fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1

Analysis

max time kernel
143s
max time network
190s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 02:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe
Size

196KB
MD5

75f7210d98f2f01390b04e086c1c55f0
SHA1

b7a67f2fe7a85ea449c6b6e3bbc2ca34e995d8f5
SHA256

fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1
SHA512

94120c149f80cd65e7d536f07843f8259a6d158902a9ad67c93e38d64fa98984e8b197bccc8f5cc1b7e703f8e6001dcf73c46dc45997b3b33f6fcb29861751c4
SSDEEP

1536:VXBYjfC24mFVsIgvo3X4iZpTha5VlA8ma7aoL8c/i:VX+0mFmIgvo4iZhha5rXaoL8c/i

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2028	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
1668	fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe
1668	fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\9eaa8f04\jusched.exe	fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe
File created	C:\Program Files (x86)\9eaa8f04\9eaa8f04	fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe
File created	C:\Program Files (x86)\9eaa8f04\info_a	fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2028	1668	fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe	28
PID 1668 wrote to memory of 2028	1668	fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe	28
PID 1668 wrote to memory of 2028	1668	fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe	28
PID 1668 wrote to memory of 2028	1668	fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe	28

C:\Users\Admin\AppData\Local\Temp\fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe
"C:\Users\Admin\AppData\Local\Temp\fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Program Files (x86)\9eaa8f04\jusched.exe
  "C:\Program Files (x86)\9eaa8f04\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:2028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\9eaa8f04\9eaa8f04

Filesize
17B

MD5
bff3d8f76e182194c4a2abf1aabba9f3

SHA1
07e5b604bb505a800b3e0ac16fee483b70595768

SHA256
6bc8a4f93eaa1b3e7cfa696855bf6a852cf6555d694bc03e337261a27e58246f

SHA512
0c5def3bb01ed166d4135190e131c27be4b6039987e269b6c3fca07677b3c637868397f207df631a098182a6bd3c795e6dd34541f82c5ecd6062441af0af7f50

Download Submit
C:\Program Files (x86)\9eaa8f04\info_a

Filesize
12B

MD5
afff6a63be4f33f64f4d29b29fd90b26

SHA1
63b508ac2fee265b6e652a8f9752e00bb87791a5

SHA256
c21f313c812c67133889ae2a43d7c68c7926b00a5fc69b1f18ddc2f2065a6abe

SHA512
32bc55cb0fc6560ee8a955cbd9d63038839e4ec619f346e68cbab152b0d9adb9001600082c5e02fb3344d2c4f9c1139093b6bee33fe6d930acd1bfed3ad4beca

Download Submit
C:\Program Files (x86)\9eaa8f04\jusched.exe

Filesize
196KB

MD5
52b514dcc9848029f63350da0743feaf

SHA1
c0b16224d31a7a01d867aa93d3c5de5bcdec9c02

SHA256
b7d1268b7d7e3dd7f12d3b074103220b8f72ef7723c14b00be5daa98a770ea01

SHA512
7fe4846c3d636f72c33286b01515632b58f0cc284c1d00a395046b46bb8309f008a595ec17f1e0cb17e17b8c9a34eacf5bc2dec3ea4edc342e3ee2295e19ac8f

Download Submit
\Program Files (x86)\9eaa8f04\jusched.exe

Filesize
196KB

MD5
52b514dcc9848029f63350da0743feaf

SHA1
c0b16224d31a7a01d867aa93d3c5de5bcdec9c02

SHA256
b7d1268b7d7e3dd7f12d3b074103220b8f72ef7723c14b00be5daa98a770ea01

SHA512
7fe4846c3d636f72c33286b01515632b58f0cc284c1d00a395046b46bb8309f008a595ec17f1e0cb17e17b8c9a34eacf5bc2dec3ea4edc342e3ee2295e19ac8f

Download Submit
\Program Files (x86)\9eaa8f04\jusched.exe

Filesize
196KB

MD5
52b514dcc9848029f63350da0743feaf

SHA1
c0b16224d31a7a01d867aa93d3c5de5bcdec9c02

SHA256
b7d1268b7d7e3dd7f12d3b074103220b8f72ef7723c14b00be5daa98a770ea01

SHA512
7fe4846c3d636f72c33286b01515632b58f0cc284c1d00a395046b46bb8309f008a595ec17f1e0cb17e17b8c9a34eacf5bc2dec3ea4edc342e3ee2295e19ac8f

Download Submit
memory/1668-54-0x0000000076DC1000-0x0000000076DC3000-memory.dmp

Filesize
8KB

Download