.89.1.12
52.123.252.202
4.230.171.124
20.42.179.204
20.165.94.63
20.247.184.142
48.211.4.16
74.178.76.54
20.42.65.90
20.184.175.15
52.182.143.212
48.199.12.1
20.42.65.93
52.168.117.171
203.26.79.13
20.42.65.91
52.148.114.188
135.234.160.245
4.150.223.96
20.184.175.9
52.110.12.47
52.110.12.3
72.154.7.101

File paths

f:\binaries.x86ret\bin\i386\mfc140u.i386.pdb
X:\:`:d:h:l:p:t:x:
X:\:`:d:h:l:
T:\:t:
X:\:`:d:t:x:
L:\:`:p:t:x:
X:\:`:x:
L:\:`:d:
D:\:t:
X:\:l:
X:\:d:
X:\:`:h:
F:\:
X:\:`:d:h:
X:\:
X:\:l:p:
D:\;t;
X:\:`:t:x:
T:\:`:h:l:p:x:
T:\:`:h:
H:\:
C:\:u:
L:\:n:z:
O:\:k:y:
T:\:d:l:t:

More Cryptinject samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report