16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933

General

Target

16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe
Size

261KB
MD5

918f2db499212c85bc93d7da1521f89c
SHA1

f0f4778b1ec991e5d263f1419fb07d173d19a793
SHA256

16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933
SHA512

76c33d7ba6049338f379241190f6483a2223f6e05f5dbbe413b17173a7567098f92ed352165d582f5d9518267cd33de4164e3dd5f11a39b79d9ebd6adb389520

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

jusched.exe

pid process

4256 jusched.exe

pid	process
4256	jusched.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run	16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe

Drops file in Program Files directory 2 IoCs

Processes:

16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe

description	ioc	process
File created	C:\Program Files (x86)\2fe329f0\2fe329f0	16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe
File created	C:\Program Files (x86)\2fe329f0\jusched.exe	16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe

Drops file in Windows directory 1 IoCs

Processes:

16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe

description ioc process

File created C:\Windows\Tasks\Update23.job 16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\Update23.job	16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe

description	pid	process	target process
PID 4656 wrote to memory of 4256	4656	16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe	jusched.exe
PID 4656 wrote to memory of 4256	4656	16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe	jusched.exe
PID 4656 wrote to memory of 4256	4656	16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe	jusched.exe

C:\Users\Admin\AppData\Local\Temp\16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe
"C:\Users\Admin\AppData\Local\Temp\16383a81f9f7f11beb922556a791dab392383c405d858ad5bcff9c41f9d2a933.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4656

C:\Program Files (x86)\2fe329f0\jusched.exe
"C:\Program Files (x86)\2fe329f0\jusched.exe"
2⤵
- Executes dropped EXE
PID:4256

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\2fe329f0\2fe329f0
MD5
2130fee70fc3f7c10d5279f96f98ad1e

SHA1
4307cef89171fa230048ea22546802198d888780

SHA256
3506e286f6223ccaf1665d4e457b712abeb527266ff28327ce60e37b9fbeb404

SHA512
67fa1bb31028ff3ba125f184207499b9205f58c9eef2ac948f5824475515c396b3d5f93e207cb96deffe1aedb286b1f935cc689c5d84449e51c517da1cffe2e5

Download Submit
C:\Program Files (x86)\2fe329f0\jusched.exe
MD5
83245a0d55af0e96929fbe6be5e893e2

SHA1
8b16db72889e792864257ddd04ba33422abbbfd3

SHA256
1238d01b9098ce7d4f3c7c29e3e50484e6092338d15bea874f048f65cc060d2a

SHA512
aea9d36d036d7471af8f41a153a559f78db4229376281fc21116a5ef7b0fc3b9bf97c5910bedcf292e98e4fa88e520dcf011bee3adc51e48b97e000de8b54790

Download Submit
C:\Program Files (x86)\2fe329f0\jusched.exe
MD5
83245a0d55af0e96929fbe6be5e893e2

SHA1
8b16db72889e792864257ddd04ba33422abbbfd3

SHA256
1238d01b9098ce7d4f3c7c29e3e50484e6092338d15bea874f048f65cc060d2a

SHA512
aea9d36d036d7471af8f41a153a559f78db4229376281fc21116a5ef7b0fc3b9bf97c5910bedcf292e98e4fa88e520dcf011bee3adc51e48b97e000de8b54790

Download Submit
memory/4256-114-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads