MALICIOUS — ff3ce19f5a79b855896c47d3cb63fc4bf8cde79dce8d26c072b928bbc1cd7fbc
MALICIOUS — ff3ce19f5a79b855896c47d3cb63fc4bf8cde79dce8d26c072b928bbc1cd7fbc is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepscram family. 8 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
ff3ce19f5a79b855896c47d3cb63fc4bf8cde79dce8d26c072b928bbc1cd7fbc - SHA-1:
fd3eda277028540df34b452841bd86232db7cd55 - MD5:
d1e7c7fbaf34026af20c7e541f88771e - imphash:
f1a539a5b71ad53ac586f053145f08ec - ssdeep:
49152:PoFQC6mZq8J2OVijbTpTdVoFQC6mZq8J2OVijbTpTdr:gt6robt6roY - TLSH:
T1EA6707CE861E1709CA7BCA326D41A6DD906170D024797D2D0E07867664E303FFDB27AA - Submitted as: ff3ce19f5a79b855896c47d3cb63fc4bf8cde79dce8d26c072b928bbc1cd7fbc
- File type: pe · Size: 7230001 bytes
- Verdict: malicious (100/100) · Family: Prepscram
Detections (8 of 55 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Dropper.QQpass-9904690-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- YARA: Yara-Rules community: YR_AntiDebug_Checks
- Detect It Easy (packer/type): DIE:Microsoft Linker
- Microsoft Defender: Trojan:Win32/Prepscram!pz
- Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25
- Kaspersky (KVRT): Trojan.Win32.Agent.neyndy
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 14 weighted signals:
- ClamAV (daily) flagged Win.Dropper.QQpass-9904690-0 (rule
Win.Dropper.QQpass-9904690-0) - engine signal, weight 0.90, confidence 0.95 - 1 behavioral detection(s): Registry Run Key Persistence [high] (rule
tl-run-key) - dynamic signal, weight 0.60, confidence 0.90 - Memory forensics: 2 finding(s), e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85 - Observed at runtime: Registry Run Key Persistence (T1547.001) (rule
Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90 - Contacted 26 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
- YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule
DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - Embedded network infrastructure: https://www.mendeley.com/library, https://service.elsevier.com/app/answers/detail/a_id/22094/kw/migrate/supporthub/mendeley/, http://support.mendeley.com/customer/portal/articles/227955 - static signal, weight 0.35, confidence 0.60
- Packing/obfuscation: UPX, high-entropy-sections:UPX1, Microsoft Linker - static signal, weight 0.25, confidence 0.55
- enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60 - Dropped 15 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Extracted generic config (14 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
2343 behavior events · 1 ATT&CK techniques · 16 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
Dropped files
- C:\Users\analyst\AppData\Local\Temp\SrwkWRDvu87H49g.exe -
df25088c28a3c8104d82827427b23b7324d9af0c3413529c56e71ee897d09448 - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe -
cf1fb442ba7d3dee4416200ec6b0a74d62ed62380ca0c3c1ad96fc7bced4b6bc - C:\Windows\CTS.exe -
3eff5bedbc0d5074ba0aa30965e8f308a0b1e0bf274a7c52b2c70e4826b64fe6 - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe -
5623b200607546294fc450dc953525f7156562b7207ad51e4fe5d977b83b579b - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe -
76b6c83b2958f14c419bb51d225b1b0480a547bd13995052daddcacc904dd62e - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe -
2184ad587b1c9b5f1c79c89fba97912ca45ed94dd7076a98d6033464e94a947b - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe -
50cd57f8238594abb82b1ab3cf7aee7bd711059b7b0b220ef17e68b77089e3ce - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe -
3978c66450eaa401c345db8fddd3e317201fc4dead3bd7890242db17d5994258 - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe -
39f3c2cbb234810d9a79fdc91cca3b36f29219c5e5e5ee9c2cf24c67d1f67d8a - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe -
9d6b426c30c95566e4a0c0b3969581b734e6147256d11fd2d99ea4c811fe0686 - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe -
7313b290080e2fdbb3248823322693a16a1277a9fe787ca6190a2b0d46d857a0 - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe -
1b1f583b4cd9009598910de7682f13a063d780ec1f6bea3335b6f67aa44fe578 - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe -
9faef0401d8092cf97c336118e9d0197fa214584a9b674dea58afe9309dd6036 - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe -
b1381023c71bb7668aaf9ec88716bff04389d47da523e43e4ed7c9f407b581f4 - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe -
f58151f7b16159c88861d8524fb4955fdfd90f0476d4e354d83f410b8e54e64d
Embedded URLs
- http://www.microsoft.com/exporting
- https://www.mendeley.com/library
- https://service.elsevier.com/app/answers/detail/a_id/22094/kw/migrate/supporthub/mendeley/
- http://support.mendeley.com/customer/portal/articles/227955
- http://p.yusukekamiyamane.com/
- https://citationstyles.org
- https://github.com/Juris-M/citeproc-js
- https://plasma.kde.org
- https://www.zotero.org/
- https://rrchnm.org/
- https://www.gmu.edu/
- https://www.elsevier.com/legal/elsevier-website-terms-and-conditions
- https://www.elsevier.com/legal/privacy-policy
- http://citationstyles.org/
- https://github.com/citation-style-language/styles
- https://csl.mendeley.com
- http://creativecommons.org/licenses/by-sa/3.0/
- https://www.mendeley.com/guides?dgcid=Mendeley_Desktop_Help-menu-Help-guides
- https://www.mendeley.com?dgcid=Mendeley_Desktop_Help-menu-website
- https://service.elsevier.com/app/home/supporthub/mendeley/?dgcid=Mendeley_Desktop_Help-menu-FAQ
- https://service.elsevier.com/app/contact/supporthub/mendeley?dgcid=Mendeley_Desktop_Help-menu-Contact-Support
- https://mendeley.com/reference-management/web-importer/#id_1?dgcid=Mendeley_Desktop_Onboarding-Add-Importer
- https://www.mendeley.com/guides/using-citation-editor?dgcid=Mendeley_Desktop_Onboarding-Help-Cite
- https://www.mendeley.com/guides/desktop/04-read-highlight-annotate?dgcid=Mendeley_Desktop_Onboarding-Help-Cite
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
Embedded domains
- www.microsoft.com
- www.mendeley.com
- service.elsevier.com
- support.mendeley.com
- p.yusukekamiyamane.com
- citationstyles.org
- github.com
- plasma.kde.org
- www.zotero.org
- rrchnm.org
- www.gmu.edu
- www.elsevier.com
- csl.mendeley.com
- creativecommons.org
- mendeley.com
- domain.com
- www.w3.org
- ns.adobe.com
- msdn.microsoft.com
- valvesoftware.com
- bpcs.com
- taskus.com
- vmc.com
- keywordsstudios.com
- covalensolutions.com
Embedded IP addresses
- 10.3.4.1
- 5.2.3.5
- 1.101.3.4
- 40.79.150.121
- 52.123.252.245
- 57.155.104.224
- 4.230.171.124
- 52.253.84.76
- 20.42.179.192
- 74.178.240.61
- 20.42.65.94
- 52.123.128.14
- 20.236.44.162
- 40.99.133.226
- 52.123.129.14
- 74.178.76.54
- 52.110.12.15
- 52.110.12.53
- 135.233.45.223
- 203.26.79.13
- 52.123.252.195
- 135.232.92.34
- 52.148.114.188
- 4.150.223.114
- 4.150.223.103
Registry keys
- HKLM\System\CurrentControlSet\Control\Session
- HKEY_CURRENT_USER\Software\Classes
- HKEY_LOCAL_MACHINE\Software\Classes
- HKLM\Software\Microsoft\Windows
- hklm\software
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
- HKLM\SOFTWARE\%sMicrosoft\Windows
File paths
- C:\jenkins\workspace\Desktop_Release_Build\src\ui\MainWindow.cpp
- C:\jenkins\workspace\Desktop_Release_Build\src\ui\ImportExportDialogProvider.cpp
- C:\jenkins\workspace\Desktop_Release_Build\src\ui\AnnotationsExportSettingsDialog.cpp
- C:\jenkins\workspace\Desktop_Release_Build\src\ui\FileListEdit.cpp
- C:\jenkins\workspace\Desktop_Release_Build\src\ui\DocumentEditor.cpp
- C:\jenkins\workspace\Desktop_Release_Build\src\ui\JSDataStore.cpp
- C:\jenkins\workspace\Desktop_Release_Build\src\ui\JSNetworkResponse.cpp
- C:\jenkins\workspace\Desktop_Release_Build\src\ui\RecommenderViewPresenter.cpp
- C:\jenkins\workspace\Desktop_Release_Build\src\ui\SearchFilterPresenter.cpp
- C:\jenkins\workspace\Desktop_Release_Build\src\ui\PeopleTextEdit.cpp
- C:\jenkins\workspace\Desktop_Release_Build\src\ui\WebEnginePage.cpp
- c:\long
- c:\buildslave\steam_rel_client_win32\build\src\public\tier1\utlstring.h
- c:\buildslave\steam_rel_client_win32\build\src\common\crypto_textencode.cpp
- c:\buildslave\steam_rel_client_win32\build\src\public\tier1\utlvector.h
- c:\buildslave\steam_rel_client_win32\build\src\common\keypair.cpp
- c:\buildslave\steam_rel_client_win32\build\src\common\crypto_25519_donna.cpp
- c:\buildslave\steam_rel_client_win32\build\src\common\crypto_digest_openssl.cpp
- c:\buildslave\steam_rel_client_win32\build\src\common\crypto_rsa_openssl.cpp
- c:\buildslave\steam_rel_client_win32\build\src\common\enum_names.cpp
- c:\buildslave\steam_rel_client_win32\build\src\common\globals.cpp
- c:\buildslave\steam_rel_client_win32\build\src\common\keyvaluesignature.cpp
- c:\buildslave\steam_rel_client_win32\build\src\common\opensslwrapper.cpp
- D:\SAMSUNG\DeXonPC_Extern\cryptopp_8_2_0\sha_simd.cpp
- D:\SAMSUNG\DeXonPC_Extern\cryptopp_8_2_0\rijndael_simd.cpp
More Prepscram samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report