MALICIOUS — de248b94713befb8f5abe74a1c22ab0b5d09f9ec60a28db36d4eb08374e62fdf

MALICIOUS — de248b94713befb8f5abe74a1c22ab0b5d09f9ec60a28db36d4eb08374e62fdf is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepscram family. 6 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: de248b94713befb8f5abe74a1c22ab0b5d09f9ec60a28db36d4eb08374e62fdf
SHA-1: f2e7631f0a90493a0bc7da34e54401b2af468831
MD5: fed9c1e865b81ff5972d4a0a8b74f4f4
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 768:eyX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIoFZbeIkcreojbzSU1iAjH2YFv:egKcR4mjD9r82WleIkcvbu271
TLSH: T15F32F130B273D384E72EFC0C60C89BBDD016198A08DA5A571AA0594AAC653BFC5E6771
Submitted as: de248b94713befb8f5abe74a1c22ab0b5d09f9ec60a28db36d4eb08374e62fdf
File type: pe · Size: 44136 bytes
Verdict: malicious (100/100) · Family: Prepscram

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Virus.8
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Dropped a malicious payload (Prepscram): CTS.exe - dynamic signal, weight 0.62, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Prepscram!pz (rule Trojan:Win32/Prepscram!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Virus.8 (rule Gen:Variant.Virus.8) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Agent.neyndy (rule Trojan.Win32.Agent.neyndy) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 9 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

7221 behavior events · 3 ATT&CK techniques · 32 dropped files.

Dropped files

C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EDCF682921FE94F4A02A43CD1A28E6B - 4770dc8005ef5a574cb6f1f0f80a96769230a4ac1bc154def2cb77dadec881f2
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\Microsoft.SharePoint.NativeMessagingClient.exe - 78b5f5ab54014fefa2e30961d9ecc057325ef9852f7b2e52a946a71eb9f63422
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8E4E510F44A56B8C8ECFEC352907C373_411140098D71F028134E9B8A21255C61 - ee8afff128e2b64b38d3f871123b59b5a2fa3f121a2962d3622d3a47be1f887c
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - ba04530932777a2a2f72812bc73501362a2edb9b2297fa6a28cc61488e9fb212
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\FileSyncConfig.exe - 8aa2611727247374596916b11bf721427b7cf42a23ca61db8746853ee41fcbf9
C:\Windows\CTS.exe - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - 191ba1fe02a8115f43a0e9333e6b504a84f4b5f780251bfc08c8232583dfab85
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - 4fef271e0455bb5f649ca0391977f70f6cb55c6126aebbb302d1141947e61972
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\FileCoAuth.exe - a5b77e41db2b9e732b4141d925c64d7e1b3402a6981ad0b5b989c86c4904c0ff
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe - 3c9e5787886148c759a0023d2503ad6b5b6993d3decc5954e51a203db1b19d65
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - db348519f990204c3dbcc5c65bd83c39a09220c26a13ad6ac6c5379dc136f1cb
C:\Users\analyst\AppData\Local\Temp\Msw75Cx8Pz5V5eh.exe - 13c921999e5ff273007a610a8521bbc77d884b41d9cbbd41e045b3497909659c
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - 5726039f498d611863bc42f06a75acc662045c333ea005cb63b0578bfbb7b98f
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - c031e55e37d74fb3a898d68b0f17413f075cc6f0599d84ae6080af2ffea41fce
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - c019dbd41d79151f29535892f5c9665a0ccada8f29e3f4aa75a2c3a357e256e8

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D
http://th.symcb.com/th.crl
http://203.26.79.13/filestreamingservice//files/89c77c08-6078-44b6-8f27-85720154df65/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/89c77c08-6078-44b6-8f27-85720154df65?P1=1788023174&P2=404&P3=2&P4=bPM%2fhZ9haFydUdfr2PCaw2ztw3InZxYUI1eeSPvvw84d20qSTzP%2bprhjf8vfzm8weVFbQjS9MLMdZG7Pu0RIrA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

52.168.112.67
20.247.185.124
4.230.171.124
74.179.77.164
20.42.73.30
85.210.193.152
20.165.94.63
104.46.162.231
20.42.65.85
135.232.92.34
203.26.79.13
52.110.12.11
52.110.12.38
52.110.12.56
52.110.12.55
52.148.114.188
72.154.7.97

More Prepscram samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report