bc4eb02be375e87aa39b9df28cd3d69e96238dd5651cb092f65d2fdfbae36d19

General

Target

bc4eb02be375e87aa39b9df28cd3d69e96238dd5651cb092f65d2fdfbae36d19.exe
Size

281KB
MD5

b713c186fda14b221fe1c1a30bf8a80c
SHA1

2dd35af9384aa3064fd78cf3294171b67a33bda3
SHA256

bc4eb02be375e87aa39b9df28cd3d69e96238dd5651cb092f65d2fdfbae36d19
SHA512

bc4faaa75e71c15adf8bc3b49a45d636ac95b2e5c9acd2a88a9ce2e0604f8ea8ee112eaebed3c8bff726fb61ce33ee1306f3e1f893c41ebb99a00e956dac93ae

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

jusched.exe

pid process

4004 jusched.exe

pid	process
4004	jusched.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

bc4eb02be375e87aa39b9df28cd3d69e96238dd5651cb092f65d2fdfbae36d19.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	bc4eb02be375e87aa39b9df28cd3d69e96238dd5651cb092f65d2fdfbae36d19.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run	bc4eb02be375e87aa39b9df28cd3d69e96238dd5651cb092f65d2fdfbae36d19.exe

Drops file in Program Files directory 2 IoCs

Processes:

bc4eb02be375e87aa39b9df28cd3d69e96238dd5651cb092f65d2fdfbae36d19.exe

description	ioc	process
File created	C:\Program Files (x86)\5a5a1302\5a5a1302	bc4eb02be375e87aa39b9df28cd3d69e96238dd5651cb092f65d2fdfbae36d19.exe
File created	C:\Program Files (x86)\5a5a1302\jusched.exe	bc4eb02be375e87aa39b9df28cd3d69e96238dd5651cb092f65d2fdfbae36d19.exe

Drops file in Windows directory 1 IoCs

Processes:

bc4eb02be375e87aa39b9df28cd3d69e96238dd5651cb092f65d2fdfbae36d19.exe

description ioc process

File created C:\Windows\Tasks\Update23.job bc4eb02be375e87aa39b9df28cd3d69e96238dd5651cb092f65d2fdfbae36d19.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\Update23.job	bc4eb02be375e87aa39b9df28cd3d69e96238dd5651cb092f65d2fdfbae36d19.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

bc4eb02be375e87aa39b9df28cd3d69e96238dd5651cb092f65d2fdfbae36d19.exe

description	pid	process	target process
PID 2112 wrote to memory of 4004	2112	bc4eb02be375e87aa39b9df28cd3d69e96238dd5651cb092f65d2fdfbae36d19.exe	jusched.exe
PID 2112 wrote to memory of 4004	2112	bc4eb02be375e87aa39b9df28cd3d69e96238dd5651cb092f65d2fdfbae36d19.exe	jusched.exe
PID 2112 wrote to memory of 4004	2112	bc4eb02be375e87aa39b9df28cd3d69e96238dd5651cb092f65d2fdfbae36d19.exe	jusched.exe

C:\Users\Admin\AppData\Local\Temp\bc4eb02be375e87aa39b9df28cd3d69e96238dd5651cb092f65d2fdfbae36d19.exe
"C:\Users\Admin\AppData\Local\Temp\bc4eb02be375e87aa39b9df28cd3d69e96238dd5651cb092f65d2fdfbae36d19.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2112

C:\Program Files (x86)\5a5a1302\jusched.exe
"C:\Program Files (x86)\5a5a1302\jusched.exe"
2⤵
- Executes dropped EXE
PID:4004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\5a5a1302\5a5a1302
MD5
2130fee70fc3f7c10d5279f96f98ad1e

SHA1
4307cef89171fa230048ea22546802198d888780

SHA256
3506e286f6223ccaf1665d4e457b712abeb527266ff28327ce60e37b9fbeb404

SHA512
67fa1bb31028ff3ba125f184207499b9205f58c9eef2ac948f5824475515c396b3d5f93e207cb96deffe1aedb286b1f935cc689c5d84449e51c517da1cffe2e5

Download Submit
C:\Program Files (x86)\5a5a1302\jusched.exe
MD5
455b36dca37f58bb1cbafdf5bcc6d410

SHA1
cf62423193b86ab7497bde231d1026eaa21b8e4e

SHA256
0aa90d0dc06aadcfce3a474ce837442afa092f80960fa2f6248d8508ed36501c

SHA512
56be0f13ca20f51fdec0b28f585a7d1f45db733de7aa2c707a5e27a7a50532474d792092748a46c88d664229b83234a527be2ed0b6adccbc31bb300925f6a640

Download Submit
C:\Program Files (x86)\5a5a1302\jusched.exe
MD5
455b36dca37f58bb1cbafdf5bcc6d410

SHA1
cf62423193b86ab7497bde231d1026eaa21b8e4e

SHA256
0aa90d0dc06aadcfce3a474ce837442afa092f80960fa2f6248d8508ed36501c

SHA512
56be0f13ca20f51fdec0b28f585a7d1f45db733de7aa2c707a5e27a7a50532474d792092748a46c88d664229b83234a527be2ed0b6adccbc31bb300925f6a640

Download Submit
memory/4004-114-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads