MALICIOUS — f5cb890cc4529951ecbecdae88e15b47694990482049a440ba37058a8e8a817c

MALICIOUS — f5cb890cc4529951ecbecdae88e15b47694990482049a440ba37058a8e8a817c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the PolyRansom family. 6 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: f5cb890cc4529951ecbecdae88e15b47694990482049a440ba37058a8e8a817c
SHA-1: 7e0426f6d0734e93d4e17558542d54d827a8aa3c
MD5: bee5ba98cbf9c5b2ca323f687880c2d7
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 3072:DheCh1Q4eUU1bQP4rn3zmfYuO52T/y1cfkKQ/8YXcQNo0TaQvj:lhElQAXmsFEkz8oc0
TLSH: T1AA424A8C852C37ACE918291B3D0E107E92EB6D06340A7E2D5CF84DB9755C5E7BBE0129
Submitted as: f5cb890cc4529951ecbecdae88e15b47694990482049a440ba37058a8e8a817c
File type: pe · Size: 215552 bytes
Verdict: malicious (99/100) · Family: PolyRansom

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): BC.Win.Virus.Ransom-9157.A
Microsoft Defender: Virus:Win32/Nabucur.A
Emsisoft (Emergency Kit): Win32.Virlock.Gen.4
Trellix Stinger (McAfee): W32/VirRansom
Kaspersky (KVRT): Virus.Win32.PolyRansom.a

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged BC.Win.Virus.Ransom-9157.A (rule BC.Win.Virus.Ransom-9157.A) - engine signal, weight 0.90, confidence 0.95
3 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 6 finding(s), e.g. RWX/private injected region in vcIYEIkQ.exe (pid 3076) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Dropped 12 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

12372 behavior events · 3 ATT&CK techniques · 28 dropped files.

Dropped files

C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.exe - 6273017ee30178c004a71194d3dd0e432be4f04938d26d3d9079cd8dc577a2d7
C:\Users\analyst\AppData\Local\Temp\LkMcAIcI.bat - beac94313998fadf971b78e9154bc5eb086c1ed8fbbcac31d885e66daf70c211
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\ProgramData\xiocAsMc\yKgEskQE.inf - e8ff08131aea06e82ed7d65c653bcd7fdde10d4d24b6ddbe02a692a73ccdac9e
C:\Users\analyst\rSwIoccE\vcIYEIkQ.inf - 4a1e6c50704aea7b583cd7d6b4d65728878d1c65983cca1c15e4a980e8fd617a
C:\Users\analyst\rSwIoccE\vcIYEIkQ - 716d9965d8f2b3a5cf19c159c0003156d6babb4a918ef9677a178f8ab0f6340e
C:\ProgramData\xiocAsMc\yKgEskQE - dde30650f321b28a4b87e17cdda8270357e4251957eb071eda0ee0775fe565b1
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.exe - bfe7eb3e7f54f362d9541af1fa773ec6518370d495a727445ec348fd38f34813
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.exe - 753a86f9ee22808380c67078eb9cd5d13f345d9f052d07e66ced47b7a6d33112
C:\Users\analyst\AppData\Local\Temp\fQUwEswU.bat - 0d20a587007cafbda42d9ab2a7dd3148af1ea311de7163e00cea3f7e1f3e25df
C:\Users\analyst\AppData\Local\Temp\wyQQEMkE.bat - 2e1c2d189dbba23821af42a34179525a7382c7ee2204bdeb30fea9eb589f0841
C:\ProgramData\xiocAsMc\yKgEskQE - b9a69b142720e06d0dc614dea70bdd98f0d4c0c8a5b37281603dc440cc79d147
C:\Users\analyst\AppData\Local\Temp\iwsu.ico - bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.exe - 6228973abb6d7e94681289e6b08ba17709e50fcda765b1280f66a2d62cb83971
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png - d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://google.com/
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787853691&P2=404&P3=2&P4=C24rrCf5nbYgvap8%2bslO%2bUxoMUS%2fdY%2b5jmJVSypiZiTuU%2fvdG4pGch9nBjrmD%2bHRrzrsrbMMzh3NA7CtFixgVg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787853810&P2=404&P3=2&P4=WayL6tsi48i7Ffgj%2b0m0ntikCSvLwAC2rQpic%2bLozZ6DIjlTCJPiyYygdYV3SsUht6%2bUe%2byZyaqewr1cEkCpXw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

i.mx

Embedded IP addresses

4.150.223.114
4.230.171.124
20.247.184.142
20.42.179.204
74.178.240.61
20.50.201.206
135.232.92.97
135.233.95.144
20.112.250.133
52.123.128.14
52.123.129.14
135.234.160.244
20.184.175.8
200.87.164.69
92.223.78.30
200.119.204.12
203.26.79.13
52.148.114.188
190.186.45.170
135.233.95.80
72.153.5.96
52.123.252.192
52.110.12.4
52.110.12.42

More PolyRansom samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report