MALICIOUS — TmCCSF.exe

MALICIOUS — TmCCSF.exe is a unknown sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (71/100). 1 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 7b39d61798506b02686bf0f368b2f284e81cc03f6f13372bd09410575b585a16
SHA-1: 1d937be7e883a386cbceb740b90a0a4550bbc1f6
MD5: 576e2491d7d13d95bc37d78043832dca
ssdeep: 49152:Yx96O7/EA5AjossRGtN2h1120R7m4XShYVxfBwrC21fXSI0ruuANnv8zKB:TO7p+tN0A0AZ4lBkCOX0ruuApUzq
TLSH: T1F55E12AC928C2611C2EFFC64DAA1408D9471F0C01566A06D2F07E5BA58A5E37FDF26CD
Submitted as: TmCCSF.exe
File type: unknown · Size: 3086432 bytes
Verdict: malicious (71/100)

Detections (1 of 54 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob

MITRE ATT&CK

T1547.001

Why this verdict

The malicious score of 71/100 is the fusion of 5 weighted signals:

Embedded executable payload carved at offset 735232 - static signal, weight 0.40, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: https://api-ap5.xbc.trendmicro.com/api/agent/report_exception/v2.0, https://api-ap5.xbc.trendmicro.com/xbc-ams/next_command/v5.0/d40068e5-f130-4308-be1c-7765992211f3 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

842 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

www.msftconnecttest.com
rb.symcd.com
rb.symcb.com
inference.location.live.net
searchapp.bundleassets.example
ntp.ubuntu.com
250.255.255.239.in-addr.arpa
desktop-hsgcbep._dosvc._tcp.local
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
23.40.52.85
23.11.37.157
20.190.167.148
40.126.14.160
52.123.252.248 AU · Sydney · AS8075 Microsoft Corporation
23.33.238.208
52.110.12.14 AU · Sydney · AS8075 Microsoft Corporation
52.110.12.4 AU · Sydney · AS8075 Microsoft Corporation
57.155.104.224 SG · Singapore · AS8075 Microsoft Limited UK

Embedded URLs

https://api-ap5.xbc.trendmicro.com/api/agent/report_exception/v2.0
https://api-ap5.xbc.trendmicro.com/xbc-ams/next_command/v5.0/d40068e5-f130-4308-be1c-7765992211f3
http://www.microsoft.com/pki/certs/CSPCA.crt0
http://www.microsoft.com/pki/certs/tspca.crt0
http://www.microsoft.com/windows0
http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://www.microsoft.com/pki/certs/MicTesPCA_2010-07-01.crt0
http://www.digicert.com/CPS0
http://oneocsp.microsoft.com/ocsp0
http://www.microsoft.com/pkiops/crl/Microsoft%20Public%20RSA%20Timestamping%20CA%202020.crl0y
http://www.microsoft.com/pkiops/certs/Microsoft%20Public%20RSA%20Timestamping%20CA%202020.crt0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

api-ap5.xbc.trendmicro.com
crl.microsoft.com
www.microsoft.com
it.name
empty.name
cacerts.digicert.com
crl3.digicert.com
www.digicert.com
crl4.digicert.com
oneocsp.microsoft.com

Embedded IP addresses

172.172.255.218
20.42.65.85
172.215.188.225
74.178.240.61
57.155.101.212
52.123.252.248
52.110.12.14
52.110.12.4
57.155.104.224
4.230.171.124
20.247.184.197

Registry keys

HKEY_LOCAL_MACHINE\%s)
HKEY_LOCAL_MACHINE\%s\%s)
HKEY_LOCAL_MACHINE\%s\%s\%s)

File paths

C:\Program
Z:\Y

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report