MALICIOUS — c4339d0038c939b3340754566c40a2d6329da0918c2fa1e0be7696eab125a672

MALICIOUS — c4339d0038c939b3340754566c40a2d6329da0918c2fa1e0be7696eab125a672 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepscram family. 6 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: c4339d0038c939b3340754566c40a2d6329da0918c2fa1e0be7696eab125a672
SHA-1: 024585902c2f6a833c82b49e1177bc8878bb5b76
MD5: 2d49483b85c72d4ab3ec124b5a0e1a3f
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 768:eyX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIoBJKNSU2qH23LSz+kkBALHCY/Oe:egKcR4mjD9r82kKY32zFkGrWkyA
TLSH: T1A432F1753422C34CD3B4FF0820CD9AEDD613EC0E18E65A6B4DB0558A6C558B78AF2724
Submitted as: c4339d0038c939b3340754566c40a2d6329da0918c2fa1e0be7696eab125a672
File type: pe · Size: 44136 bytes
Verdict: malicious (100/100) · Family: Prepscram

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Virus.8
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Prepscram): CTS.exe - dynamic signal, weight 0.62, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) and 22 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

8044 behavior events · 3 ATT&CK techniques · 17 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - 2be75cf3d42b268e5578e31eec0a42dfc256bd60e17939e5c3d67a32adc32bc2
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - 052b9558320c4053c273400b909a191c664feb2e3862cd4643138195cf9b5237
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - 6d1ef9ae7dac59854a7133d7d04f16c40ce917a9b7e9e4424c57ab238c92c9d8
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - 05ea46d2a954d54a7f4f6cb01a1e2c6bfa6baa00d25017c679dcf981b4dbd2c9
C:\Users\analyst\AppData\Local\Temp\tKk9N3QcdOj8E1Y.exe - 6869e1f45a5ebf8e4f7b177a37c3edd5ec615c22863c4388c232cdcc1de1dfab
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - b8654b61085b95840601cb9818d0b64bb5fec23374e02ae66f959195be7ce752
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - bf53fcb851c8293dd922326fcdaa3d8c4a3fabbcec8cf15a2edf3460a1209807
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - 32f934ac6bcb38b8328a7b8ed35e6d712786c8c79a5774399c21641b35794536
C:\Windows\CTS.exe - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe - 45f87cf946567ed46399e507bb510225262e33b2d568d6237536df90d0af8242
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe - 28171dd4dd775fdb4f4fd5608f1067d293d164b1728a091889534e2849fa92b6
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe - 4cf053c953c5ec67a5459d0df59dea666c4387a88472a0e32af63d03827d50dd
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe - d457c704b15ad5bc23f0fa7427538681dc20683812618ba1730f817125859ee2
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - 63225b397e8c386e4b3d745be756e2cf14db0081f241cfd98a552daba1549b34
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe - 260b7eaca7b6711ebef2c9fd96d82208e60f3e22240a2c859eaebc15a8ca8d1e

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787946665&P2=404&P3=2&P4=GNL5nxWF37o57gLMGdKBz%2f2oqQiRFsliAq8TFxwyK3%2bCfOaFkuUFvib1OgW8KIgiVl07pjWDyi2pypYSL9oe4g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787946736&P2=404&P3=2&P4=dkFrq3hZJpD%2byYBsovJP0BED9vuWjlHvDRh0xmjpkSEsbdbabGn9yGpzORUpFIRN0%2b81EYhdU7vvrb%2fAvQ1Gpg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

51.116.246.105
57.155.104.224
4.230.171.124
52.253.84.76
135.233.95.144
74.178.240.51
20.42.65.90
20.76.201.171
40.103.64.242
52.123.129.14
52.123.128.14
172.178.240.162
203.26.79.13
92.223.78.30
52.148.114.188
135.234.160.245
52.123.252.241
74.178.232.29
72.154.7.113
52.110.12.54
52.110.12.46
20.184.175.17
51.105.71.136
52.110.12.2
52.110.12.55

More Prepscram samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report