4c941ca70a2fff6bb268a01cf0011efb1b0856abb372a030bcdaa0a916ba1c15

Analysis

max time kernel
146s
max time network
149s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 21:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c941ca70a2fff6bb268a01cf0011efb1b0856abb372a030bcdaa0a916ba1c15.exe
Size

35KB
MD5

f94a517ed28a7ffc4012caba54e76271
SHA1

43865e57d84c4624b66c40c62171860e6665ab2c
SHA256

4c941ca70a2fff6bb268a01cf0011efb1b0856abb372a030bcdaa0a916ba1c15
SHA512

f1b563d4489b9f0101ba421a39bd378bf85b94865418afbd485ac95bdbebfc147d65a1208f9377d25d866a3e480c1d8e97ad07c5bef458e73cce5a80dd8a41b6
SSDEEP

768:cflivXrVKpVhKvtxwYHwVFoeAQumucwU/C:ylqrVKprVuQuoC

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
908	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
1800	4c941ca70a2fff6bb268a01cf0011efb1b0856abb372a030bcdaa0a916ba1c15.exe
1800	4c941ca70a2fff6bb268a01cf0011efb1b0856abb372a030bcdaa0a916ba1c15.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ddf527db\jusched.exe	4c941ca70a2fff6bb268a01cf0011efb1b0856abb372a030bcdaa0a916ba1c15.exe
File created	C:\Program Files (x86)\ddf527db\ddf527db	4c941ca70a2fff6bb268a01cf0011efb1b0856abb372a030bcdaa0a916ba1c15.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe
908	jusched.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 908	1800	4c941ca70a2fff6bb268a01cf0011efb1b0856abb372a030bcdaa0a916ba1c15.exe	28
PID 1800 wrote to memory of 908	1800	4c941ca70a2fff6bb268a01cf0011efb1b0856abb372a030bcdaa0a916ba1c15.exe	28
PID 1800 wrote to memory of 908	1800	4c941ca70a2fff6bb268a01cf0011efb1b0856abb372a030bcdaa0a916ba1c15.exe	28
PID 1800 wrote to memory of 908	1800	4c941ca70a2fff6bb268a01cf0011efb1b0856abb372a030bcdaa0a916ba1c15.exe	28

C:\Users\Admin\AppData\Local\Temp\4c941ca70a2fff6bb268a01cf0011efb1b0856abb372a030bcdaa0a916ba1c15.exe
"C:\Users\Admin\AppData\Local\Temp\4c941ca70a2fff6bb268a01cf0011efb1b0856abb372a030bcdaa0a916ba1c15.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Program Files (x86)\ddf527db\jusched.exe
  "C:\Program Files (x86)\ddf527db\jusched.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\ddf527db\ddf527db

Filesize
13B

MD5
f253efe302d32ab264a76e0ce65be769

SHA1
768685ca582abd0af2fbb57ca37752aa98c9372b

SHA256
49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd

SHA512
1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4

Download Submit
C:\Program Files (x86)\ddf527db\jusched.exe

Filesize
35KB

MD5
78ce770d6cd6f0ae0e67d3fb22ebc7a0

SHA1
0d54ebec5763c1edb4329cd339a30f552a97691c

SHA256
c7623d42b289846d21c4212cf94c49ced89fb8ae3fd27f4585b033b16ce27495

SHA512
94032134b29c1e43368b0531e688aa0fe1cc24761374208ba492ace06995669e02f75138f7e8b761cc028b9b4c5049b64e24beadac1be9c17cb7f75eedcaf162

Download Submit
\Program Files (x86)\ddf527db\jusched.exe

Filesize
35KB

MD5
78ce770d6cd6f0ae0e67d3fb22ebc7a0

SHA1
0d54ebec5763c1edb4329cd339a30f552a97691c

SHA256
c7623d42b289846d21c4212cf94c49ced89fb8ae3fd27f4585b033b16ce27495

SHA512
94032134b29c1e43368b0531e688aa0fe1cc24761374208ba492ace06995669e02f75138f7e8b761cc028b9b4c5049b64e24beadac1be9c17cb7f75eedcaf162

Download Submit
\Program Files (x86)\ddf527db\jusched.exe

Filesize
35KB

MD5
78ce770d6cd6f0ae0e67d3fb22ebc7a0

SHA1
0d54ebec5763c1edb4329cd339a30f552a97691c

SHA256
c7623d42b289846d21c4212cf94c49ced89fb8ae3fd27f4585b033b16ce27495

SHA512
94032134b29c1e43368b0531e688aa0fe1cc24761374208ba492ace06995669e02f75138f7e8b761cc028b9b4c5049b64e24beadac1be9c17cb7f75eedcaf162

Download Submit
memory/1800-54-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download