MALICIOUS — beb8f1a580ccf0c046ba6f56ba9678a9f350b24a4fbf66b2b5414bb2cfb392b3

MALICIOUS — beb8f1a580ccf0c046ba6f56ba9678a9f350b24a4fbf66b2b5414bb2cfb392b3 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepscram family. 6 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: beb8f1a580ccf0c046ba6f56ba9678a9f350b24a4fbf66b2b5414bb2cfb392b3
SHA-1: 76f8473eb44542701fb40e77491da892b1997527
MD5: 9ca0b6118e77bdcce1e67b2f35c51380
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 768:eyX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIo9d/1JSkQxk3kFfXNAf5FUCb:egKcR4mjD9r82mPJSkI5Afvx
TLSH: T11A32F2703031978CE7673C0864CDB9DFAA225CCA1CA946530960C91ABD1947BD6EAF54
Submitted as: beb8f1a580ccf0c046ba6f56ba9678a9f350b24a4fbf66b2b5414bb2cfb392b3
File type: pe · Size: 44136 bytes
Verdict: malicious (100/100) · Family: Prepscram

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Virus.8
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Prepscram): CTS.exe - dynamic signal, weight 0.62, confidence 0.90
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

7821 behavior events · 3 ATT&CK techniques · 17 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - 116f3037779561683eb7e8ffc6da1ba81020a7e9989ccc283ee34664269b5fdc
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe - ea60dc332a9972faec676c0300242a4877cfc367c9c2264e7ed9b5ff32ae5430
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe - ce17c9fa3e0e9c6ede496fac40f7c01e6b66a4b14f7159055d9db00b7b487565
C:\Windows\CTS.exe - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - 4216ee92954d983b84de94a4bec9e0e9977249d936500a54f4d3310ed2b72d7c
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe - 4cc1c1201a57500b4874b72a0a7ba373abcd26ea523e2476cbc7e74c6e4ba346
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - e1be58d25cdf256117f6d70f41f660530be47a1ce93b874032ecb934d9f67831
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - cf97fde709e8c2a242c00637df28d5244bb5aed0a01970ca7d84a010ab5d55a4
C:\Users\analyst\AppData\Local\Temp\zG3efs9V9TraWta.exe - c063966687887eb0aaf5cbd6486a974cfbc84edbb84b305303fb531b303e5c1e
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - 09bee03edbbf764f0cc9534f33422d2836a8a982cf5cb48b314876247c51c351
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - 0b075a693ccf5235fa5bcffabf2e65dbcc239afd462d56c672021958d9dc29d9
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe - 9a206ebd6e7286de313c28d0167523e57daaaed4efd80a0a169773ce4b437477
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - e00d3d214f1d258193ab5a63760925b08ccb43d727a9b7ff1514317a9b4800e5
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe - f6ba309268527a54e4c5738cf0c1cff82b3fe19543d419ab93b37b6462bf4e31
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - 4b5fb0303b020d98fcfb2db6959ca3b3e363a3997d7378a15da3789876930bbb

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787856093&P2=404&P3=2&P4=m5ojlMziwmO%2faBFREsSZKCqfEdXdyfypeHlmFry%2bmvR66PhEbU8Y%2fB9bYjpLx78XpNoRtPn%2ffPuFCxwWZYFTiQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

4.150.223.96
52.230.60.54
4.230.171.124
20.42.179.204
74.178.76.128
135.232.92.97
4.150.223.103
20.236.44.162
52.123.128.14
52.123.129.14
52.123.252.194
172.178.240.162
52.123.252.223
203.26.79.13
52.110.12.20
52.148.114.188
52.110.12.42
135.234.160.244
74.178.232.29
57.154.63.210
72.154.7.17
92.223.78.30
48.211.4.16
52.110.12.4
52.110.12.8

More Prepscram samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report