MALICIOUS — c30015bacd440d1e1206afa56fa1ab35bd855d60cb76d4cfeae82ebad9705705

MALICIOUS — c30015bacd440d1e1206afa56fa1ab35bd855d60cb76d4cfeae82ebad9705705 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepscram family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: c30015bacd440d1e1206afa56fa1ab35bd855d60cb76d4cfeae82ebad9705705
SHA-1: 3416ed5108b2d91c06f3010c87274cb0e6759488
MD5: fa2f0a8f465e336a7c739b7b10e00871
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 768:eyX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIot:egKcR4mjD9r820
TLSH: T13B2DD0707076D348D376FC1860CDB9EEA1236C8A089D57971EA0D90ABC6047BC6F6B20
Submitted as: c30015bacd440d1e1206afa56fa1ab35bd855d60cb76d4cfeae82ebad9705705
File type: pe · Size: 29259 bytes
Verdict: malicious (100/100) · Family: Prepscram

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Virus.8
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Prepscram): CTS.exe - dynamic signal, weight 0.62, confidence 0.90
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 4 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

2352 behavior events · 1 ATT&CK techniques · 17 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe - 6e6525fa93bd4d4d2347fd24b37a030402f593381bf6067dcff850d4a1cbee5f
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - 8632578a1eca9c61a007f23dd53db36179a858412b558cca8daefb234196ff3c
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - d1e0a14c5d339cc2f92a3957a34ac9e3185342a8065f3a52398fe35e8f0f376e
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - c11079101e9ae945de9a0dd65bc2bb810a7116a5126198953ffd0343c3acb4d2
C:\Windows\CTS.exe - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - f5bc76128ca4287459f9879fd18bf410a620c30e0a31abce105f8ee774bf6c1d
C:\Users\analyst\AppData\Local\Temp\RSQ7glru2kYlcKz.exe - 0d25ae5a79242facdef7a94e8715a573c7391f31773eeb60eab8fa3c5775ab31
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe - ab82fb69be993c86e27aa10e9a2a5fb603064c9cdd96a43716e6e91bb4bcb55f
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - a99dee6fc0f31dd27ee6b77f42f502249640929c855af6ea303f35e23edf1cc8
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe - 65eed20e987cc3c966b26c833d745c1ceeee5d6b1a6c26f9a5927bc1778d4594
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe - ae2c4e9ab440394d98d131152e09a6d74b46bebf40eb991027ea935faf60a27a
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - a5fbce903a132c2e294ae933bf0f6c68f26b973534f1b50e6400049b566c1d3d
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - c6f857a85a37fb2a5b569b8546ec47894a22fc965ff4774b81c1de442c04ef03
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe - 87b8eca58885a5c1f235db573b5a0f792947d59e11791caa651dc2a95dbeeb30
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - 0808cc01d39ec00083886096d1ef4dbdf8ded66ce8541a5c24bc76cdef7c35e8

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787876476&P2=404&P3=2&P4=TQl47UXJ0WBccOESe%2fOA712kZytQsOB8FcPqGkICnR2YJDwXui%2fm1PwzsbVi5ZxIucmauAeexL%2fvKZwvDizs3A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787876553&P2=404&P3=2&P4=Kdgrv6oH5GQ6uLDd2LHeG6m05OI3%2b5SScz1jd%2fQaasD9u7%2fGr1dmw%2fyT5xMfph%2b2II0xB6jEs8qK%2fs3hNe2hFg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.50.201.201
52.123.252.239
20.42.179.192
4.230.171.124
20.247.184.197
85.210.193.152
135.232.92.137
13.89.179.12
74.178.76.54
52.123.128.14
20.236.44.162
52.123.129.14
52.123.252.243
135.234.160.245
203.26.79.13
40.84.97.4
4.150.223.99
52.168.112.67
52.148.114.188
52.123.252.236
135.233.95.80
72.145.35.107
52.110.12.54
52.110.12.15

More Prepscram samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report