2a85d34dc5031bc90bef4a4143b4bc6e5185f274834bc1217fee3c347797c0a8

General

Target

2a85d34dc5031bc90bef4a4143b4bc6e5185f274834bc1217fee3c347797c0a8.exe
Size

208KB
MD5

579b3022de2fcfddb8c38cb3b634624f
SHA1

a35ce0ae2d5fde78f26a2ca04367038d100c725e
SHA256

2a85d34dc5031bc90bef4a4143b4bc6e5185f274834bc1217fee3c347797c0a8
SHA512

2340050f9aa6b1eee7650ee90195bf761e8286215b66d26f18362d14077d10a98725cc2c1b88560799475f2cbdf0102bcea808ff2c543afeb9fd07c92164f7d9
SSDEEP

1536:+NSXbc74YTOnlNSUL09atT0mBBA7aKSvIYFwA/dvoQQO5:+Eo75OnPSI09qgmBBAGKSvwIvoQ9

Score

10^/10

persistence

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1496	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
1960	2a85d34dc5031bc90bef4a4143b4bc6e5185f274834bc1217fee3c347797c0a8.exe
1960	2a85d34dc5031bc90bef4a4143b4bc6e5185f274834bc1217fee3c347797c0a8.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	2a85d34dc5031bc90bef4a4143b4bc6e5185f274834bc1217fee3c347797c0a8.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	2a85d34dc5031bc90bef4a4143b4bc6e5185f274834bc1217fee3c347797c0a8.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\d218d815\jusched.exe	2a85d34dc5031bc90bef4a4143b4bc6e5185f274834bc1217fee3c347797c0a8.exe
File created	C:\Program Files (x86)\d218d815\d218d815	2a85d34dc5031bc90bef4a4143b4bc6e5185f274834bc1217fee3c347797c0a8.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	2a85d34dc5031bc90bef4a4143b4bc6e5185f274834bc1217fee3c347797c0a8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1496	1960	2a85d34dc5031bc90bef4a4143b4bc6e5185f274834bc1217fee3c347797c0a8.exe	26
PID 1960 wrote to memory of 1496	1960	2a85d34dc5031bc90bef4a4143b4bc6e5185f274834bc1217fee3c347797c0a8.exe	26
PID 1960 wrote to memory of 1496	1960	2a85d34dc5031bc90bef4a4143b4bc6e5185f274834bc1217fee3c347797c0a8.exe	26
PID 1960 wrote to memory of 1496	1960	2a85d34dc5031bc90bef4a4143b4bc6e5185f274834bc1217fee3c347797c0a8.exe	26

C:\Users\Admin\AppData\Local\Temp\2a85d34dc5031bc90bef4a4143b4bc6e5185f274834bc1217fee3c347797c0a8.exe
"C:\Users\Admin\AppData\Local\Temp\2a85d34dc5031bc90bef4a4143b4bc6e5185f274834bc1217fee3c347797c0a8.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Program Files (x86)\d218d815\jusched.exe
  "C:\Program Files (x86)\d218d815\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:1496

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\d218d815\d218d815

Filesize
17B

MD5
3330ebaaa7e9f4630f4ad4c156be59d8

SHA1
40375cf8e68671e0100e725de5cd5c6657b9f722

SHA256
2c8451d5dca9e68ec3af7f318c5d874fbdfea9e89e7b5f9922b4dbd65f027e15

SHA512
b7631f9685bac9f81aa6bf53afd839910773e108989bbb79ba39cafabbe6b6994ed2fde44911c9f7f24b45c9745d6e80cd9f01975bfb765561df4881f7dad696

Download Submit
C:\Program Files (x86)\d218d815\jusched.exe

Filesize
208KB

MD5
b08d2252970cc206f1c3e65e97f4e35f

SHA1
8932867e0f48c40da5024c9b04cfb9d0f5a3ac5e

SHA256
0b93da3f542112b0f1c8f2911853b3ddab89936c132203f0f85af16558c099cc

SHA512
013d927e31909aa2372d824916ac4bf912c52bcd25cdf663be60bf1d36fe85cc7c74f1e73d729dec7f239289d7fb29ceb0ed99026b3fc2903e5afa9dce9b8922

Download Submit
\Program Files (x86)\d218d815\jusched.exe

Filesize
208KB

MD5
b08d2252970cc206f1c3e65e97f4e35f

SHA1
8932867e0f48c40da5024c9b04cfb9d0f5a3ac5e

SHA256
0b93da3f542112b0f1c8f2911853b3ddab89936c132203f0f85af16558c099cc

SHA512
013d927e31909aa2372d824916ac4bf912c52bcd25cdf663be60bf1d36fe85cc7c74f1e73d729dec7f239289d7fb29ceb0ed99026b3fc2903e5afa9dce9b8922

Download Submit
\Program Files (x86)\d218d815\jusched.exe

Filesize
208KB

MD5
b08d2252970cc206f1c3e65e97f4e35f

SHA1
8932867e0f48c40da5024c9b04cfb9d0f5a3ac5e

SHA256
0b93da3f542112b0f1c8f2911853b3ddab89936c132203f0f85af16558c099cc

SHA512
013d927e31909aa2372d824916ac4bf912c52bcd25cdf663be60bf1d36fe85cc7c74f1e73d729dec7f239289d7fb29ceb0ed99026b3fc2903e5afa9dce9b8922

Download Submit
memory/1496-61-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1960-54-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1960-55-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/1960-60-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download

Analysis

Sharing