22ef86f1e576a6c2cb442d1fcc5092ffeb05943a95a7916e6dec72cdbd4a025b

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19-10-2022 20:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22ef86f1e576a6c2cb442d1fcc5092ffeb05943a95a7916e6dec72cdbd4a025b.exe
Size

198KB
MD5

a1aa46252a269de3b8a88b641f985530
SHA1

8c26f7888a6e6532fcef54568c7262ec942db112
SHA256

22ef86f1e576a6c2cb442d1fcc5092ffeb05943a95a7916e6dec72cdbd4a025b
SHA512

6e6f4e7cbb3e5dbad6999d601856be0ecf321b10577172d13ed57a5dd2a093b005a15b13820bf4b2895161138f8bda04e05bf50e999b9eab98362f55ac5fb76d
SSDEEP

1536:JXBhCQCq4mFVsIgvo3X4iZpTha5VlA8mH7aoHayXzR:JX74mFmIgvo4iZhha5rOaoHfV

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2232	jusched.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	22ef86f1e576a6c2cb442d1fcc5092ffeb05943a95a7916e6dec72cdbd4a025b.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\3ac8d391\jusched.exe	22ef86f1e576a6c2cb442d1fcc5092ffeb05943a95a7916e6dec72cdbd4a025b.exe
File created	C:\Program Files (x86)\3ac8d391\3ac8d391	22ef86f1e576a6c2cb442d1fcc5092ffeb05943a95a7916e6dec72cdbd4a025b.exe
File created	C:\Program Files (x86)\3ac8d391\info_a	22ef86f1e576a6c2cb442d1fcc5092ffeb05943a95a7916e6dec72cdbd4a025b.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	22ef86f1e576a6c2cb442d1fcc5092ffeb05943a95a7916e6dec72cdbd4a025b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 360 wrote to memory of 2232	360	22ef86f1e576a6c2cb442d1fcc5092ffeb05943a95a7916e6dec72cdbd4a025b.exe	87
PID 360 wrote to memory of 2232	360	22ef86f1e576a6c2cb442d1fcc5092ffeb05943a95a7916e6dec72cdbd4a025b.exe	87
PID 360 wrote to memory of 2232	360	22ef86f1e576a6c2cb442d1fcc5092ffeb05943a95a7916e6dec72cdbd4a025b.exe	87

C:\Users\Admin\AppData\Local\Temp\22ef86f1e576a6c2cb442d1fcc5092ffeb05943a95a7916e6dec72cdbd4a025b.exe
"C:\Users\Admin\AppData\Local\Temp\22ef86f1e576a6c2cb442d1fcc5092ffeb05943a95a7916e6dec72cdbd4a025b.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:360
- C:\Program Files (x86)\3ac8d391\jusched.exe
  "C:\Program Files (x86)\3ac8d391\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:2232

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\3ac8d391\3ac8d391

Filesize
17B

MD5
ea30f8139bb911f029a1e7cbe45ed983

SHA1
0eb7dec5427d1d3c0a51678feab94aea2716cfa4

SHA256
795b20420c630ebd74c12699428fe7ec4c3270ec3429d347d096356dc27ea32b

SHA512
b19671e73af17bb4f0d22e70ccb1e85786e2a3bf4aa54225e80b76ec82bceeef4228f86e7511520ddc08c3c4c33d55fe9a767644e1014d83e0149bbfa767ed04

Download Submit
C:\Program Files (x86)\3ac8d391\info_a

Filesize
12B

MD5
a0b34c6649594d7ce4c26e96c8f3be5f

SHA1
4b41e6b139d198f89aa5a9147a0479e424bde115

SHA256
96b1b410a865bb0d34f6598925577e582fea905c59f80fc3cbe2301ef448e75a

SHA512
fb07ec2e718ad0d1c1184180642b64d1ed589d90937a4317feeda127c658450cef3e7d2d64105ab0b582dad8f2909a6cd0ffcd013beeb07eac3be492c73d0d07

Download Submit
C:\Program Files (x86)\3ac8d391\jusched.exe

Filesize
198KB

MD5
f6bd0717fccd856aa5d0928a4055928a

SHA1
a451ca09ce1ec4f9dc1378f646dbc4e7ed0c00c4

SHA256
e7557d5b3928411f63d833f2ee14aa3ddd221e919e9f08832a2df3ecae76ac6e

SHA512
7824e29fe70eae084af6d3b9c33c028223a078d09612a93cea71395d80d13eb079119cae70ef014674308466953b24300aa7695d5542b9c6cfcc8bb7a428f1c5

Download Submit
C:\Program Files (x86)\3ac8d391\jusched.exe

Filesize
198KB

MD5
f6bd0717fccd856aa5d0928a4055928a

SHA1
a451ca09ce1ec4f9dc1378f646dbc4e7ed0c00c4

SHA256
e7557d5b3928411f63d833f2ee14aa3ddd221e919e9f08832a2df3ecae76ac6e

SHA512
7824e29fe70eae084af6d3b9c33c028223a078d09612a93cea71395d80d13eb079119cae70ef014674308466953b24300aa7695d5542b9c6cfcc8bb7a428f1c5

Download Submit