MALICIOUS — 7fa343b3baa409d1d59f854c9efd779361c0a9ac5f7350bb1e020c1ffe734e16
MALICIOUS — 7fa343b3baa409d1d59f854c9efd779361c0a9ac5f7350bb1e020c1ffe734e16 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepscram family. 6 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
7fa343b3baa409d1d59f854c9efd779361c0a9ac5f7350bb1e020c1ffe734e16 - SHA-1:
072f1dd8d32160197f5e0bd6c5b1a82978b3d06f - MD5:
7f9ef6e0802211eabc5bb97163e20a64 - imphash:
f1a539a5b71ad53ac586f053145f08ec - File type: pe · Size: 3560872 bytes
- Verdict: malicious (100/100) · Family: Prepscram
Detections (6 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Malware.Zusy-9957983-0
- Detect It Easy (packer/type): DIE:UPX
- Microsoft Defender: Trojan:Win32/Prepscram!pz
- Emsisoft (Emergency Kit): Gen:Variant.Rootkit.25
- Kaspersky (KVRT): Trojan.Win32.Agent.neyndy
MITRE ATT&CK
Dynamic analysis (windows)
5587 behavior events · 2 ATT&CK techniques · 25 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- assets.msn.com
- licensing.mp.microsoft.com
- www.bing.com
- tas02.sls.update.microsoft.com
- fe3cr.delivery.mp.microsoft.com
- v10.events.data.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/13661/files/64fe845037ed1f3b98b355f13c2ebf52d10503523d3b031867fc6987faa382b6 —
64fe845037ed1f3b98b355f13c2ebf52d10503523d3b031867fc6987faa382b6 - /opt/CAPEv2/storage/analyses/13661/files/e3f54465dbf6e43ddcf4ae9651d2344f8f168d87b6d1e8da42f328585d6574df —
e3f54465dbf6e43ddcf4ae9651d2344f8f168d87b6d1e8da42f328585d6574df - /opt/CAPEv2/storage/analyses/13661/files/b9846d22e13f8f1a5145ca75b0a9855ad822fe82b20e3428b622f97ec7313d9f —
b9846d22e13f8f1a5145ca75b0a9855ad822fe82b20e3428b622f97ec7313d9f - /opt/CAPEv2/storage/analyses/13661/files/ed7464c4f7dc1b92b8012b92ff6db95d93e369a17629a66c7ebbc250b45fa775 —
ed7464c4f7dc1b92b8012b92ff6db95d93e369a17629a66c7ebbc250b45fa775 - /opt/CAPEv2/storage/analyses/13661/files/4922d959823e91fed09f85fe21315911f5a60f4bc150da5b1c962b00ba0a4e33 —
4922d959823e91fed09f85fe21315911f5a60f4bc150da5b1c962b00ba0a4e33 - /opt/CAPEv2/storage/analyses/13661/files/37d57c6bffa96ec542d5cac02c9a51ef52f8063da2a45dc257c1e603b2897be2 —
37d57c6bffa96ec542d5cac02c9a51ef52f8063da2a45dc257c1e603b2897be2 - /opt/CAPEv2/storage/analyses/13661/files/3d60b9e37417564fc3bda606e3de218088f72058323a2f87213a06a526dc1930 —
3d60b9e37417564fc3bda606e3de218088f72058323a2f87213a06a526dc1930 - /opt/CAPEv2/storage/analyses/13661/files/3763b1afae10e4588b9bd5faabe2fce529a5ae4515f2ff8db76b6cf079532e9f —
3763b1afae10e4588b9bd5faabe2fce529a5ae4515f2ff8db76b6cf079532e9f - /opt/CAPEv2/storage/analyses/13661/files/b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 —
b612d46644d0e4a3829c4d6715f71d979103aa487624805363b36f5b4f92b118 - /opt/CAPEv2/storage/analyses/13661/files/c712d6c7a60f170a0c6c5ec768d962c58b1f59a2d417e98c7c528a037c427ab6 —
c712d6c7a60f170a0c6c5ec768d962c58b1f59a2d417e98c7c528a037c427ab6 - /opt/CAPEv2/storage/analyses/13661/files/1760f88754bb58d619a0e563993634b76074028b39295450a54d320bea5d72ed —
1760f88754bb58d619a0e563993634b76074028b39295450a54d320bea5d72ed - /opt/CAPEv2/storage/analyses/13661/files/983132c3f36dadd0f4e20417b1fd6398c6cdea3e48026dd6e1d739a9cf728ace —
983132c3f36dadd0f4e20417b1fd6398c6cdea3e48026dd6e1d739a9cf728ace - /opt/CAPEv2/storage/analyses/13661/files/9ad7dd2afd9028a808177b96548883fb1b54de6ada7479e80797f3982e65540c —
9ad7dd2afd9028a808177b96548883fb1b54de6ada7479e80797f3982e65540c - /opt/CAPEv2/storage/analyses/13661/files/1ff5e451f0cee11a0189baabcfd8697faf1ae09a66b226068203aff84e4269e3 —
1ff5e451f0cee11a0189baabcfd8697faf1ae09a66b226068203aff84e4269e3 - /opt/CAPEv2/storage/analyses/13661/files/39d533ed9d43e36a251e8b9dc990d3363d2314d3eb1357717e891ca95df3d6bf —
39d533ed9d43e36a251e8b9dc990d3363d2314d3eb1357717e891ca95df3d6bf
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786553633&P2=404&P3=2&P4=AygUPFbzIgYaDnhfa5UzMd%2bxpO8M%2ffXroBYu9J4iXAdLdyfgZsEvGWdFbpV9SDHeiB%2bkkMWTv0Iozj%2f5EhsgSA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786553737&P2=404&P3=2&P4=HIcLef7KhgbG28xQSMZOBd%2bS85%2b60TJZ0c%2b%2b3oDPcGIhKgCjW5oA8lwlXGgiEN1TAgRhnof777Uh%2bqiyQLnc7g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- 8.jp
Embedded IP addresses
- 20.184.175.13
- 4.230.171.124
- 40.84.85.40
- 4.144.132.223
- 4.247.188.233
- 135.233.95.144
- 74.178.76.54
- 20.42.73.26
- 74.179.77.204
- 135.233.45.222
- 52.110.12.40
- 52.110.12.52
- 20.42.65.90
- 203.26.79.13
- 135.234.160.244
- 52.123.252.229
- 74.178.76.44
- 52.123.252.203
- 48.211.4.16
- 72.145.35.112
- 52.148.114.188
- 52.110.12.47
- 74.179.71.159
File paths
- J:\3\
More Prepscram samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report