MALICIOUS — ee873c5ee44a3f4883d9f318be1497f005e1bc42dda9397686cec740af917bfc
MALICIOUS — ee873c5ee44a3f4883d9f318be1497f005e1bc42dda9397686cec740af917bfc is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Prepscram family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
ee873c5ee44a3f4883d9f318be1497f005e1bc42dda9397686cec740af917bfc - SHA-1:
d7f4b124b8788ce37a8a851c6e5f49c1b252fd00 - MD5:
e21d4f2461ed71a4e8da748998b2908f - imphash:
f1a539a5b71ad53ac586f053145f08ec - ssdeep:
24576:SeQa4iclZzLMlV6ZNxJSk+WA7mYekqlPUgn6/:Sez4iYZsV6DxMTWhYNql+/ - TLSH:
T186513378FDB09668EEBFFF44F021229CFC6604066BDFA20B54866934532748BE444E58 - Submitted as: ee873c5ee44a3f4883d9f318be1497f005e1bc42dda9397686cec740af917bfc
- File type: pe · Size: 877952 bytes
- Verdict: malicious (99/100) · Family: Prepscram
Detections (6 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Malware.Zusy-9957983-0
- Detect It Easy (packer/type): DIE:UPX
- Microsoft Defender: Trojan:Win32/Prepscram!pz
- Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25
- Kaspersky (KVRT): Trojan.Win32.Agent.neyndy
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 7 weighted signals:
- ClamAV (daily) flagged Win.Malware.Zusy-9957983-0 (rule
Win.Malware.Zusy-9957983-0) - engine signal, weight 0.90, confidence 0.95 - Dropped a malicious payload (Prepscram): b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - dynamic signal, weight 0.80, confidence 0.90
- Memory forensics: 2 finding(s), e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85 - Contacted 42 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
- Detect It Easy (packer/type) flagged DIE:UPX (rule
DIE:UPX) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
2354 behavior events · 1 ATT&CK techniques · 17 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- settings-win.data.microsoft.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
- licensing.mp.microsoft.com
- msedge.api.cdp.microsoft.com
- geo.prod.do.dsp.mp.microsoft.com
- kv801.prod.do.dsp.mp.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/13551/files/20012bbf640a8b8b41e693b7852815a278696c5509443571d4f1da0cf3603899 -
20012bbf640a8b8b41e693b7852815a278696c5509443571d4f1da0cf3603899 - /opt/CAPEv2/storage/analyses/13551/files/77477dd0651fff1419130ce8b327a9bb9d3e983083cd85448ceb0743000d86c4 -
77477dd0651fff1419130ce8b327a9bb9d3e983083cd85448ceb0743000d86c4 - /opt/CAPEv2/storage/analyses/13551/files/d42a2829a0ea4a3a323b7e84627fa1cf82bae079372a9c6d3ffa81de1945f563 -
d42a2829a0ea4a3a323b7e84627fa1cf82bae079372a9c6d3ffa81de1945f563 - /opt/CAPEv2/storage/analyses/13551/files/ea4ced41dc8407143053f7c81d52d1cfcb37667638b71dbccd5549fa3efffaac -
ea4ced41dc8407143053f7c81d52d1cfcb37667638b71dbccd5549fa3efffaac - /opt/CAPEv2/storage/analyses/13551/files/e801eeff66555a50e7c5599a0d1e3c60e3b4220bd77122272032d26437f9d151 -
e801eeff66555a50e7c5599a0d1e3c60e3b4220bd77122272032d26437f9d151 - /opt/CAPEv2/storage/analyses/13551/files/c7539dc1a64a098488f3e0818164459fc83d516209c7bf41cac0d38e8e8c3f0a -
c7539dc1a64a098488f3e0818164459fc83d516209c7bf41cac0d38e8e8c3f0a - /opt/CAPEv2/storage/analyses/13551/files/b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 -
b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - /opt/CAPEv2/storage/analyses/13551/files/dcbcea563933340cad874b339e58750810db1f7b3b33c2acd7e8de956a8bf539 -
dcbcea563933340cad874b339e58750810db1f7b3b33c2acd7e8de956a8bf539 - /opt/CAPEv2/storage/analyses/13551/files/1e2b829a8db70f1566bac69de68abb8b91c98a344fb14384f9e7657bda3ec9bb -
1e2b829a8db70f1566bac69de68abb8b91c98a344fb14384f9e7657bda3ec9bb - /opt/CAPEv2/storage/analyses/13551/files/d73b2857285aebd1bede87e5a1cbe8152c240430273e01d7f95d4a98ff0f3acc -
d73b2857285aebd1bede87e5a1cbe8152c240430273e01d7f95d4a98ff0f3acc - /opt/CAPEv2/storage/analyses/13551/files/28c8f320530f1097cb8359e7965e36c82978e1d4098068eefcf4bea41506c62c -
28c8f320530f1097cb8359e7965e36c82978e1d4098068eefcf4bea41506c62c - /opt/CAPEv2/storage/analyses/13551/files/d303b3819c6410c2b07a8099c9eab703181f6b288a05b760b95d6260f6312cef -
d303b3819c6410c2b07a8099c9eab703181f6b288a05b760b95d6260f6312cef - /opt/CAPEv2/storage/analyses/13551/files/86dfaea3de9882580f60f546296be3852518f32020ce1eacb5ebda30b6bdaad0 -
86dfaea3de9882580f60f546296be3852518f32020ce1eacb5ebda30b6bdaad0 - /opt/CAPEv2/storage/analyses/13551/files/ff6eecc9e3842a5b8bedc17a5ae6cd8555562649de4eb4e7e8b35ff4e90f27a2 -
ff6eecc9e3842a5b8bedc17a5ae6cd8555562649de4eb4e7e8b35ff4e90f27a2 - /opt/CAPEv2/storage/analyses/13551/files/ccfe70380d9d106950abf18755a37ab92efe2a097a80377161ea502d5521f557 -
ccfe70380d9d106950abf18755a37ab92efe2a097a80377161ea502d5521f557
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786550658&P2=404&P3=2&P4=koO4F4oFZrkxhuqPMESsWM4qxNcfXELGfxY1Nny9UgCn5usVDMJ858nzOTpOPqSO2WksApe2mI2Qtdt6riBBIQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786550717&P2=404&P3=2&P4=VLgcVtYVsKaiiJdNqVPJypVtpRAiIu1c9FPB5u6WHKrmdOGw9YX2sO7REVgwdnsErEmcB6v6WYeShdpRwBFbtw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- iq.ml
Embedded IP addresses
- 74.178.76.44
- 13.69.109.131
- 52.123.252.203
- 48.211.4.16
- 4.230.171.124
- 4.144.132.114
- 135.233.95.144
- 74.178.240.51
- 74.178.232.29
- 4.207.44.76
- 203.26.79.13
- 172.178.240.161
- 20.42.73.28
- 52.110.12.30
- 52.110.12.18
- 72.153.5.96
- 92.223.78.30
- 52.148.114.188
- 52.110.12.32
- 74.179.71.159
- 52.110.12.40
File paths
- p:\5TL
More Prepscram samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report