68b826bb7aa10fea464dd20a8ae8550c9b2d34a57e164d352afd9c8448ee4e9a

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68b826bb7aa10fea464dd20a8ae8550c9b2d34a57e164d352afd9c8448ee4e9a.exe
Size

61KB
MD5

78ac96474e7782c3778711e97bdb16e0
SHA1

b415f9a0da7ff296fde3ea0204703e5603185d27
SHA256

68b826bb7aa10fea464dd20a8ae8550c9b2d34a57e164d352afd9c8448ee4e9a
SHA512

f753884bcdd6667ccd9926e9fa076b322e88b8df122b45f75a3179f41dce1bc3a3bbec8c6e28cd21440395792f4528525ba4cd3ad5e94dd1acbfb984d9c807ca
SSDEEP

768:bzQYScGrIubHuYtvdxwYHw5FAe2Qoncwx99LDDJ6PFiartuQ:fQTIubHy5wQoh9Kiax

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4528	jusched.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	68b826bb7aa10fea464dd20a8ae8550c9b2d34a57e164d352afd9c8448ee4e9a.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\7993b105\7993b105	68b826bb7aa10fea464dd20a8ae8550c9b2d34a57e164d352afd9c8448ee4e9a.exe
File created	C:\Program Files (x86)\7993b105\jusched.exe	68b826bb7aa10fea464dd20a8ae8550c9b2d34a57e164d352afd9c8448ee4e9a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe
4528	jusched.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 4528	2300	68b826bb7aa10fea464dd20a8ae8550c9b2d34a57e164d352afd9c8448ee4e9a.exe	82
PID 2300 wrote to memory of 4528	2300	68b826bb7aa10fea464dd20a8ae8550c9b2d34a57e164d352afd9c8448ee4e9a.exe	82
PID 2300 wrote to memory of 4528	2300	68b826bb7aa10fea464dd20a8ae8550c9b2d34a57e164d352afd9c8448ee4e9a.exe	82

C:\Users\Admin\AppData\Local\Temp\68b826bb7aa10fea464dd20a8ae8550c9b2d34a57e164d352afd9c8448ee4e9a.exe
"C:\Users\Admin\AppData\Local\Temp\68b826bb7aa10fea464dd20a8ae8550c9b2d34a57e164d352afd9c8448ee4e9a.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Program Files (x86)\7993b105\jusched.exe
  "C:\Program Files (x86)\7993b105\jusched.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4528

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\7993b105\7993b105

Filesize
13B

MD5
f253efe302d32ab264a76e0ce65be769

SHA1
768685ca582abd0af2fbb57ca37752aa98c9372b

SHA256
49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd

SHA512
1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4

Download Submit
C:\Program Files (x86)\7993b105\jusched.exe

Filesize
61KB

MD5
2dd629cb8d61cae71d6396b43d90c766

SHA1
ff31392eeedc3590b6241cae592688f49882238a

SHA256
09d455dd44d536dd909b3519b695e5437bd8deba83f9e0f47ff9f670ac329fff

SHA512
41283c60442f3bdf5bf736f1a5a9c13c4a7d7ec738a4303c344a639abf60a3fd312b8d23e1c00f59f17b7847f1463ee2d2e7110269b1c889975a12943230da75

Download Submit
C:\Program Files (x86)\7993b105\jusched.exe

Filesize
61KB

MD5
2dd629cb8d61cae71d6396b43d90c766

SHA1
ff31392eeedc3590b6241cae592688f49882238a

SHA256
09d455dd44d536dd909b3519b695e5437bd8deba83f9e0f47ff9f670ac329fff

SHA512
41283c60442f3bdf5bf736f1a5a9c13c4a7d7ec738a4303c344a639abf60a3fd312b8d23e1c00f59f17b7847f1463ee2d2e7110269b1c889975a12943230da75

Download Submit
memory/2300-132-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2300-136-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4528-137-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download