MALICIOUS — f384ae4d2842443ba72a4e8f5f34ad97c71a28bba4f70abc88af3e5fc235f66b

MALICIOUS — f384ae4d2842443ba72a4e8f5f34ad97c71a28bba4f70abc88af3e5fc235f66b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Autorun family. 7 of 56 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

SHA-256: f384ae4d2842443ba72a4e8f5f34ad97c71a28bba4f70abc88af3e5fc235f66b
SHA-1: b9086d76df5fb790dd50fa8b890192b346766ef7
MD5: 95eb6b341ab10d1c677681e103987127
imphash: ba57cff438d021f24d6f677ef19046de
ssdeep: 12288:VbKsikEy19X6aTCjOV5KV5izrqFkbVDVMPB:hKsikt116aTCjeIifqFuLMPB
TLSH: T1724A7C6501563233E2BBDD04640D8EDE8423F4E871750B6D920BD01DA3F9AB3E6F6899
Submitted as: f384ae4d2842443ba72a4e8f5f34ad97c71a28bba4f70abc88af3e5fc235f66b
File type: pe · Size: 431070 bytes
Verdict: malicious (100/100) · Family: Autorun

Detections (7 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Worm.Autorun-1250
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
Microsoft Defender: Trojan:Win32/Ausiv!pz
Emsisoft (Emergency Kit): Backdoor.Hupigon.AAEA
Kaspersky (KVRT): Worm.Win32.AutoRun.nf

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 22 weighted signals:

ClamAV (daily) flagged Win.Worm.Autorun-1250 (rule Win.Worm.Autorun-1250) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.70, confidence 0.70
Microsoft Defender flagged Trojan:Win32/Ausiv!pz (rule Trojan:Win32/Ausiv!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Backdoor.Hupigon.AAEA (rule Backdoor.Hupigon.AAEA) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Worm.Win32.AutoRun.nf (rule Worm.Win32.AutoRun.nf) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 23 external host(s) and 11 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.30, confidence 0.70
Embedded network infrastructure: http://www.2651china.cn/2651/1.txt, http://www.2651china.cn/2651/wm.htm, http://www.gnu.org/software/coreutils/ - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 33 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

22813 behavior events · 3 ATT&CK techniques · 35 dropped files.

Dropped files

C:\Program Files\7-Zip\7zG.exe - 78e68ace33c5e5a80d42f9599b19832dd94e27d833d6e27eda5b52df6ae25947
C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe - 2b3a1940fd52b4d676e0098ec5582073db315aeac759a3580633d4b1c9469e72
C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\MenuCoreApp\AcroShareTarget.exe - d17b1e14981e0ed2c772e6246879dbfd1931511ad0207b1861b5639d5e83ba6f
C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe - 368e75233e3dec1042fce08488d4e6ef12e068e6b00e6410bb38b4f1a3936289
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe - 94eacc5764fd7f2c8570a49b4875342d13defa64abab1bb109445f839f11f147
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe - 4d289ff1085d6f86c2d09f0d71710c7d00d48f6b32afa6f43e72f03d02b7a8dd
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe - 4857af24c045ec2215d6652cb813057d031c3b224b5a7e9e6544aff2aed89ccd
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe - c985b2619631a27efb8d472dc698130973aaeb778002b3db1b78b14daf2fe359
C:\Sysmon64.exe - 0d5003f852c8e0900e2a045cdf017f1c0a57e2597237a674e7f09696c0826806
C:\Program Files\7-Zip\7z.exe - b5cc27d46e6cd89c53de9ccd736d3246c5bacc08887cd53a83445aabdc73c6f7
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe - 9a762e0ffcb5586f5fae6b2f7c52944b322cb357a9da65e3bf6688904ec5025b
C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe - 40f22d58a340e3346233f105244a270ba1dd65e48a7e4b8c195b579179c88e34
C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe - 571cf0528308baa8f9a0a24247094d42a8a9f0fb5fabd4fb9d620630633b8f96
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe - 059aeb915a9d2536df0b7cdba2713c5ad64c6ac7a9e8415ba5285ed4cd2cae6e
C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe - a50dafb8f8deef9f4218d968347166db372fe976b6c87aaee05457960911df4f

Embedded URLs

http://www.2651china.cn/2651/1.txt
http://www.2651china.cn/2651/wm.htm
http://www.gnu.org/software/coreutils/
http://translationproject.org/team/
http://gnu.org/licenses/gpl.html
http://www.gnu.org/gethelp/
http://www.microsoft.com/pki/certs/CSPCA.crt0
http://www.microsoft.com/pki/certs/tspca.crt0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

www.2651china.cn
www.gnu.org
translationproject.org
gnu.org
cygwin.com
debian.org
crl.microsoft.com
www.microsoft.com
sb.scorecardresearch.com
btloader.com
scripts.mf.webcontentassessor.com
m.adnxs.com
cdn.btloader.com
ad-delivery.net
ab.dns-finder.com
cdn.api.btloader.com
ib.adnxs.com
res.public.onecdn.static.microsoft
ty-api.archive-digger.com
shftr.adnxs.net
msft-ssp-apac.adnxs.com
b1t-tokdc1.outbrain.com
acdn.adnxs.com
api.btloader.com
crcdn01.adnxs-simple.com

Embedded IP addresses

2.7.6.1
20.42.65.89
20.247.185.124
4.230.171.124
104.18.33.89
85.210.196.11
135.233.45.222
52.110.12.19
52.110.12.22
4.243.157.76
4.243.157.107
4.243.157.148
40.115.75.193
4.237.188.71
4.243.157.154
4.243.157.91
35.75.254.76
135.234.160.246
4.247.188.233
34.36.200.111
18.65.244.122
104.20.20.189
172.64.154.167
172.178.240.163
130.211.23.194

File paths

T:\:p:~:

More Autorun samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report