MALICIOUS — virussign.com_d707cc9a0103ec3fdb46261eb31cf150.vir

MALICIOUS — virussign.com_d707cc9a0103ec3fdb46261eb31cf150.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (77/100), attributed to the Wacatac family. 3 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: b667674fead7ee58de3c00f1974eb9bde2d3be8ddbea57e634afd11768ab9d28
• SHA-1: 30d8f0ae3d560cd805319535e6b26ffa0057a2e1
• MD5: d707cc9a0103ec3fdb46261eb31cf150
• imphash: fc75b4e84570c703da55dd0e2fb9fba7
• ssdeep: 3072:sV1/BluLsk7lpR42YT4/TqMG66L+2YJ+GQ36JRK7gHWJFQkZGpa6E46ih1QGl/K8:s3/BluV7lHS4mBbL+bgKmAZ6ihj6Qew
• TLSH: T18F589EA6821322A1FDF694589C688CECF882B56E1235944C5187FC5DA0DCF73F5F24A2
• Submitted as: virussign.com_d707cc9a0103ec3fdb46261eb31cf150.vir
• File type: pe · Size: 1740400 bytes
• Verdict: malicious (77/100) · Family: Wacatac

Detections (3 of 52 engines)

• capa (capabilities): capability:collection/keylog
• LIEF (executable format parser): lief:invalid-authenticode
• Microsoft Defender: Trojan:Win32/Wacatac.C!ml

MITRE ATT&CK

• T1057
• T1056.001
• T1112

Why this verdict

The malicious score of 77/100 is the fusion of 5 weighted signals:

• Microsoft Defender flagged Trojan:Win32/Wacatac.C!ml (rule Trojan:Win32/Wacatac.C!ml) - engine signal, weight 0.55, confidence 0.85
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

19430 behavior events · 1 ATT&CK techniques · 1 dropped files.

Runtime network

• none

Dropped files

• d4b217ef54a75ad0422afe70937fd720a57ffdf1e422b7105bd52a2917e1e905 - d4b217ef54a75ad0422afe70937fd720a57ffdf1e422b7105bd52a2917e1e905

Embedded URLs

• http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
• https://www.microsoft.com/en-us/windows

Embedded domains

• www.microsoft.com
• crl.microsoft.com

File paths

• C:\Windows\System32\ctfmon.exe

More Wacatac samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report