fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1

Analysis

max time kernel
146s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 02:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe
Size

196KB
MD5

75f7210d98f2f01390b04e086c1c55f0
SHA1

b7a67f2fe7a85ea449c6b6e3bbc2ca34e995d8f5
SHA256

fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1
SHA512

94120c149f80cd65e7d536f07843f8259a6d158902a9ad67c93e38d64fa98984e8b197bccc8f5cc1b7e703f8e6001dcf73c46dc45997b3b33f6fcb29861751c4
SSDEEP

1536:VXBYjfC24mFVsIgvo3X4iZpTha5VlA8ma7aoL8c/i:VX+0mFmIgvo4iZhha5rXaoL8c/i

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1920	jusched.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\3bd46b58\jusched.exe	fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe
File created	C:\Program Files (x86)\3bd46b58\3bd46b58	fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe
File created	C:\Program Files (x86)\3bd46b58\info_a	fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 1920	3700	fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe	83
PID 3700 wrote to memory of 1920	3700	fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe	83
PID 3700 wrote to memory of 1920	3700	fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe	83

C:\Users\Admin\AppData\Local\Temp\fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe
"C:\Users\Admin\AppData\Local\Temp\fe46fd3eabfc771949594725b194ea0f54bda4f085665dcf3c3e528be64a3bb1.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Program Files (x86)\3bd46b58\jusched.exe
  "C:\Program Files (x86)\3bd46b58\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:1920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\3bd46b58\3bd46b58

Filesize
17B

MD5
bff3d8f76e182194c4a2abf1aabba9f3

SHA1
07e5b604bb505a800b3e0ac16fee483b70595768

SHA256
6bc8a4f93eaa1b3e7cfa696855bf6a852cf6555d694bc03e337261a27e58246f

SHA512
0c5def3bb01ed166d4135190e131c27be4b6039987e269b6c3fca07677b3c637868397f207df631a098182a6bd3c795e6dd34541f82c5ecd6062441af0af7f50

Download Submit
C:\Program Files (x86)\3bd46b58\info_a

Filesize
12B

MD5
afff6a63be4f33f64f4d29b29fd90b26

SHA1
63b508ac2fee265b6e652a8f9752e00bb87791a5

SHA256
c21f313c812c67133889ae2a43d7c68c7926b00a5fc69b1f18ddc2f2065a6abe

SHA512
32bc55cb0fc6560ee8a955cbd9d63038839e4ec619f346e68cbab152b0d9adb9001600082c5e02fb3344d2c4f9c1139093b6bee33fe6d930acd1bfed3ad4beca

Download Submit
C:\Program Files (x86)\3bd46b58\jusched.exe

Filesize
196KB

MD5
6fbda9c1e6b3b1b75533a2bd1658486b

SHA1
00ab2eea7de77010e8ce8f1fdd55a0e9479dab42

SHA256
d7ddd34691bd567f56e1e9fae13fbb1cdf41046e8696a033e1da736d52124a5d

SHA512
2b61712ba240599d963ac14a446ac3619455b57dbbf8ef6ca6589c3a02b0878fd090660979ee358ed392370e01309be28aa876a7b183998b719e5b76323bbff0

Download Submit
C:\Program Files (x86)\3bd46b58\jusched.exe

Filesize
196KB

MD5
6fbda9c1e6b3b1b75533a2bd1658486b

SHA1
00ab2eea7de77010e8ce8f1fdd55a0e9479dab42

SHA256
d7ddd34691bd567f56e1e9fae13fbb1cdf41046e8696a033e1da736d52124a5d

SHA512
2b61712ba240599d963ac14a446ac3619455b57dbbf8ef6ca6589c3a02b0878fd090660979ee358ed392370e01309be28aa876a7b183998b719e5b76323bbff0

Download Submit