Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 23:10
Static task
static1
Behavioral task
behavioral1
Sample
3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe
-
Size
82KB
-
MD5
01c5a9b1222cacab6a30b384d905e300
-
SHA1
0af2d488e99e0664667dcbd82ce9ceb051a5f511
-
SHA256
3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8
-
SHA512
d65ecfc16da5275629d4e6b71bffc4966587709fab67ad10e8dc3e0f9d7da1ce4ae3df3a0860dfa06abc352ad0dc81cf0a47528111623620760ee207daa65631
-
SSDEEP
1536:saDiQbValrtcRoBSclCQpr68ZGvPcZGvUZGv:5DDal5cRKSckD8QPcQUQ
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 528 jusched.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched = "C:\\Users\\Admin\\AppData\\Roaming\\jusched.exe" 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\v: 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File opened (read-only) \??\u: 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File opened (read-only) \??\r: 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File opened (read-only) \??\x: 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File opened (read-only) \??\y: 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File opened (read-only) \??\t: 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File opened (read-only) \??\o: 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File opened (read-only) \??\n: 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File opened (read-only) \??\h: 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File opened (read-only) \??\f: 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File opened (read-only) \??\z: 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File opened (read-only) \??\q: 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File opened (read-only) \??\m: 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File opened (read-only) \??\i: 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File opened (read-only) \??\g: 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File opened (read-only) \??\e: 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File opened (read-only) \??\s: 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File opened (read-only) \??\p: 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File opened (read-only) \??\l: 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File opened (read-only) \??\k: 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File opened (read-only) \??\j: 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File opened (read-only) \??\w: 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\emule\incoming\Trojan Killer 2.0.6.4 Patch.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\kazaa\my shared folder\WinRAR-3 91 Full + Keymaker.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\kazaa lite\my shared folder\Xilisoft Burn Pro v1 0 64 0112 Keygen.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\kazaa lite k++\my shared folder\Autorun Virus Remover v2 3 1022-Lz0.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\grokster\my grokster\Microsoft AutoCollage 2008.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\bearshare\shared\Uniture Memory Booster v6 1 0 5158-MESMERiZE.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\edonkey2000\incoming\Xilisoft Apple TV Video Converter v5 1 26 1030 Inc.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\tesla\files\MS Office 2007 Activation KeyGen.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\kazaa lite\my shared folder\DiceRoller2 0.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\grokster\my grokster\paypal hack 2010.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\grokster\my grokster\Miscrosoft Office Ultimate 2007.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\grokster\my grokster\Recover Keys v3 0 3 7-MAZE.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\morpheus\my shared folder\Web Dumper 3.1.1 Keygen.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\tesla\files\WinZip PRO v12.1 + Serials.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\kazaa\my shared folder\Xilisoft Apple TV Video Converter v5 1 26 1030 Inc.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\kazaa lite k++\my shared folder\Xilisoft CD Ripper v1 0 47 0904 Keygen.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\grokster\my grokster\Adobe Photoshop CS4 KeyGen.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\grokster\my grokster\WinRAR 3.92 Final.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\bearshare\shared\Loaris Trojan Remover 1.2.0 Patch.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\limewire\shared\LimeWire Pro.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\winmx\shared\paypal hack 2010.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\kazaa lite\my shared folder\kaspersky license key 2010.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\kazaa lite\my shared folder\WinZip PRO v12.1 + Serials.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\grokster\my grokster\Borderlands Proper-Razor1911.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\bearshare\shared\Atomix Virtual DJ v6.0.2 FINAL Professional.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\bearshare\shared\Recover Keys v3 0 3 7-MAZE.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\edonkey2000\incoming\LimeWire.Pro.v5.4.6.1.Multilingual.Retail-ZWT.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\limewire\shared\cute dogs screensaver.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\kazaa lite\my shared folder\Adobe Photoshop CS4 Extended + Keygen + Activation.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\icq\shared folder\Adobe Photoshop CS4 KeyGen.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\grokster\my grokster\RuneScape 2010 - Newest Exploits.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\bearshare\shared\Driver Genius Professional 2009 9.0.0 Build 186.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\edonkey2000\incoming\Sony Vegas Pro 9.0 Full.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\tesla\files\DesktopCalendar.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\winmx\shared\Dr Web AntiVirus v5 0 10 11260 R-EAT.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\icq\shared folder\Windows 2008 Server KeyGen.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\icq\shared folder\DiceRoller2 0.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\icq\shared folder\YouTube Downloader all Access.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\icq\shared folder\Yamicsoft Windows 7 Manager v1 1 8 x64.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\bearshare\shared\facebook for dummies.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\bearshare\shared\Error Repair Professional 4 1 3 AT4RE DM999.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\winmx\shared\kaspersky license key 2010.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\winmx\shared\Borderlands Proper-Razor1911.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\kazaa lite\my shared folder\Setup OneCare for Windows 7.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\icq\shared folder\Microsoft AutoCollage 2008.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\icq\shared folder\Atomix Virtual DJ v6.0.2 FINAL Professional.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\winmx\shared\Recover Keys v3 0 3 7-MAZE.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\kazaa\my shared folder\LimeWire.Pro.v5.4.6.1.Multilingual.Retail-ZWT.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\grokster\my grokster\YouTube Downloader all Access.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\bearshare\shared\Garmin mobile xt keygen.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\kazaa lite k++\my shared folder\Sony Vegas Pro 9.0 Full.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\morpheus\my shared folder\Driver Genius Professional 2009 9.0.0 Build 186.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\winmx\shared\Web Dumper 3.1.1 Keygen.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\winmx\shared\LimeWire Pro.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\bearshare\shared\LimeWire Pro.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\emule\incoming\Babylon 8 - Instant translation tool.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\tesla\files\Microsoft Office Professional Plus x32 x64 2010.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\icq\shared folder\kaspersky license key 2010.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\icq\shared folder\Error Repair Professional 4 1 3 AT4RE DM999.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\emule\incoming\Website X5 Designer v7.7 WYSIWYG Website Creator.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\kazaa\my shared folder\Diskeeper 2010 Pro Premier v14 0 900t Final.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\icq\shared folder\Xilisoft Blu Ray Ripper v5 2 4 0108 Keygen.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\limewire\shared\ScreenCapture 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe File created C:\Program Files (x86)\morpheus\my shared folder\Windows 7 Toolkit v1.8 activations+full suite.exe 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3204 wrote to memory of 528 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 85 PID 3204 wrote to memory of 528 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 85 PID 3204 wrote to memory of 528 3204 3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe"C:\Users\Admin\AppData\Local\Temp\3791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Roaming\jusched.exe"C:\Users\Admin\AppData\Roaming\jusched.exe"2⤵
- Executes dropped EXE
PID:528
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD501c5a9b1222cacab6a30b384d905e300
SHA10af2d488e99e0664667dcbd82ce9ceb051a5f511
SHA2563791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8
SHA512d65ecfc16da5275629d4e6b71bffc4966587709fab67ad10e8dc3e0f9d7da1ce4ae3df3a0860dfa06abc352ad0dc81cf0a47528111623620760ee207daa65631
-
Filesize
82KB
MD501c5a9b1222cacab6a30b384d905e300
SHA10af2d488e99e0664667dcbd82ce9ceb051a5f511
SHA2563791ac64f6d7202d2bb05cad93d46c7e8e1ccdf6f5a309f132d0b9317920aea8
SHA512d65ecfc16da5275629d4e6b71bffc4966587709fab67ad10e8dc3e0f9d7da1ce4ae3df3a0860dfa06abc352ad0dc81cf0a47528111623620760ee207daa65631