MALICIOUS — e5c738a3d1fb71a9a688e111b5907e5e4c0c4382e9da33d426d19b0572d2a098

MALICIOUS — e5c738a3d1fb71a9a688e111b5907e5e4c0c4382e9da33d426d19b0572d2a098 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepscram family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: e5c738a3d1fb71a9a688e111b5907e5e4c0c4382e9da33d426d19b0572d2a098
SHA-1: d1c840d5712ff2862eba6f04c419c21412163ab5
MD5: 4eedb4b0eb91db2e9ff9664f5f968b47
imphash: f1a539a5b71ad53ac586f053145f08ec
ssdeep: 768:eyX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIozzgT4JgBQa5cGEjy4ytG9z:egKcR4mjD9r82MrJeFftM
TLSH: T11231F178B875E30CE7317E1C60CDEABD90725D8A8955C1E31AB15509B878077C3EAEA0
Submitted as: e5c738a3d1fb71a9a688e111b5907e5e4c0c4382e9da33d426d19b0572d2a098
File type: pe · Size: 42341 bytes
Verdict: malicious (100/100) · Family: Prepscram

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Zusy-9957983-0
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Trojan:Win32/Prepscram!pz
Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25
Kaspersky (KVRT): Trojan.Win32.Agent.neyndy

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Prepscram): CTS.exe - dynamic signal, weight 0.62, confidence 0.90
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 21 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

2373 behavior events · 1 ATT&CK techniques · 17 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe - de4f52897e1eb91afc9318f1e87a1597f72dc235e1ad1e5104cc8364d50e4333
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - 9a5b702d4ffd703cacd98b55b7a9a4e1db0bdb2e9d3f7c2f354af99267a42ef8
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - cd5946be0561a5b8ac9dd499975bdd6b72fc4fa93a83a69d2d1be3434eada6b0
C:\Windows\CTS.exe - b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe - d2ba68c4a3e70017e59b6931c18d3087608520e74b7d7d4dee8c25e4088dfc04
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe - 54b9437856f1d41d22944ae8204c57a67740082776c48ae611b620959092501b
C:\Users\analyst\AppData\Local\Temp\KbCmNpfXQfRDmTJ.exe - 4126f9459178e2f280796580553fed45198ef74812ee414b9d277de822ee3b7a
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - 4419be1b2c4fa7a0b2806db8b321769f2ee8a7d74873b3e3fe5f0cfd3e07132e
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - 04fc297d0c450f3f623b6474cc46067147cff674b48b2f361f16e2c63ac92a90
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - 497f30866a400359dc05d62f40c543216872c049ab6c08722addc1e83b2b1df3
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - df390b98c0043e9a510351b70724e5331bd1205d7f42f50f88435c4d3c4785d4
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - 50b4a71b2f5528c98f68adada0591c176bf2082262766216545298d771543d4b
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe - 6773b4de56ad13bb8a0bbd73e791e3a0c9298643451a58de0b4df884900b163b
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe - ee5f825c6119e45b1b38e745d825196ce5a4017847a62ea6d1b127c1c0711750
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - 06ebe05d689bc73cd9b3f57d9493728bbcc93ea7357248866f63bf3fb7b697b6

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787901946&P2=404&P3=2&P4=A3tajZckl63FXun4NdiHlM%2f%2fvxIRZe6a4606ARaHFY%2f%2fNfF4qAFv3HhOpdZJa2OWAxWelxe5DzVtkPttbXVE0w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787901967&P2=404&P3=2&P4=I7bX0I0Iv%2bbgO9zbRw42fhZb89kRI1KsoL5WbF8TKNEN3Fw%2fxCHzSktkuA0j2QW8hgn%2f7cgcyQKlP8qAdZ2Fbg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.42.73.28
48.211.4.16
4.230.171.124
20.247.184.142
20.165.94.46
20.165.94.63
20.165.94.54
4.150.223.97
203.26.79.13
4.150.223.103
20.112.250.133
52.123.128.14
52.123.129.14
135.234.160.245
52.110.12.50
52.110.12.33
52.148.114.188
72.154.7.99
92.223.78.30
52.110.12.38
52.110.12.31

More Prepscram samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report