6170b02c4866e58fb621b325b3d03d9935b2fe4daf7e3b5472d5d3bd261ab684

Analysis

max time kernel
156s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
30-07-2022 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6170b02c4866e58fb621b325b3d03d9935b2fe4daf7e3b5472d5d3bd261ab684.exe
Size

760KB
MD5

8629ef73d999bb67b6e403755371b19b
SHA1

a52f6baca6221930a4a9d98a12050bdb46218005
SHA256

6170b02c4866e58fb621b325b3d03d9935b2fe4daf7e3b5472d5d3bd261ab684
SHA512

d4b9395110b200caac0bbe4aee14f2c0feaaa1c5a9c0bff790bcd10091f34cadc7be0831a08284dd72bf51eaa13029db57bd8b4faba432752ca13a49f2d7393b

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 15 IoCs

Processes:

jushed.exejushed.exejusched.exejushed.exejushed.exejushed.exesvchost.exejushed.exejushed.exejushed.exejushed.exejushed.exejushed.exejushed.exejushed.exe

pid	process
1924	jushed.exe
1588	jushed.exe
2556	jusched.exe
4120	jushed.exe
4276	jushed.exe
2956	jushed.exe
1148	svchost.exe
2168	jushed.exe
2424	jushed.exe
1816	jushed.exe
2864	jushed.exe
4008	jushed.exe
1404	jushed.exe
4248	jushed.exe
2280	jushed.exe

UPX packed file 34 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1760-130-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral2/memory/1760-131-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\jushed.exe	upx
C:\Users\Admin\AppData\Roaming\jushed.exe	upx
behavioral2/memory/1924-135-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral2/memory/1760-136-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral2/memory/1588-139-0x00000000000D0000-0x0000000000148000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\jushed.exe	upx
behavioral2/memory/1588-142-0x00000000000D0000-0x0000000000148000-memory.dmp	upx
behavioral2/memory/1588-143-0x00000000000D0000-0x0000000000148000-memory.dmp	upx
behavioral2/memory/1588-144-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral2/memory/1588-145-0x00000000000D0000-0x0000000000148000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\Java SE Platform Updater\jusched.exe	upx
C:\Users\Admin\AppData\Roaming\Java SE Platform Updater\jusched.exe	upx
behavioral2/memory/1588-149-0x00000000000D0000-0x0000000000148000-memory.dmp	upx
behavioral2/memory/2556-151-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral2/memory/4120-152-0x00000000000D0000-0x0000000000148000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\jushed.exe	upx
behavioral2/memory/4120-155-0x00000000000D0000-0x0000000000148000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\jushed.exe	upx
behavioral2/memory/2556-159-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral2/memory/4276-160-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral2/memory/1924-161-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\jushed.exe	upx
behavioral2/memory/2956-170-0x00000000000D0000-0x0000000000148000-memory.dmp	upx
behavioral2/memory/4276-171-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\jushed.exe	upx
C:\Users\Admin\AppData\Roaming\jushed.exe	upx
C:\Users\Admin\AppData\Roaming\jushed.exe	upx
C:\Users\Admin\AppData\Roaming\jushed.exe	upx
C:\Users\Admin\AppData\Roaming\jushed.exe	upx
C:\Users\Admin\AppData\Roaming\jushed.exe	upx
C:\Users\Admin\AppData\Roaming\jushed.exe	upx
C:\Users\Admin\AppData\Roaming\jushed.exe	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

jushed.exejushed.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation	jushed.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation	jushed.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

jushed.exejushed.exejushed.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	jushed.exe
Key created	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	jushed.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jushed = "C:\\Users\\Admin\\AppData\\Roaming\\jushed.exe"	jushed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	jushed.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jushed = "C:\\Users\\Admin\\AppData\\Roaming\\jushed.exe"	jushed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jushed = "C:\\Users\\Admin\\AppData\\Roaming\\jushed.exe"	jushed.exe
Key created	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Windows\CurrentVersion\Run	jushed.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java SE Platform Updater = "\"C:\\Users\\Admin\\AppData\\Roaming\\Java SE Platform Updater\\jusched.exe\""	jushed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jushed = "C:\\Users\\Admin\\AppData\\Roaming\\jushed.exe"	jushed.exe
Key created	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	jushed.exe

AutoIT Executable 8 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/1760-131-0x0000000000400000-0x00000000004B6000-memory.dmp	autoit_exe
behavioral2/memory/1924-135-0x0000000000400000-0x00000000004B6000-memory.dmp	autoit_exe
behavioral2/memory/1760-136-0x0000000000400000-0x00000000004B6000-memory.dmp	autoit_exe
behavioral2/memory/2556-151-0x0000000000400000-0x00000000004B6000-memory.dmp	autoit_exe
behavioral2/memory/2556-159-0x0000000000400000-0x00000000004B6000-memory.dmp	autoit_exe
behavioral2/memory/4276-160-0x0000000000400000-0x00000000004B6000-memory.dmp	autoit_exe
behavioral2/memory/1924-161-0x0000000000400000-0x00000000004B6000-memory.dmp	autoit_exe
behavioral2/memory/4276-171-0x0000000000400000-0x00000000004B6000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 11 IoCs

Processes:

jushed.exejushed.exe

description	pid	process	target process
PID 1924 set thread context of 1588	1924	jushed.exe	jushed.exe
PID 1924 set thread context of 4120	1924	jushed.exe	jushed.exe
PID 4276 set thread context of 2956	4276	jushed.exe	jushed.exe
PID 1924 set thread context of 2168	1924	jushed.exe	jushed.exe
PID 1924 set thread context of 2424	1924	jushed.exe	jushed.exe
PID 1924 set thread context of 1816	1924	jushed.exe	jushed.exe
PID 1924 set thread context of 2864	1924	jushed.exe	jushed.exe
PID 1924 set thread context of 4008	1924	jushed.exe	jushed.exe
PID 1924 set thread context of 1404	1924	jushed.exe	jushed.exe
PID 1924 set thread context of 4248	1924	jushed.exe	jushed.exe
PID 1924 set thread context of 2280	1924	jushed.exe	jushed.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4580	4120	WerFault.exe	jushed.exe
4968	2168	WerFault.exe	jushed.exe
4504	2424	WerFault.exe	jushed.exe
3956	1816	WerFault.exe	jushed.exe
1852	2864	WerFault.exe	jushed.exe
4080	4008	WerFault.exe	jushed.exe
4764	1404	WerFault.exe	jushed.exe
5064	4248	WerFault.exe	jushed.exe
1124	2280	WerFault.exe	jushed.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

jushed.exejushed.exe

pid	process
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
4276	jushed.exe
4276	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
1924	jushed.exe
4276	jushed.exe
4276	jushed.exe
1924	jushed.exe
1924	jushed.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6170b02c4866e58fb621b325b3d03d9935b2fe4daf7e3b5472d5d3bd261ab684.exejushed.exejushed.exejusched.exejushed.exejushed.exe

description	pid	process	target process
PID 1760 wrote to memory of 1924	1760	6170b02c4866e58fb621b325b3d03d9935b2fe4daf7e3b5472d5d3bd261ab684.exe	jushed.exe
PID 1760 wrote to memory of 1924	1760	6170b02c4866e58fb621b325b3d03d9935b2fe4daf7e3b5472d5d3bd261ab684.exe	jushed.exe
PID 1760 wrote to memory of 1924	1760	6170b02c4866e58fb621b325b3d03d9935b2fe4daf7e3b5472d5d3bd261ab684.exe	jushed.exe
PID 1924 wrote to memory of 1588	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 1588	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 1588	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 1588	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 1588	1924	jushed.exe	jushed.exe
PID 1588 wrote to memory of 2556	1588	jushed.exe	jusched.exe
PID 1588 wrote to memory of 2556	1588	jushed.exe	jusched.exe
PID 1588 wrote to memory of 2556	1588	jushed.exe	jusched.exe
PID 1924 wrote to memory of 4120	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 4120	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 4120	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 4120	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 4120	1924	jushed.exe	jushed.exe
PID 2556 wrote to memory of 4276	2556	jusched.exe	jushed.exe
PID 2556 wrote to memory of 4276	2556	jusched.exe	jushed.exe
PID 2556 wrote to memory of 4276	2556	jusched.exe	jushed.exe
PID 4276 wrote to memory of 2956	4276	jushed.exe	jushed.exe
PID 4276 wrote to memory of 2956	4276	jushed.exe	jushed.exe
PID 4276 wrote to memory of 2956	4276	jushed.exe	jushed.exe
PID 4276 wrote to memory of 2956	4276	jushed.exe	jushed.exe
PID 4276 wrote to memory of 2956	4276	jushed.exe	jushed.exe
PID 2956 wrote to memory of 1148	2956	jushed.exe	svchost.exe
PID 2956 wrote to memory of 1148	2956	jushed.exe	svchost.exe
PID 2956 wrote to memory of 1148	2956	jushed.exe	svchost.exe
PID 1924 wrote to memory of 2168	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 2168	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 2168	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 2168	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 2168	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 2424	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 2424	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 2424	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 2424	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 2424	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 1816	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 1816	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 1816	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 1816	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 1816	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 2864	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 2864	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 2864	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 2864	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 2864	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 4008	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 4008	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 4008	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 4008	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 4008	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 1404	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 1404	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 1404	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 1404	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 1404	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 4248	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 4248	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 4248	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 4248	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 4248	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 2280	1924	jushed.exe	jushed.exe
PID 1924 wrote to memory of 2280	1924	jushed.exe	jushed.exe

C:\Users\Admin\AppData\Local\Temp\6170b02c4866e58fb621b325b3d03d9935b2fe4daf7e3b5472d5d3bd261ab684.exe
"C:\Users\Admin\AppData\Local\Temp\6170b02c4866e58fb621b325b3d03d9935b2fe4daf7e3b5472d5d3bd261ab684.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1760

C:\Users\Admin\AppData\Roaming\jushed.exe
C:\Users\Admin\AppData\Roaming\jushed.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1924

C:\Users\Admin\AppData\Roaming\jushed.exe
"C:\Users\Admin\AppData\Roaming\jushed.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1588

C:\Users\Admin\AppData\Roaming\Java SE Platform Updater\jusched.exe
"C:\Users\Admin\AppData\Roaming\Java SE Platform Updater\jusched.exe" C:\Users\Admin\AppData\Roaming\jushed.exe
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556

C:\Users\Admin\AppData\Roaming\jushed.exe
C:\Users\Admin\AppData\Roaming\jushed.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4276

C:\Users\Admin\AppData\Roaming\jushed.exe
"C:\Users\Admin\AppData\Roaming\jushed.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2956

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
7⤵
- Executes dropped EXE
PID:1148

C:\Users\Admin\AppData\Roaming\jushed.exe
"C:\Users\Admin\AppData\Roaming\jushed.exe"
3⤵
- Executes dropped EXE
PID:4120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 320
4⤵
- Program crash
PID:4580

C:\Users\Admin\AppData\Roaming\jushed.exe
"C:\Users\Admin\AppData\Roaming\jushed.exe"
3⤵
- Executes dropped EXE
PID:2168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 328
4⤵
- Program crash
PID:4968

C:\Users\Admin\AppData\Roaming\jushed.exe
"C:\Users\Admin\AppData\Roaming\jushed.exe"
3⤵
- Executes dropped EXE
PID:2424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 312
4⤵
- Program crash
PID:4504

C:\Users\Admin\AppData\Roaming\jushed.exe
"C:\Users\Admin\AppData\Roaming\jushed.exe"
3⤵
- Executes dropped EXE
PID:1816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 312
4⤵
- Program crash
PID:3956

C:\Users\Admin\AppData\Roaming\jushed.exe
"C:\Users\Admin\AppData\Roaming\jushed.exe"
3⤵
- Executes dropped EXE
PID:2864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 324
4⤵
- Program crash
PID:1852

C:\Users\Admin\AppData\Roaming\jushed.exe
"C:\Users\Admin\AppData\Roaming\jushed.exe"
3⤵
- Executes dropped EXE
PID:4008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 328
4⤵
- Program crash
PID:4080

C:\Users\Admin\AppData\Roaming\jushed.exe
"C:\Users\Admin\AppData\Roaming\jushed.exe"
3⤵
- Executes dropped EXE
PID:1404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 312
4⤵
- Program crash
PID:4764

C:\Users\Admin\AppData\Roaming\jushed.exe
"C:\Users\Admin\AppData\Roaming\jushed.exe"
3⤵
- Executes dropped EXE
PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 312
4⤵
- Program crash
PID:5064

C:\Users\Admin\AppData\Roaming\jushed.exe
"C:\Users\Admin\AppData\Roaming\jushed.exe"
3⤵
- Executes dropped EXE
PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 328
4⤵
- Program crash
PID:1124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4120 -ip 4120
1⤵
PID:2872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2168 -ip 2168
1⤵
PID:2116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2424 -ip 2424
1⤵
PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1816 -ip 1816
1⤵
PID:1424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2864 -ip 2864
1⤵
PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4008 -ip 4008
1⤵
PID:3468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1404 -ip 1404
1⤵
PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4248 -ip 4248
1⤵
PID:3036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2280 -ip 2280
1⤵
PID:2624

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\res.ico
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\res.ico
Filesize
134KB

MD5
c3fb299fd88883c020d55eeaf5c3e453

SHA1
f801a266e152d8538c82773a683502153b3e6bac

SHA256
c471008a6c90ce3650f454e16bbcb17511d04c7e0fe868a2dce4f1678f140e0b

SHA512
f80e6e05354e1a09e1e96572635d0c2ac0196ed895e8a20c4489f0eab35b3b89a11b4e69568cb7588b07916d19cc73c726bc480f9a3358af8ddee1904ad9ac9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\res.ico
Filesize
134KB

MD5
c3fb299fd88883c020d55eeaf5c3e453

SHA1
f801a266e152d8538c82773a683502153b3e6bac

SHA256
c471008a6c90ce3650f454e16bbcb17511d04c7e0fe868a2dce4f1678f140e0b

SHA512
f80e6e05354e1a09e1e96572635d0c2ac0196ed895e8a20c4489f0eab35b3b89a11b4e69568cb7588b07916d19cc73c726bc480f9a3358af8ddee1904ad9ac9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\res.ico2
Filesize
134KB

MD5
c3fb299fd88883c020d55eeaf5c3e453

SHA1
f801a266e152d8538c82773a683502153b3e6bac

SHA256
c471008a6c90ce3650f454e16bbcb17511d04c7e0fe868a2dce4f1678f140e0b

SHA512
f80e6e05354e1a09e1e96572635d0c2ac0196ed895e8a20c4489f0eab35b3b89a11b4e69568cb7588b07916d19cc73c726bc480f9a3358af8ddee1904ad9ac9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe
Filesize
178KB

MD5
04d4986fe58edc324f7ed4a193242e2a

SHA1
72ce688ecca5f741f597773fb8640d3a7a98599c

SHA256
ef2d4c5dc95593b5096f1b5657c7649543e558eff47b3c66ae10ee71a73304a7

SHA512
5ae6a1588f25bba366bded951732be8dd3699ad5d6c56ba84c5ed44426b14021b8c2ff90d4c2161398fff79af6039011a18269dd7861f3ce3a89447661f30712

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe
Filesize
178KB

MD5
04d4986fe58edc324f7ed4a193242e2a

SHA1
72ce688ecca5f741f597773fb8640d3a7a98599c

SHA256
ef2d4c5dc95593b5096f1b5657c7649543e558eff47b3c66ae10ee71a73304a7

SHA512
5ae6a1588f25bba366bded951732be8dd3699ad5d6c56ba84c5ed44426b14021b8c2ff90d4c2161398fff79af6039011a18269dd7861f3ce3a89447661f30712

Download Submit
C:\Users\Admin\AppData\Roaming\Java SE Platform Updater\jusched.exe
Filesize
760KB

MD5
8629ef73d999bb67b6e403755371b19b

SHA1
a52f6baca6221930a4a9d98a12050bdb46218005

SHA256
6170b02c4866e58fb621b325b3d03d9935b2fe4daf7e3b5472d5d3bd261ab684

SHA512
d4b9395110b200caac0bbe4aee14f2c0feaaa1c5a9c0bff790bcd10091f34cadc7be0831a08284dd72bf51eaa13029db57bd8b4faba432752ca13a49f2d7393b

Download Submit
C:\Users\Admin\AppData\Roaming\Java SE Platform Updater\jusched.exe
Filesize
760KB

MD5
8629ef73d999bb67b6e403755371b19b

SHA1
a52f6baca6221930a4a9d98a12050bdb46218005

SHA256
6170b02c4866e58fb621b325b3d03d9935b2fe4daf7e3b5472d5d3bd261ab684

SHA512
d4b9395110b200caac0bbe4aee14f2c0feaaa1c5a9c0bff790bcd10091f34cadc7be0831a08284dd72bf51eaa13029db57bd8b4faba432752ca13a49f2d7393b

Download Submit
C:\Users\Admin\AppData\Roaming\jushed.exe
Filesize
760KB

MD5
8629ef73d999bb67b6e403755371b19b

SHA1
a52f6baca6221930a4a9d98a12050bdb46218005

SHA256
6170b02c4866e58fb621b325b3d03d9935b2fe4daf7e3b5472d5d3bd261ab684

SHA512
d4b9395110b200caac0bbe4aee14f2c0feaaa1c5a9c0bff790bcd10091f34cadc7be0831a08284dd72bf51eaa13029db57bd8b4faba432752ca13a49f2d7393b

Download Submit
C:\Users\Admin\AppData\Roaming\jushed.exe
Filesize
760KB

MD5
8629ef73d999bb67b6e403755371b19b

SHA1
a52f6baca6221930a4a9d98a12050bdb46218005

SHA256
6170b02c4866e58fb621b325b3d03d9935b2fe4daf7e3b5472d5d3bd261ab684

SHA512
d4b9395110b200caac0bbe4aee14f2c0feaaa1c5a9c0bff790bcd10091f34cadc7be0831a08284dd72bf51eaa13029db57bd8b4faba432752ca13a49f2d7393b

Download Submit
C:\Users\Admin\AppData\Roaming\jushed.exe
Filesize
760KB

MD5
8629ef73d999bb67b6e403755371b19b

SHA1
a52f6baca6221930a4a9d98a12050bdb46218005

SHA256
6170b02c4866e58fb621b325b3d03d9935b2fe4daf7e3b5472d5d3bd261ab684

SHA512
d4b9395110b200caac0bbe4aee14f2c0feaaa1c5a9c0bff790bcd10091f34cadc7be0831a08284dd72bf51eaa13029db57bd8b4faba432752ca13a49f2d7393b

Download Submit
C:\Users\Admin\AppData\Roaming\jushed.exe
Filesize
760KB

MD5
8629ef73d999bb67b6e403755371b19b

SHA1
a52f6baca6221930a4a9d98a12050bdb46218005

SHA256
6170b02c4866e58fb621b325b3d03d9935b2fe4daf7e3b5472d5d3bd261ab684

SHA512
d4b9395110b200caac0bbe4aee14f2c0feaaa1c5a9c0bff790bcd10091f34cadc7be0831a08284dd72bf51eaa13029db57bd8b4faba432752ca13a49f2d7393b

Download Submit
C:\Users\Admin\AppData\Roaming\jushed.exe
Filesize
760KB

MD5
8629ef73d999bb67b6e403755371b19b

SHA1
a52f6baca6221930a4a9d98a12050bdb46218005

SHA256
6170b02c4866e58fb621b325b3d03d9935b2fe4daf7e3b5472d5d3bd261ab684

SHA512
d4b9395110b200caac0bbe4aee14f2c0feaaa1c5a9c0bff790bcd10091f34cadc7be0831a08284dd72bf51eaa13029db57bd8b4faba432752ca13a49f2d7393b

Download Submit
C:\Users\Admin\AppData\Roaming\jushed.exe
Filesize
760KB

MD5
8629ef73d999bb67b6e403755371b19b

SHA1
a52f6baca6221930a4a9d98a12050bdb46218005

SHA256
6170b02c4866e58fb621b325b3d03d9935b2fe4daf7e3b5472d5d3bd261ab684

SHA512
d4b9395110b200caac0bbe4aee14f2c0feaaa1c5a9c0bff790bcd10091f34cadc7be0831a08284dd72bf51eaa13029db57bd8b4faba432752ca13a49f2d7393b

Download Submit
C:\Users\Admin\AppData\Roaming\jushed.exe
Filesize
760KB

MD5
8629ef73d999bb67b6e403755371b19b

SHA1
a52f6baca6221930a4a9d98a12050bdb46218005

SHA256
6170b02c4866e58fb621b325b3d03d9935b2fe4daf7e3b5472d5d3bd261ab684

SHA512
d4b9395110b200caac0bbe4aee14f2c0feaaa1c5a9c0bff790bcd10091f34cadc7be0831a08284dd72bf51eaa13029db57bd8b4faba432752ca13a49f2d7393b

Download Submit
C:\Users\Admin\AppData\Roaming\jushed.exe
Filesize
760KB

MD5
8629ef73d999bb67b6e403755371b19b

SHA1
a52f6baca6221930a4a9d98a12050bdb46218005

SHA256
6170b02c4866e58fb621b325b3d03d9935b2fe4daf7e3b5472d5d3bd261ab684

SHA512
d4b9395110b200caac0bbe4aee14f2c0feaaa1c5a9c0bff790bcd10091f34cadc7be0831a08284dd72bf51eaa13029db57bd8b4faba432752ca13a49f2d7393b

Download Submit
C:\Users\Admin\AppData\Roaming\jushed.exe
Filesize
760KB

MD5
8629ef73d999bb67b6e403755371b19b

SHA1
a52f6baca6221930a4a9d98a12050bdb46218005

SHA256
6170b02c4866e58fb621b325b3d03d9935b2fe4daf7e3b5472d5d3bd261ab684

SHA512
d4b9395110b200caac0bbe4aee14f2c0feaaa1c5a9c0bff790bcd10091f34cadc7be0831a08284dd72bf51eaa13029db57bd8b4faba432752ca13a49f2d7393b

Download Submit
C:\Users\Admin\AppData\Roaming\jushed.exe
Filesize
760KB

MD5
8629ef73d999bb67b6e403755371b19b

SHA1
a52f6baca6221930a4a9d98a12050bdb46218005

SHA256
6170b02c4866e58fb621b325b3d03d9935b2fe4daf7e3b5472d5d3bd261ab684

SHA512
d4b9395110b200caac0bbe4aee14f2c0feaaa1c5a9c0bff790bcd10091f34cadc7be0831a08284dd72bf51eaa13029db57bd8b4faba432752ca13a49f2d7393b

Download Submit
C:\Users\Admin\AppData\Roaming\jushed.exe
Filesize
760KB

MD5
8629ef73d999bb67b6e403755371b19b

SHA1
a52f6baca6221930a4a9d98a12050bdb46218005

SHA256
6170b02c4866e58fb621b325b3d03d9935b2fe4daf7e3b5472d5d3bd261ab684

SHA512
d4b9395110b200caac0bbe4aee14f2c0feaaa1c5a9c0bff790bcd10091f34cadc7be0831a08284dd72bf51eaa13029db57bd8b4faba432752ca13a49f2d7393b

Download Submit
C:\Users\Admin\AppData\Roaming\jushed.exe
Filesize
760KB

MD5
8629ef73d999bb67b6e403755371b19b

SHA1
a52f6baca6221930a4a9d98a12050bdb46218005

SHA256
6170b02c4866e58fb621b325b3d03d9935b2fe4daf7e3b5472d5d3bd261ab684

SHA512
d4b9395110b200caac0bbe4aee14f2c0feaaa1c5a9c0bff790bcd10091f34cadc7be0831a08284dd72bf51eaa13029db57bd8b4faba432752ca13a49f2d7393b

Download Submit
C:\Users\Admin\AppData\Roaming\jushed.exe
Filesize
760KB

MD5
8629ef73d999bb67b6e403755371b19b

SHA1
a52f6baca6221930a4a9d98a12050bdb46218005

SHA256
6170b02c4866e58fb621b325b3d03d9935b2fe4daf7e3b5472d5d3bd261ab684

SHA512
d4b9395110b200caac0bbe4aee14f2c0feaaa1c5a9c0bff790bcd10091f34cadc7be0831a08284dd72bf51eaa13029db57bd8b4faba432752ca13a49f2d7393b

Download Submit
C:\Users\Admin\AppData\Roaming\jushed.exe
Filesize
760KB

MD5
8629ef73d999bb67b6e403755371b19b

SHA1
a52f6baca6221930a4a9d98a12050bdb46218005

SHA256
6170b02c4866e58fb621b325b3d03d9935b2fe4daf7e3b5472d5d3bd261ab684

SHA512
d4b9395110b200caac0bbe4aee14f2c0feaaa1c5a9c0bff790bcd10091f34cadc7be0831a08284dd72bf51eaa13029db57bd8b4faba432752ca13a49f2d7393b

Download Submit
memory/1148-172-0x0000000000000000-mapping.dmp

Download
memory/1404-200-0x0000000000000000-mapping.dmp

Download
memory/1588-144-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1588-145-0x00000000000D0000-0x0000000000148000-memory.dmp

Filesize
480KB

Download
memory/1588-149-0x00000000000D0000-0x0000000000148000-memory.dmp

Filesize
480KB

Download
memory/1588-143-0x00000000000D0000-0x0000000000148000-memory.dmp

Filesize
480KB

Download
memory/1588-138-0x0000000000000000-mapping.dmp

Download
memory/1588-139-0x00000000000D0000-0x0000000000148000-memory.dmp

Filesize
480KB

Download
memory/1588-142-0x00000000000D0000-0x0000000000148000-memory.dmp

Filesize
480KB

Download
memory/1760-131-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1760-130-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1760-136-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1816-185-0x0000000000000000-mapping.dmp

Download
memory/1924-161-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1924-135-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/1924-132-0x0000000000000000-mapping.dmp

Download
memory/2168-175-0x0000000000000000-mapping.dmp

Download
memory/2280-210-0x0000000000000000-mapping.dmp

Download
memory/2424-180-0x0000000000000000-mapping.dmp

Download
memory/2556-151-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2556-146-0x0000000000000000-mapping.dmp

Download
memory/2556-159-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2864-190-0x0000000000000000-mapping.dmp

Download
memory/2956-170-0x00000000000D0000-0x0000000000148000-memory.dmp

Filesize
480KB

Download
memory/2956-164-0x0000000000000000-mapping.dmp

Download
memory/4008-195-0x0000000000000000-mapping.dmp

Download
memory/4120-152-0x00000000000D0000-0x0000000000148000-memory.dmp

Filesize
480KB

Download
memory/4120-150-0x0000000000000000-mapping.dmp

Download
memory/4120-155-0x00000000000D0000-0x0000000000148000-memory.dmp

Filesize
480KB

Download
memory/4248-205-0x0000000000000000-mapping.dmp

Download
memory/4276-157-0x0000000000000000-mapping.dmp

Download
memory/4276-160-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/4276-171-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download