MALICIOUS — ff7c6077f4f0be7c06b4a43b185b37808548ce92ed303f8c9e0c6ec06472b611

MALICIOUS — ff7c6077f4f0be7c06b4a43b185b37808548ce92ed303f8c9e0c6ec06472b611 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Fileinfector family. 5 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: ff7c6077f4f0be7c06b4a43b185b37808548ce92ed303f8c9e0c6ec06472b611
SHA-1: 9a86c333f696db89a168d0f5b1df40384cc9b731
MD5: 97c77caec4e6b6852e82967d1a1af19b
imphash: 895fbb56c02c3d2bca3125cef5da8730
ssdeep: 768:ae2mxDMm+STZ5UW0Z080t0M07e2mxDMm+STZ5UW0Z080t0M07e2mxDMm+STZ5UWE:txft5dxft5dxft5dxft5dxft5E1Z
TLSH: T1A53E0DD531857610EDB4F908AD04AC2DB163CDA222363BD82812E5BF75B97F706D881E
Submitted as: ff7c6077f4f0be7c06b4a43b185b37808548ce92ed303f8c9e0c6ec06472b611
File type: pe · Size: 144155 bytes
Verdict: malicious (99/100) · Family: Fileinfector

Detections (5 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Dropper.Fileinfector-9830254-0
Detect It Easy (packer/type): DIE:MinGW
Microsoft Defender: Trojan:Win32/Vindor!pz
Kaspersky (KVRT): Virus.Win32.Lamer.ks

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Dropper.Fileinfector-9830254-0 (rule Win.Dropper.Fileinfector-9830254-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Vindor!pz (rule Trojan:Win32/Vindor!pz) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.ks (rule Virus.Win32.Lamer.ks) - engine signal, weight 0.55, confidence 0.85
Contacted 2 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497.001, T1497 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:MinGW (rule DIE:MinGW) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, MinGW - static signal, weight 0.25, confidence 0.55
Dropped 23 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

102032 behavior events · 1 ATT&CK techniques · 37 dropped files.

Dropped files

C:\Windows\System32\msvcp140_atomic_wait.dll - ff20145243f9b6f925b79acf860209ecc53f8a0eff563185db968b8a2eee0111
C:\exc.exe - fb2d53d4bf080c8169cde519e0f2ec13d804a7c245161f74ede9899376e332eb
C:\Windows\System32\NOISE.DAT - 3c398afdf3d776cc9d5c0aceaacf23ad5498f3082cb86d83d7458c0e1496e768
C:\Windows\System32\debug.log - 41a8ce88699d582422aff862ea6bdfebdfdedcf68f906952b1776a0b28a916e6
C:\Windows\pyshellext.amd64.dll - 614fee5d4ab6d401b7052751b0622658dc83a68438e606cfde7e80577c4d9e70
C:\Windows\System32\mfcm140.dll - a233ddfab8c7890de53734290b1330fd153f2daf7ca51e88dd5bc78a770c88c1
C:\Windows\System32\vcruntime140_threads.dll - e4f43abb0dd3dc22d4a2fa99d70f75c1a3dc2e03225d3393307daaaa5b99a114
C:\Windows\System32\vcomp140.dll - d54f01c9763c0d67541fae4601b1ca253888afe06181f5c1843d766f21ad9b87
C:\Windows\system.ini - 1ea60554c2ba14fe4340011dea3f265f256a6a1ccb5466443ba28e35afac50f4
C:\Windows\System32\mfc140u.dll - 7398f56a3d7e5dd9ea8cac848ced0ac27ecb7fad5da5c193057190074243e7b4
C:\Windows\pyw.exe - a3837456630d0666f8d3ad90cccf31d0faa4614f5be6abaa28152708638dd586
C:\Windows\win.ini - 4435f49915ac15e93695bf72b06d0e002dae05ab5203114616be504cd683ff14
C:\Windows\setupact.log - 5bd54fd1ec7f85d1941fd352d9c8906b3a023fb5c772b63770a405ba5de2a121
C:\Windows\System32\msvcp140_1.dll - d8c693500b9d1eee565716a015e0d9c131ec12e04c7be2f80b36760ccb39c01d
C:\Windows\PFRO.log - 259d7d4c521f46034630848649b66e6567cce4cb1dbbcaa9af36eb80890b0bdd

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7?P1=1785377842&P2=404&P3=2&P4=l1E6ID%2bdP67CJpKOjU%2fX%2fGF9WXhFVyGpnE3i5Cg1PBeyqvAXwFOIHh5%2fQdq0yf4r1ZEEidf68dZXH8WxKtak%2fA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.65.91
4.230.171.124
57.155.101.212
20.247.184.142
74.178.240.51
4.150.223.108
85.210.196.11
74.178.240.61
20.89.1.9
52.123.252.244
92.223.78.30
135.233.95.144
34.104.35.123
125.56.205.113
125.56.205.26
4.209.250.170
20.42.65.85
13.69.116.104
203.26.79.13
52.148.114.188
52.110.12.33
52.110.12.53
20.42.179.192
72.145.35.110

File paths

d:\w7rtm\com\complus\dtc\dtc\adme\deployment.cpp

More Fileinfector samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report