MALICIOUS — c4412b204dc0647602a83aa1ef448a8e7639c357571ea2f1d0c408c10d77ae8c

MALICIOUS — c4412b204dc0647602a83aa1ef448a8e7639c357571ea2f1d0c408c10d77ae8c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepscram family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: c4412b204dc0647602a83aa1ef448a8e7639c357571ea2f1d0c408c10d77ae8c
SHA-1: 34c72848cf6baf08166a6c3eb2e2757c22c36900
MD5: 24c455780bc662a8028b8e2ba4f17e55
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 6144:SwKI9Eqrh591Pe9EP7UNX6vR3czk20yP2BVtNb4L:SwKI9fhX1lzkXDzk20yP2BJb4L
TLSH: T1D644233639809FE3E0C69A587C79A41FED2F27CF181EF58E2DB5BA053C809271990459
Submitted as: c4412b204dc0647602a83aa1ef448a8e7639c357571ea2f1d0c408c10d77ae8c
File type: pe · Size: 244970 bytes
Verdict: malicious (100/100) · Family: Prepscram

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Prepscram): CTS.exe - dynamic signal, weight 0.62, confidence 0.90
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 28 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

2349 behavior events · 1 ATT&CK techniques · 17 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe - fe5953d1c58c81db3f07d8861e77878dabdb62471937b48aa18ab5cf387bbdd1
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe - 0485e3a21688fbec795d9a5dc899da080acd465489e75b0fa9b108aecf52d183
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - a0d77c820c28a804b319022a0b3a9508c9dcf6a4a4fe89b53282af3d7b8cca2d
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - 197caf3210bddd7275d814d797cbbe8a62ec1ebfc64b1779dd2df771c7fa9ffe
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe - 342a3b6a25e027f415bae8aa1551015b22a872076944754862ef482127f6cd42
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - 55f2a81295f1d180e5c428a429ab004ce64d4c12c8a7f1edb8782212fb697917
C:\Windows\CTS.exe - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - e5476765dc609b1f617dd08a029988dfc32021b0d5b8345f12a8bf726d1ccda2
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe - 337b9c5a1608dfcc8decf1221ca75160826726baf8fe2cdf165583d83a671896
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - 94337dadd976ae532359b631778bd273bb97607485af15437f56976b09f6a13f
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - 8e98e876280d7a103b3ae10a006c968c8868a2f14d483ec8457749ab4765e723
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe - c2840f3bd57a0e13ed929a2656082991c06a8d53a51f9b1e900bb8d7e46d341a
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - 3883c4466bfe3114ba5ccee40c82b7fc2bb0ea17c9f8c260fe6408a5f754f06c
C:\Users\analyst\AppData\Local\Temp\ijkJDO0FB5fZZ3l.exe - 78a74bdb0b9adca78f3225605c6a383a7da27692b519f31ad43e21ff5a01e803
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - d86e382a89fbfa0cb5c42ec4c36e5a2d325d352d1ff67bccaa01517d23ce33ea

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787806286&P2=404&P3=2&P4=Fm6HgIYRFAuDzrJVFJOGV2uWLBHP%2bZJvGYNtqkPN8%2fY%2bh0u4U8lQB6D%2biGxgLcbM%2bucBIiKQhWsYcg%2b0JHOLgA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787806354&P2=404&P3=2&P4=gXLk9OKEYZpBl%2f1lLm%2fHA51n41KIde4mtu7V44Bn88aAkpTsAmr4yRdQPgkswL1EwwfA6ouYS0G2Ys6htQZHVw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

13.89.179.15
4.144.132.223
20.165.94.63
172.215.188.232
135.233.95.135
52.182.143.212
40.79.197.34
20.231.239.246
52.123.128.14
52.123.129.14
172.66.2.5
40.99.134.2
4.230.171.124
203.26.79.13
135.233.45.223
52.110.12.44
52.110.12.16
52.148.114.188
74.178.232.29
20.184.175.4
20.42.65.84
125.56.205.34
125.56.205.32
72.153.5.140
52.123.252.235

More Prepscram samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report