22ef86f1e576a6c2cb442d1fcc5092ffeb05943a95a7916e6dec72cdbd4a025b

Analysis

max time kernel
143s
max time network
150s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19-10-2022 20:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22ef86f1e576a6c2cb442d1fcc5092ffeb05943a95a7916e6dec72cdbd4a025b.exe
Size

198KB
MD5

a1aa46252a269de3b8a88b641f985530
SHA1

8c26f7888a6e6532fcef54568c7262ec942db112
SHA256

22ef86f1e576a6c2cb442d1fcc5092ffeb05943a95a7916e6dec72cdbd4a025b
SHA512

6e6f4e7cbb3e5dbad6999d601856be0ecf321b10577172d13ed57a5dd2a093b005a15b13820bf4b2895161138f8bda04e05bf50e999b9eab98362f55ac5fb76d
SSDEEP

1536:JXBhCQCq4mFVsIgvo3X4iZpTha5VlA8mH7aoHayXzR:JX74mFmIgvo4iZhha5rOaoHfV

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
764	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
620	22ef86f1e576a6c2cb442d1fcc5092ffeb05943a95a7916e6dec72cdbd4a025b.exe
620	22ef86f1e576a6c2cb442d1fcc5092ffeb05943a95a7916e6dec72cdbd4a025b.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\995ec10c\jusched.exe	22ef86f1e576a6c2cb442d1fcc5092ffeb05943a95a7916e6dec72cdbd4a025b.exe
File created	C:\Program Files (x86)\995ec10c\995ec10c	22ef86f1e576a6c2cb442d1fcc5092ffeb05943a95a7916e6dec72cdbd4a025b.exe
File created	C:\Program Files (x86)\995ec10c\info_a	22ef86f1e576a6c2cb442d1fcc5092ffeb05943a95a7916e6dec72cdbd4a025b.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	22ef86f1e576a6c2cb442d1fcc5092ffeb05943a95a7916e6dec72cdbd4a025b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 764	620	22ef86f1e576a6c2cb442d1fcc5092ffeb05943a95a7916e6dec72cdbd4a025b.exe	27
PID 620 wrote to memory of 764	620	22ef86f1e576a6c2cb442d1fcc5092ffeb05943a95a7916e6dec72cdbd4a025b.exe	27
PID 620 wrote to memory of 764	620	22ef86f1e576a6c2cb442d1fcc5092ffeb05943a95a7916e6dec72cdbd4a025b.exe	27
PID 620 wrote to memory of 764	620	22ef86f1e576a6c2cb442d1fcc5092ffeb05943a95a7916e6dec72cdbd4a025b.exe	27

C:\Users\Admin\AppData\Local\Temp\22ef86f1e576a6c2cb442d1fcc5092ffeb05943a95a7916e6dec72cdbd4a025b.exe
"C:\Users\Admin\AppData\Local\Temp\22ef86f1e576a6c2cb442d1fcc5092ffeb05943a95a7916e6dec72cdbd4a025b.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:620
- C:\Program Files (x86)\995ec10c\jusched.exe
  "C:\Program Files (x86)\995ec10c\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\995ec10c\995ec10c

Filesize
17B

MD5
ea30f8139bb911f029a1e7cbe45ed983

SHA1
0eb7dec5427d1d3c0a51678feab94aea2716cfa4

SHA256
795b20420c630ebd74c12699428fe7ec4c3270ec3429d347d096356dc27ea32b

SHA512
b19671e73af17bb4f0d22e70ccb1e85786e2a3bf4aa54225e80b76ec82bceeef4228f86e7511520ddc08c3c4c33d55fe9a767644e1014d83e0149bbfa767ed04

Download Submit
C:\Program Files (x86)\995ec10c\info_a

Filesize
12B

MD5
a0b34c6649594d7ce4c26e96c8f3be5f

SHA1
4b41e6b139d198f89aa5a9147a0479e424bde115

SHA256
96b1b410a865bb0d34f6598925577e582fea905c59f80fc3cbe2301ef448e75a

SHA512
fb07ec2e718ad0d1c1184180642b64d1ed589d90937a4317feeda127c658450cef3e7d2d64105ab0b582dad8f2909a6cd0ffcd013beeb07eac3be492c73d0d07

Download Submit
C:\Program Files (x86)\995ec10c\jusched.exe

Filesize
198KB

MD5
f795608a1e45fe5999236495bdb8e86c

SHA1
844e4ea61d86305232d6feb4dbe2f412f1ca521f

SHA256
bcae54f92f33ad068c04fce69ec5defcc5e4144e3447348699b1cfea8361a9e4

SHA512
2002695ae0443afcdd1127c30ba6a646c4bdd6789231896247a97c2c5237eda5921dc6780ba8e1b20fcc6f9ecdcf094a689e1958b90e2e5871ba17ef4a73767f

Download Submit
\Program Files (x86)\995ec10c\jusched.exe

Filesize
198KB

MD5
f795608a1e45fe5999236495bdb8e86c

SHA1
844e4ea61d86305232d6feb4dbe2f412f1ca521f

SHA256
bcae54f92f33ad068c04fce69ec5defcc5e4144e3447348699b1cfea8361a9e4

SHA512
2002695ae0443afcdd1127c30ba6a646c4bdd6789231896247a97c2c5237eda5921dc6780ba8e1b20fcc6f9ecdcf094a689e1958b90e2e5871ba17ef4a73767f

Download Submit
\Program Files (x86)\995ec10c\jusched.exe

Filesize
198KB

MD5
f795608a1e45fe5999236495bdb8e86c

SHA1
844e4ea61d86305232d6feb4dbe2f412f1ca521f

SHA256
bcae54f92f33ad068c04fce69ec5defcc5e4144e3447348699b1cfea8361a9e4

SHA512
2002695ae0443afcdd1127c30ba6a646c4bdd6789231896247a97c2c5237eda5921dc6780ba8e1b20fcc6f9ecdcf094a689e1958b90e2e5871ba17ef4a73767f

Download Submit
memory/620-54-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download