MALICIOUS — e47442ed1c0f10527a482b542c519d6855061ef47fa9b7bf55981f47842242a3

MALICIOUS — e47442ed1c0f10527a482b542c519d6855061ef47fa9b7bf55981f47842242a3 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100). 5 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: e47442ed1c0f10527a482b542c519d6855061ef47fa9b7bf55981f47842242a3
SHA-1: 54b44d38a4e82f2a335ad166b8a160d190ad137a
MD5: 58436319218994a492746a54e47127d3
imphash: 77812cb581f98af0bfd5873c43c70ba4
ssdeep: 3072:EQmEfI+rQmtH8fI+vQmofI+FQmEfI+rQmtS:tPpH8PgPWPpS
TLSH: T14243D4CE2DA09D8FC1B889912904A91D4FE74DE21A79645CC6E6902F4DFBCFB543013A
Submitted as: e47442ed1c0f10527a482b542c519d6855061ef47fa9b7bf55981f47842242a3
File type: pe · Size: 237091 bytes
Verdict: malicious (100/100)

Detections (5 of 56 engines)

ClamAV (daily): Win.Trojan.Agent-1388714
Microsoft Defender: Worm:Win32/AutoRun!pz
Emsisoft (Emergency Kit): Worm.AutoRun.1
Trellix Stinger (McAfee): W32/Autorun.worm.fb
Kaspersky (KVRT): Trojan.Win32.Fsysna.akyk

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Trojan.Agent-1388714 (rule Win.Trojan.Agent-1388714) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Worm:Win32/AutoRun!pz (rule Worm:Win32/AutoRun!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Worm.AutoRun.1 (rule Worm.AutoRun.1) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/Autorun.worm.fb (rule W32/Autorun.worm.fb) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Fsysna.akyk (rule Trojan.Win32.Fsysna.akyk) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Dropped a suspicious payload (HUILoader): Msvbvm60.dll - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

149131 behavior events · 2 ATT&CK techniques · 9 dropped files.

Dropped files

C:\Windows\SysWOW64\Drivers\Msvbvm60.dll - 898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
C:\Windows\AE 0124 BE.exe - b4dba2d339efb967c982d6675cab60a647b523174cb4f498fb8bb86c890facd2
C:\B1uv3nth3x1.diz - 564815feb9c5bdadb145cd0d16738c4e5fbc6a46cf65c62ac6a985c43d1939e8
C:\Users\analyst\AppData\Local\Temp\wct51ED.tmp - 8741f67f52af57f9b924e0534c51d5658f1fb4e035dd0e3b04f472e454b98d6b
C:\Users\analyst\AppData\Local\Temp\8c500f99-ba3c-4d30-967c-d9bdfa0f501f.tmp - 665934b31c81bbfdd91652855f0e583d73ad4eb0ff05b108a2fe5bd9613b63a3
C:\Users\analyst\AppData\Local\Temp\wct2C7C.tmp - a1864fbd4681dac5ee8f6f1c61bbd5004c71cb2af1ec1006fdbeb55ade536af9
C:\Users\analyst\AppData\Local\Temp\wmsetup.log - b11630055c84537e8859368be34c50cda8d82b8db9a15082ef95f4fd68c7b155
C:\Windows\AE 0124 BE.gif - c6988504d0d9f11a0a016204db152692667d47c16d83a07049ef8c0a4bac5165
C:\Autorun.inf - bd6ba26ee8245ec0ebc94141554879c59d6aecfca9ba8ce7766b7d949dd3d4ba

Embedded URLs

http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://ns.adobe.com/iX/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

ns.adobe.com
www.w3.org
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.168.112.66
52.230.60.54
52.123.252.213
4.230.171.124
135.234.160.246
20.42.179.204
52.110.12.37
52.110.12.55
52.148.114.188
57.155.104.224
72.154.7.103
52.110.12.15
52.110.12.2

File paths

C:\Program
c:\B1uv3nth3x1.diz

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report