MALICIOUS — e6772c0aef5547205db1e5e70cddc963a91141435104e0d42dd2eca90059599a

MALICIOUS — e6772c0aef5547205db1e5e70cddc963a91141435104e0d42dd2eca90059599a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the PolyRansom family. 6 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: e6772c0aef5547205db1e5e70cddc963a91141435104e0d42dd2eca90059599a
SHA-1: d8090472779d95865e8dbc42cac61d6f4593a22f
MD5: 04842117dd78cd968841d44fe91e0812
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 12288:VMgLHnMJbStJvXkeryrqlmPox4cZE0OXrZAI8FZUaDhaMFWEL9cHknfe4iw1EXgI:Vnp7OGQcZyXFAVFZr4Afe4iwC9/PT
TLSH: T15658BC91D1FBAA2809D8967CA4D0B5110C14374FFA853A0EF7DE4CDA2D059D68087BAF
Submitted as: e6772c0aef5547205db1e5e70cddc963a91141435104e0d42dd2eca90059599a
File type: pe · Size: 1767424 bytes
Verdict: malicious (100/100) · Family: PolyRansom

Detections (6 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): BC.Win.Virus.Ransom-9157.B
Kaspersky (KVRT): Virus.Win32.PolyRansom.a
Microsoft Defender: Trojan:Win32/NabucurObfs
Emsisoft (Emergency Kit): Win32.Virlock.Gen.5
Trellix Stinger (McAfee): W32/VirRansom

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged BC.Win.Virus.Ransom-9157.B (rule BC.Win.Virus.Ransom-9157.B) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload: bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - dynamic signal, weight 0.80, confidence 0.90
Kaspersky (KVRT) flagged Virus.Win32.PolyRansom.a (rule Virus.Win32.PolyRansom.a) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 35 external host(s) at runtime (17 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

38897 behavior events · 2 ATT&CK techniques · 41 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/7434/files/fad38b248c38320b36690e66ee628c71843278c2f8105170a6a93d6e432a753c - fad38b248c38320b36690e66ee628c71843278c2f8105170a6a93d6e432a753c
/opt/CAPEv2/storage/analyses/7434/files/103a42a6c08821b2a31ff659e1f582fe4fb633d6386e9c024714c53e3e072aee - 103a42a6c08821b2a31ff659e1f582fe4fb633d6386e9c024714c53e3e072aee
/opt/CAPEv2/storage/analyses/7434/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
/opt/CAPEv2/storage/analyses/7434/files/ab6e1e75d864c0bcc7d07a2144d42c7daa671d810d0a199d9453c83419365512 - ab6e1e75d864c0bcc7d07a2144d42c7daa671d810d0a199d9453c83419365512
/opt/CAPEv2/storage/analyses/7434/files/d1e75b7f045ba53d11c1ad893857d785e05293b3644562dedc617eea87e1db0c - d1e75b7f045ba53d11c1ad893857d785e05293b3644562dedc617eea87e1db0c
/opt/CAPEv2/storage/analyses/7434/files/6be2c4eb2fe3249d0945216be20363dc9fe32a48a80bc08314bef988d6101ac2 - 6be2c4eb2fe3249d0945216be20363dc9fe32a48a80bc08314bef988d6101ac2
/opt/CAPEv2/storage/analyses/7434/files/f75aeba534cef7c54952725fa6c7a4f9337516134c5490a069ca08479b241897 - f75aeba534cef7c54952725fa6c7a4f9337516134c5490a069ca08479b241897
/opt/CAPEv2/storage/analyses/7434/files/67cf9a2017a9a7e337cd846388b4ff9f7e02b66b4f775724c09ac84e4613986e - 67cf9a2017a9a7e337cd846388b4ff9f7e02b66b4f775724c09ac84e4613986e
/opt/CAPEv2/storage/analyses/7434/files/684681b7aeafe1e480f91a22b064705cee2a551423f8b2f7189e6a50114bffe8 - 684681b7aeafe1e480f91a22b064705cee2a551423f8b2f7189e6a50114bffe8
/opt/CAPEv2/storage/analyses/7434/files/3dae5e81e0963d4402babb811803bda1b14a084888e76d3b8a453dfe890dd409 - 3dae5e81e0963d4402babb811803bda1b14a084888e76d3b8a453dfe890dd409
/opt/CAPEv2/storage/analyses/7434/files/ff7e03162e868a295ea3962c85b0a126b43a11db350016af5bc4e4372640b3e1 - ff7e03162e868a295ea3962c85b0a126b43a11db350016af5bc4e4372640b3e1
/opt/CAPEv2/storage/analyses/7434/files/81bac677e834253ae60125ed1be64b1ed0cf25adacaee3fd70a4000b8d5bd508 - 81bac677e834253ae60125ed1be64b1ed0cf25adacaee3fd70a4000b8d5bd508
/opt/CAPEv2/storage/analyses/7434/files/cb744dca57388acbee3fd133cf076b2a56c7ae81f508f39957e981bcf06eb07d - cb744dca57388acbee3fd133cf076b2a56c7ae81f508f39957e981bcf06eb07d
/opt/CAPEv2/storage/analyses/7434/files/17e4efe3c8a69cc49d19a26f00c5468465c4feb9bf3af6139d52bcf598325dcf - 17e4efe3c8a69cc49d19a26f00c5468465c4feb9bf3af6139d52bcf598325dcf
/opt/CAPEv2/storage/analyses/7434/files/0d7ec26a3f44f8eb98856dda73c188ba45f7664d68663365ff290187113d7fe7 - 0d7ec26a3f44f8eb98856dda73c188ba45f7664d68663365ff290187113d7fe7

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786268815&P2=404&P3=2&P4=MkE7xYulTwFurHVd47QmRHywtAOPfiQ6AuaQ0PmBdJenyvz0DoYPIfLWzJavsLXbwpAojfSqO%2fO6AobFvcJNAw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://google.com/
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786268866&P2=404&P3=2&P4=aZDtqxUNFpHQXqjV%2fFVV2FmeIVqYBL3sxuT9CzyuvzvvlRWasMoCQDEeNpJPLo7jte%2bYp6zSBo2AVK0GvxUk8A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.42.73.26
52.123.252.243
4.144.132.114
4.230.171.124
40.84.85.40
74.178.232.29
135.232.92.97
135.232.92.137
4.150.223.102
203.26.79.13
172.178.240.163
200.87.164.69
200.119.204.12
190.186.45.170
20.42.73.31
51.132.193.104
172.215.188.232
72.145.35.111
52.148.114.188
142.251.222.14
142.250.195.238
52.110.12.2
52.110.12.50

File paths

z:\_%m

More PolyRansom samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report