MALICIOUS — 74c3df2452b7eb5de24e334e707534d412ee184dc88c1023aeee1ee7bf75e42a
MALICIOUS — 74c3df2452b7eb5de24e334e707534d412ee184dc88c1023aeee1ee7bf75e42a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepscram family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
74c3df2452b7eb5de24e334e707534d412ee184dc88c1023aeee1ee7bf75e42a - SHA-1:
316304965c7ea913da67d3872c727ba74026b5d4 - MD5:
1a9254deffa6d23a01066fcfaab0fb0f - imphash:
f1a539a5b71ad53ac586f053145f08ec - File type: pe · Size: 2415528 bytes
- Verdict: malicious (100/100) · Family: Prepscram
Detections (6 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Malware.Zusy-9957983-0
- Detect It Easy (packer/type): DIE:UPX
- Microsoft Defender: Trojan:Win32/Prepscram!pz
- Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25
- Kaspersky (KVRT): Trojan.Win32.Agent.neyndy
MITRE ATT&CK
Dynamic analysis (windows)
2371 behavior events · 1 ATT&CK techniques · 17 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
- msedge.api.cdp.microsoft.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- assets.msn.com
- geo.prod.do.dsp.mp.microsoft.com
- licensing.mp.microsoft.com
- www.bing.com
- kv801.prod.do.dsp.mp.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/13559/files/df3d11ffcb6edc3edf5b7dfcab4bc8fdc5eb0ea302d367956393ec198472ab09 —
df3d11ffcb6edc3edf5b7dfcab4bc8fdc5eb0ea302d367956393ec198472ab09 - /opt/CAPEv2/storage/analyses/13559/files/119d5c6f5395ac668cb940d09c4065d828ea672bb0864aa83cc7c28cd7cb9d83 —
119d5c6f5395ac668cb940d09c4065d828ea672bb0864aa83cc7c28cd7cb9d83 - /opt/CAPEv2/storage/analyses/13559/files/30ba95d5696905bbb91a6741fbca7ea036baa1e4461c095861ffc6218d1867c5 —
30ba95d5696905bbb91a6741fbca7ea036baa1e4461c095861ffc6218d1867c5 - /opt/CAPEv2/storage/analyses/13559/files/c7235be174e445e8c10f872aaa917273cdb1ce0222c7ba2b3b6af296aa489dff —
c7235be174e445e8c10f872aaa917273cdb1ce0222c7ba2b3b6af296aa489dff - /opt/CAPEv2/storage/analyses/13559/files/b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 —
b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - /opt/CAPEv2/storage/analyses/13559/files/e6e453c5fc0fa24ecd91831cb3b05f204398584350248df08556faaa24d62b40 —
e6e453c5fc0fa24ecd91831cb3b05f204398584350248df08556faaa24d62b40 - /opt/CAPEv2/storage/analyses/13559/files/7e6e066414f208bbc4b55ab3438d29658299523abf30a82e386661cbcce08315 —
7e6e066414f208bbc4b55ab3438d29658299523abf30a82e386661cbcce08315 - /opt/CAPEv2/storage/analyses/13559/files/b27961c207324c7eff24342995fede4241688bd6fd5ffd9da37bc06914f496a4 —
b27961c207324c7eff24342995fede4241688bd6fd5ffd9da37bc06914f496a4 - /opt/CAPEv2/storage/analyses/13559/files/db1667e6bf825b1611370bed40034c1ef86b180b5127eb4873db092eb760c1c7 —
db1667e6bf825b1611370bed40034c1ef86b180b5127eb4873db092eb760c1c7 - /opt/CAPEv2/storage/analyses/13559/files/9ce239befba79d1157dbd1ba1f5f188d9e6665b0a4a1b8381c8d01b2de0a7010 —
9ce239befba79d1157dbd1ba1f5f188d9e6665b0a4a1b8381c8d01b2de0a7010 - /opt/CAPEv2/storage/analyses/13559/files/07947b30f1a938db6b7b2838b7809eb213ba7a2455b67d5465cba135e7c7c498 —
07947b30f1a938db6b7b2838b7809eb213ba7a2455b67d5465cba135e7c7c498 - /opt/CAPEv2/storage/analyses/13559/files/aeeda8526ffeaafbb7777b895a7bf99f148b1a95d2733351db02765110bc89ae —
aeeda8526ffeaafbb7777b895a7bf99f148b1a95d2733351db02765110bc89ae - /opt/CAPEv2/storage/analyses/13559/files/ca4a5f2cb80de8f8730ef6931608812b884f0ce1ac29bc6284bdd8124563a327 —
ca4a5f2cb80de8f8730ef6931608812b884f0ce1ac29bc6284bdd8124563a327 - /opt/CAPEv2/storage/analyses/13559/files/d00655600c465ff0a2be6b2cc26e4239e0216eb083f9d45330789df960a1e5f9 —
d00655600c465ff0a2be6b2cc26e4239e0216eb083f9d45330789df960a1e5f9 - /opt/CAPEv2/storage/analyses/13559/files/8c9d217a43e1f5f6c45b40b5af3fb8dce70e45f0aa6ac59152eca2abd9b6ed69 —
8c9d217a43e1f5f6c45b40b5af3fb8dce70e45f0aa6ac59152eca2abd9b6ed69
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786550850&P2=404&P3=2&P4=IFV%2bgYcOalB%2fuJ%2bpt6dWeqfYvDuvQ9QO8OaBB458Z5rJuEhepMz2u2TMub14oTT9eFtOcsSEj37b3c8mgpOUsA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786550867&P2=404&P3=2&P4=KjHXmY5dScblRZ8A6QbiNCb0rLwDChTdn1UrYR78SvigRR8tCUmnlNkcRJTFNVPVV9uoNQrT7ujscVfPMccycA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- nn.sh
Embedded IP addresses
- 142.250.183.46
- 20.184.175.2
- 52.123.252.212
- 4.230.171.124
- 172.215.188.232
- 20.247.185.124
- 74.179.71.159
- 135.233.95.144
- 135.233.95.135
- 203.26.79.13
- 135.234.160.245
- 172.66.2.5
- 72.145.35.107
- 52.110.12.2
- 52.110.12.22
- 85.210.193.152
- 135.234.160.246
- 4.150.223.110
- 48.200.63.27
- 52.168.112.66
- 92.223.78.30
- 52.148.114.188
- 20.42.73.27
- 172.175.111.170
- 52.110.12.42
More Prepscram samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report