MALICIOUS — d1e8acef644530548695eb19aad60cbf4204ed75b79c66c70e855b52a0832ee3

MALICIOUS — d1e8acef644530548695eb19aad60cbf4204ed75b79c66c70e855b52a0832ee3 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100), attributed to the RiskTool family. 2 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: d1e8acef644530548695eb19aad60cbf4204ed75b79c66c70e855b52a0832ee3
SHA-1: a69d6e1a97614b219478445e6a68b3faaf946db5
MD5: 189d4d70dfe7ead230abba6f9eb96cfd
imphash: 027ea80e8125c6dda271246922d4c3b0
ssdeep: 49152:6yZlRbHQO3bE7mNGNmwq8obrm+bE7mNGNmk1:jRbHl3gBgwq8ofm+gBgk1
TLSH: T1245A028D0F172B42CFF2E5801C35AD8E5A21F69E523D28545286803E36E36B7ED3591B
Submitted as: d1e8acef644530548695eb19aad60cbf4204ed75b79c66c70e855b52a0832ee3
File type: pe · Size: 2135616 bytes
Verdict: malicious (92/100) · Family: RiskTool

Detections (2 of 56 engines)

Microsoft Defender: HackTool:Win32/crack
Kaspersky (KVRT): not-a-virus:RiskTool.Win32.Cmdow.a

MITRE ATT&CK

Why this verdict

The malicious score of 92/100 is the fusion of 7 weighted signals:

Microsoft Defender flagged HackTool:Win32/crack (rule HackTool:Win32/crack) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged not-a-virus:RiskTool.Win32.Cmdow.a (rule not-a-virus:RiskTool.Win32.Cmdow.a) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

7495 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT - b1313dd95eaf63f33f86f72f09e2ecd700d11159a8693210c37470fcb84038f7
ca517a62cc4bd322c4afb74599b3f4a6f414d0fb6f750eae56a0d9c95d997f49 - ca517a62cc4bd322c4afb74599b3f4a6f414d0fb6f750eae56a0d9c95d997f49
03aa8e39b80817938fb6cb6f83e671e3a5156ec662464cbf41f5ee140246e533 - 03aa8e39b80817938fb6cb6f83e671e3a5156ec662464cbf41f5ee140246e533

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

to9.uk
schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.109
4.230.171.124
172.215.188.225
52.253.84.76
85.210.196.11
20.50.73.5
20.165.94.54
135.233.95.144
104.18.33.89
20.184.175.20
52.110.12.52
52.110.12.32
172.178.240.162
20.42.65.91
52.148.114.188
72.153.5.61
92.223.78.30
52.110.12.44
52.110.12.24

File paths

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
X:\:
X:\:`:h:p:t:x:

More RiskTool samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report