16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933

General

Target

16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe
Size

261KB
MD5

918f2db499212c85bc93d7da1521f89c
SHA1

f0f4778b1ec991e5d263f1419fb07d173d19a793
SHA256

16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933
SHA512

76c33d7ba6049338f379241190f6483a2223f6e05f5dbbe413b17173a7567098f92ed352165d582f5d9518267cd33de4164e3dd5f11a39b79d9ebd6adb389520

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

jusched.exe

pid process

1444 jusched.exe

pid	process
1444	jusched.exe

Loads dropped DLL 2 IoCs

Processes:

16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe

pid	process
1100	16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe
1100	16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run	16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe

Drops file in Program Files directory 2 IoCs

Processes:

16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe

description	ioc	process
File created	C:\Program Files (x86)\115c7201\jusched.exe	16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe
File created	C:\Program Files (x86)\115c7201\115c7201	16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe

Drops file in Windows directory 1 IoCs

Processes:

16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe

description ioc process

File created C:\Windows\Tasks\Update23.job 16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\Update23.job	16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe

description	pid	process	target process
PID 1100 wrote to memory of 1444	1100	16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe	jusched.exe
PID 1100 wrote to memory of 1444	1100	16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe	jusched.exe
PID 1100 wrote to memory of 1444	1100	16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe	jusched.exe
PID 1100 wrote to memory of 1444	1100	16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe	jusched.exe

C:\Users\Admin\AppData\Local\Temp\16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe
"C:\Users\Admin\AppData\Local\Temp\16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1100

C:\Program Files (x86)\115c7201\jusched.exe
"C:\Program Files (x86)\115c7201\jusched.exe"
2⤵
- Executes dropped EXE
PID:1444

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\115c7201\115c7201
MD5
2130fee70fc3f7c10d5279f96f98ad1e

SHA1
4307cef89171fa230048ea22546802198d888780

SHA256
3506e286f6223ccaf1665d4e457b712abeb527266ff28327ce60e37b9fbeb404

SHA512
67fa1bb31028ff3ba125f184207499b9205f58c9eef2ac948f5824475515c396b3d5f93e207cb96deffe1aedb286b1f935cc689c5d84449e51c517da1cffe2e5

Download Submit
C:\Program Files (x86)\115c7201\jusched.exe
MD5
d320f79520aa7dad91a623b627b091b3

SHA1
4531142d813bd99b4537703159275bcd9cbbc474

SHA256
85580ba717885215714d4c2c2c554a210e9a547042ddfdeff32c8fd9defea25c

SHA512
8b32dea3371823364ec5f25ebda435ac5437ff0c8767ec10b7c3c3890794aadee5d0a88d4c9dd77b3161968510cba3db51d0f74d467b694322ae0de0e84a6f2b

Download Submit
\Program Files (x86)\115c7201\jusched.exe
MD5
d320f79520aa7dad91a623b627b091b3

SHA1
4531142d813bd99b4537703159275bcd9cbbc474

SHA256
85580ba717885215714d4c2c2c554a210e9a547042ddfdeff32c8fd9defea25c

SHA512
8b32dea3371823364ec5f25ebda435ac5437ff0c8767ec10b7c3c3890794aadee5d0a88d4c9dd77b3161968510cba3db51d0f74d467b694322ae0de0e84a6f2b

Download Submit
\Program Files (x86)\115c7201\jusched.exe
MD5
d320f79520aa7dad91a623b627b091b3

SHA1
4531142d813bd99b4537703159275bcd9cbbc474

SHA256
85580ba717885215714d4c2c2c554a210e9a547042ddfdeff32c8fd9defea25c

SHA512
8b32dea3371823364ec5f25ebda435ac5437ff0c8767ec10b7c3c3890794aadee5d0a88d4c9dd77b3161968510cba3db51d0f74d467b694322ae0de0e84a6f2b

Download Submit
memory/1100-60-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1444-63-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads