MALICIOUS — e66ff027917eca61064e3086294fb3ca596fcb56ae40b825fd8dc3156551a0a8

MALICIOUS — e66ff027917eca61064e3086294fb3ca596fcb56ae40b825fd8dc3156551a0a8 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AutoRun family. 10 of 55 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

SHA-256: e66ff027917eca61064e3086294fb3ca596fcb56ae40b825fd8dc3156551a0a8
SHA-1: 4241740ba4071eec88084897936fe66537766f9a
MD5: c7051321ab6e1ad9711d3eb38b482e61
imphash: 01392ca861cf87b8d28ad9ea90016bb4
ssdeep: 49152:++buog/TXJwOZ4rRokpzA0vbMZqhaK6zbfqdl:++k4rRoklAOQx
TLSH: T1DB5CBFCE40093761EAB6D7241DA0ADAD9012B0D954BD7B4C9783C97E10E5C37E9B80EB
Submitted as: e66ff027917eca61064e3086294fb3ca596fcb56ae40b825fd8dc3156551a0a8
File type: pe · Size: 2473660 bytes
Verdict: malicious (100/100) · Family: AutoRun

Detections (10 of 55 engines)

capa (capabilities): capability:credential-access
MalwareAnalyser heuristics (entropy/packer): ASPack
ClamAV (daily): Win.Worm.Vindor-9886047-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Worm:Win32/AutoRun!pz
Emsisoft (Emergency Kit): Gen:Heur.Mint.Autorunner.1
Trellix Stinger (McAfee): W32/Worm-GBW!C7051321AB6E
Kaspersky (KVRT): Worm.Win32.AutoRun.vx

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Worm.Vindor-9886047-0 (rule Win.Worm.Vindor-9886047-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 25 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.symauth.com/cps0, http://www.symauth.com/rpa04, http://www.symauth.com/cps09 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: ASPack, high-entropy-sections:.text, Microsoft Linker - static signal, weight 0.25, confidence 0.55
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 26 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

26707 behavior events · 1 ATT&CK techniques · 27 dropped files.

Dropped files

C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jfr.exe - 3e27cc6407fc7d7b6e26495c6ff849c23cf3b6e9c8a885ea742ad7b3109af536
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\ktab.exe - 51e57fdf672acec905dc11fb467293a6c1251683cb92e769d451e46b9e0e92d6
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jfr.exe - 617b17b95ccd5493b2507dede1c17089588240d53220cdf31566c1de118609bf
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jrunscript.exe - 3c6d62569a6dbad19d57ab33039ea0626a3eaf4386fa8b207c136957b26005ab
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jabswitch.exe - c4c65264e0d3b9b31c5262259ec4b8af6ec62a1fff918a98910aabf17f015959
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jabswitch.exe - 63d3001e3b1c7f7054e6c5d62edee8ba77a3a4f55f356907dc496be00c3eac47
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\java.exe - 8c435a45123e88410f42259fcb3b303b5f60ce00e01d8d4a9c5bd342bf51e184
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\keytool.exe - 599e533da3261e2fc678ccc3393bb90cafa7ce620196168b9c5cb41a4e48099b
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\keytool.exe - 7fc5fe333051b566666374534e505e79e1ecf0cd94f33150a8fe9ce86fff649f
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccessinspector.exe - a7487ee88d94f322148489c818cc861ee1e77ec31ce5b5e7b5e999c0d5acf6f6
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccessinspector.exe - 1c8a5fee5b716372ad5f619ce46c900c4d58cdcebb7f0f328a2c73f2731f4b20
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\javaw.exe - 00293b1fc4c093b570c7a9433fb5b16b188e938061cacf6f7a35721a6f346acb
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\javaw.exe - e396430b509232fe90d0bd02ec7ac3108ef95f01e0b6afa6163ace511f94c585
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\klist.exe - 8af42d0233ad670962b54626ae505c400f33e16869a8caecf37e37dab6454e47

Embedded URLs

http://www.adobe.com/go/learn_fp_settings_privacy_controls_en
http://www.adobe.com/go/learn_fp_settings_trusted_locations_en
http://www.adobe.com/go/learn_fp_settings_peer_assisted_networking_en
http://www.adobe.com/go/learn_fp_settings_protected_content_en
http://www.adobe.com/go/learn_fp_settings_private_browsing_en
http://www.adobe.com/go/learn_fp_settings_storage_en
http://www.adobe.com/go/learn_fp_settings_camera_and_mic_en
http://www.adobe.com/go/learn_fp_settings_playback_en
http://www.adobe.com/go/learn_fp_settings_advanced_en
https://www.adobe.com/go/flash-player-updates
https://get3.adobe.com/flashplayer/update/osx
https://get3.adobe.com/flashplayer/update/ppapiosx
http://www.adobe.com/go/learn_fp_settings_chromium_en
http://www.adobe.com/go/fp_learn_more_usage_data
http://www.adobe.com/go/learn_fp_settings_privacy_controls_cz
http://www.adobe.com/go/learn_fp_settings_trusted_locations_cz
http://www.adobe.com/go/learn_fp_settings_peer_assisted_networking_cz
http://www.adobe.com/go/learn_fp_settings_protected_content_cz
http://www.adobe.com/go/learn_fp_settings_private_browsing_cz
http://www.adobe.com/go/learn_fp_settings_storage_cz
http://www.adobe.com/go/learn_fp_settings_camera_and_mic_cz
http://www.adobe.com/go/learn_fp_settings_playback_cz
http://www.adobe.com/go/learn_fp_settings_advanced_cz
https://www.adobe.com/go/flash-player-updates-cz
https://get3.adobe.com/cz/flashplayer/update/osx

Embedded domains

macromedia.com
www.adobe.com
get3.adobe.com
adobe.com
www.microsoft.com
crl.microsoft.com
armmf.adobe.com
crl.thawte.com
ts-aia.ws.symantec.com
ts-crl.ws.symantec.com
crl.verisign.com
www.verisign.com
logo.verisign.com
www.symauth.com
evcs-crl.ws.symantec.com
evcs-aia.ws.symantec.com
crash-reports.mozilla.com
schemas.microsoft.com
www.digicert.com
cacerts.digicert.com
crl3.digicert.com
crl4.digicert.com

Embedded IP addresses

1.7.2.0
52.123.252.212
20.42.73.30
20.42.179.192
4.144.132.223
4.230.171.124
135.232.92.34
135.233.95.144
203.26.79.13
74.178.240.51
74.178.240.61
20.236.44.162
52.123.129.14
52.123.128.14
20.42.73.26
135.233.45.223
52.148.114.188
20.42.65.89
51.132.193.104
72.153.5.141
172.215.188.232
48.211.4.16
172.172.255.218
52.168.117.168
52.110.12.22

Registry keys

HKEY_CLASSES_ROOT\Software\Adobe\Acrobat\Exe
HKLM\SOFTWARE\RegisteredApplications

File paths

E:\r\ws\St_Make\code\build\win\results\FlashPlayerApp\Release\Win32\FlashPlayerApp.pdb
X:\:`:d:h:l:p:t:x:
T:\:d:l:t:
f:\CB\ARM_Sustaining\BuildResults\bin\Win32\Release\AdobeARMHelper.pdb
X:\:`:
X:\:`:d:h:l:p:@;D;H;L;P;T;X;\;`;
X:\:`:d:h:p:t:x:
T:\:h:
c:\builds\moz2_slave\rel-m-rel-w32_bld-000000000000\build\obj-firefox\browser\app\firefox.pdb
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin1.inl
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl

More AutoRun samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report