MALICIOUS — e4678770bb0b9a40aef07d8703965ca3a79da6f154393c22840c515722c75a0e

MALICIOUS — e4678770bb0b9a40aef07d8703965ca3a79da6f154393c22840c515722c75a0e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AutoRun family. 9 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: e4678770bb0b9a40aef07d8703965ca3a79da6f154393c22840c515722c75a0e
SHA-1: b7c26716748e247c33bbe85234ed9869152de3f6
MD5: ad6b719ae7a55234cb9b3a99e6543036
imphash: 5e6955ab958f0427686406bc5d4d6248
ssdeep: 24576:5lklfz8OCwRlG5rwEx/B5ewYsKUnNzO0LdXewKNnpzcuzW:2wOCrJBQCKMN7pXRKNnpzhW
TLSH: T10F5849CC461A6386D6F6CB692D148ADD146DB4D9507A394F1F83C03F62E3833A87A05B
Submitted as: e4678770bb0b9a40aef07d8703965ca3a79da6f154393c22840c515722c75a0e
File type: pe · Size: 1647848 bytes
Verdict: malicious (100/100) · Family: AutoRun

Detections (9 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Dqan-9885474-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Trojan:Win32/Tiggre!rfn
Kaspersky (KVRT): Worm.Win32.AutoRun.vx

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Malware.Dqan-9885474-0 (rule Win.Malware.Dqan-9885474-0) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Tiggre!rfn (rule Trojan:Win32/Tiggre!rfn) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Worm.Win32.AutoRun.vx (rule Worm.Win32.AutoRun.vx) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.50, confidence 0.70
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.30, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60
Memory forensics: 4 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in SppExtComObj.E (pid 6084) (rule windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/windows0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://schemas.microsoft.com/appx/2010/manifest
http://schemas.microsoft.com/appv/2010/manifest
http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com/0
http://office.microsoft.com
http://www.microsoft.com/pki/certs/CSPCA.crt0
http://www.microsoft.com/pki/certs/tspca.crt0
http://schemas.microsoft.com/appv/2010/deploymentconfiguration
http://schemas.microsoft.com/appv/201
http://sqm.microsoft.com/sqm/WindowsLive/sqmserver.dll
http://go.microsoft.com/fwlink/?LinkId=619651
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

www.microsoft.com
crl.microsoft.com
schemas.microsoft.com
office.microsoft.com
sqm.microsoft.com
microsoft.com
go.microsoft.com
outlook.network

Embedded IP addresses

4.150.223.108
4.144.132.223
4.230.171.124
40.84.97.4
74.178.76.128
20.89.1.8
4.247.188.224
74.178.240.51
52.123.252.248
172.66.2.5
52.110.12.50
52.110.12.54
104.18.33.89

File paths

e:\bt\1118478\client\onedrive\product\filecoauth\filecoauth\syncenginefileinfoprovider.cpp
e:\bt\1118478\client\onedrive\product\filecoauth\filecoauth\storageproviderfinder.cpp
e:\bt\1118478\client\onedrive\product\ux\shared\runningobjecttablehelper.cpp
e:\bt\1118478\client\onedrive\product\ux\shared\utilities.cpp
X:\:`:d:h:l:p:t:x:
D:\:l:p:
J:\:
d:\dbs\el\oc\target\x86\ship\postc2r\x-none\onenotem.pdb
F:\Office\Target\x86\ship\postc2r\x-none\msoxmled.pdb
C:\Loggers\MyLogger.dll;OutputAsHTML
C:\My.dll
C:\Logger.dll
f:\dd\tools\devdiv\FinalPublicKey.snk
f:\dd\vsproject\xmake\XMakeCommandLine\objr\i386\MSBuild.pdb
d:\dbs\el\oc\target\x86\ship\click2run\x-none\perfboost.pdb
T:\:d:l:t:
X:\:`:h:l:p:t:x:
X:\:t:
T:\:
e:\bt\1118478\client\onedrive\product\ux\shared\win32api.cpp
e:\bt\1118478\client\onedrive\product\ux\shared\watsonreport.cpp

More AutoRun samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report