MALICIOUS — b6de63d13e153b04adabdfc90f8cab8b881c301b75fe1c55ef58708a60551868

MALICIOUS — b6de63d13e153b04adabdfc90f8cab8b881c301b75fe1c55ef58708a60551868 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the PolyRansom family. 6 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: b6de63d13e153b04adabdfc90f8cab8b881c301b75fe1c55ef58708a60551868
SHA-1: b72f468db22d65b79e206b6309cbadb90dac9c31
MD5: 27e99b2ac3ca02aebb550dfba6a8f4bc
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 6144:592DrdFMPJKhMwC2cKg3UYvyoVvG6XLemIhiELu:5kDr3MYhGKg3UYaog6bvUNa
TLSH: T18246D43E07114829CBE65EA9FDCFC659A4D50A6E282BF76BA42CB0DF8605597F0C10C1
Submitted as: b6de63d13e153b04adabdfc90f8cab8b881c301b75fe1c55ef58708a60551868
File type: pe · Size: 300032 bytes
Verdict: malicious (100/100) · Family: PolyRansom

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): BC.Win.Virus.Ransom-9157.A
Microsoft Defender: Virus:Win32/Nabucur.A
Emsisoft (Emergency Kit): Win32.Virlock.Gen.4
Trellix Stinger (McAfee): W32/VirRansom
Kaspersky (KVRT): Virus.Win32.PolyRansom.a

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged BC.Win.Virus.Ransom-9157.A (rule BC.Win.Virus.Ransom-9157.A) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 6 finding(s), e.g. RWX/private injected region in vcIYEIkQ.exe (pid 6804) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (24 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Dropped 16 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

11098 behavior events · 3 ATT&CK techniques · 28 dropped files.

Dropped files

C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.exe - 71a848526cbbb25befaa5b161fcbc55c72e68d2d8c5de7670644a1be2fb91865
C:\Users\analyst\AppData\Local\Temp\cEIC.exe - e7eb93a83dca53cf6fe9a416b9ccdd918b398e74ff2e714c3fc0a4514bb28cd9
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.exe - e596e273429dcce011d8f3e7d0b3c7a0711e71f2dc733a631c0e703f75496da4
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.exe - 3b2e73c971c8c6c1f7ba22951afdb99ed7169087a2347eb9f32ecfeb99155c4d
C:\Users\analyst\rSwIoccE\vcIYEIkQ - 8a0b5275102d9c0fcb8499fbaf3759491663fb92701f6d39fca7854131003323
C:\Users\analyst\AppData\Local\Temp\SYgA.exe - d01b53fbb71b964359ac0564b4aec6c08f9f9bd1300347c1ee212bbcdc2ad08d
C:\Users\analyst\AppData\Local\Temp\IUoK.exe - 8434566747b712a935cb50ea3d8cd1e2f2d28586269964191db946594f9b1b31
C:\Users\analyst\AppData\Local\Temp\AoQs.exe - dc820ce89e399c93755bb0d9f0f65d366c7effc975d4713794dc6b6934dd33e7
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.exe - c35a27316760bed7f5f7050ed29b1010544315fdf16ebf71cd278eb26bf6b315
C:\Users\analyst\AppData\Local\Temp\uAsa.ico - bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620
C:\ProgramData\xiocAsMc\yKgEskQE.inf - e5afa8f96261ae521d214e719a5bc44504a009f2be8373f1c26e65e916502686
C:\Users\analyst\AppData\Local\Temp\CUYq.exe - 343aeb8af42142df7c3bb3b2837935bc43b8343d36db4d5bc939febbb3ad69dc
C:\Users\analyst\AppData\Local\Temp\nKgAYEYM.bat - 57cd6ae4bc88529e36f29eade5cdd6586376221ec2cb8c1d064a2a8aa0c19d62
C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png - d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787887253&P2=404&P3=2&P4=gB7LZ%2fuFqvxxQ1gTwvOjJ8GeCaQKFnPO9IEqwarsbwW4k9DsmPbWF3qAdtSwLryVWeH3hdOmXfnqWfIoqw0PwA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://google.com/
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787887320&P2=404&P3=2&P4=YGZqmRap3RbWZS0drTs81Z0aX9yoFVBjSJEOtvVt14rqf5Cl41steXGM289rNo%2bQcepYvJVqXDGTJZgVU567gw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

4.150.223.99
52.123.252.242
4.247.188.224
4.230.171.124
52.123.252.243
52.253.84.76
20.42.179.192
74.178.240.61
20.184.175.3
74.178.240.51
20.231.239.246
52.123.128.14
52.123.129.14
162.159.142.9
4.150.223.112
203.26.79.13
74.178.232.29
200.87.164.69
135.234.160.244
200.119.204.12
52.148.114.188
190.186.45.170
92.223.78.30
72.153.5.135
52.110.12.3

More PolyRansom samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report