Analysis
-
max time kernel
126s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20-10-2022 07:40
Static task
static1
Behavioral task
behavioral1
Sample
3980968bcd1591705c90e998d53bb40ce0d3d88c26ba333d3a4ad2be4d6b7e26.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3980968bcd1591705c90e998d53bb40ce0d3d88c26ba333d3a4ad2be4d6b7e26.exe
Resource
win10v2004-20220812-en
General
-
Target
3980968bcd1591705c90e998d53bb40ce0d3d88c26ba333d3a4ad2be4d6b7e26.exe
-
Size
209KB
-
MD5
80045ee88a5344595b4d951d00ce5157
-
SHA1
82fa3a2dc67cc622911160d2fe265d3a51fc6fa4
-
SHA256
3980968bcd1591705c90e998d53bb40ce0d3d88c26ba333d3a4ad2be4d6b7e26
-
SHA512
02f85336049e34c2055a8d73a9250a32c4f704039b74ed93ab832faee08d6a76f3c6db52b938e472168e0e1a6481360281bc0198b4e4f6931e24568db150b201
-
SSDEEP
1536:xNSXbc74YTOnlNSUL09atT0mBBA7aKSvIYFwAfdvoZQO5NoLp:xEo75OnPSI09qgmBBAGKSvwovoZ9Tq
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 256 jusched.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 3980968bcd1591705c90e998d53bb40ce0d3d88c26ba333d3a4ad2be4d6b7e26.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 3980968bcd1591705c90e998d53bb40ce0d3d88c26ba333d3a4ad2be4d6b7e26.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run 3980968bcd1591705c90e998d53bb40ce0d3d88c26ba333d3a4ad2be4d6b7e26.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\8af814e6\jusched.exe 3980968bcd1591705c90e998d53bb40ce0d3d88c26ba333d3a4ad2be4d6b7e26.exe File created C:\Program Files (x86)\8af814e6\8af814e6 3980968bcd1591705c90e998d53bb40ce0d3d88c26ba333d3a4ad2be4d6b7e26.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\Update23.job 3980968bcd1591705c90e998d53bb40ce0d3d88c26ba333d3a4ad2be4d6b7e26.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4340 wrote to memory of 256 4340 3980968bcd1591705c90e998d53bb40ce0d3d88c26ba333d3a4ad2be4d6b7e26.exe 80 PID 4340 wrote to memory of 256 4340 3980968bcd1591705c90e998d53bb40ce0d3d88c26ba333d3a4ad2be4d6b7e26.exe 80 PID 4340 wrote to memory of 256 4340 3980968bcd1591705c90e998d53bb40ce0d3d88c26ba333d3a4ad2be4d6b7e26.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\3980968bcd1591705c90e998d53bb40ce0d3d88c26ba333d3a4ad2be4d6b7e26.exe"C:\Users\Admin\AppData\Local\Temp\3980968bcd1591705c90e998d53bb40ce0d3d88c26ba333d3a4ad2be4d6b7e26.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Program Files (x86)\8af814e6\jusched.exe"C:\Program Files (x86)\8af814e6\jusched.exe"2⤵
- Executes dropped EXE
PID:256
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17B
MD53330ebaaa7e9f4630f4ad4c156be59d8
SHA140375cf8e68671e0100e725de5cd5c6657b9f722
SHA2562c8451d5dca9e68ec3af7f318c5d874fbdfea9e89e7b5f9922b4dbd65f027e15
SHA512b7631f9685bac9f81aa6bf53afd839910773e108989bbb79ba39cafabbe6b6994ed2fde44911c9f7f24b45c9745d6e80cd9f01975bfb765561df4881f7dad696
-
Filesize
210KB
MD5648dd49116d6a706db32e890e9a95c03
SHA19a8655c79fa0f8782e3788cb5840b50bf1367a36
SHA2565b61792671e2e876793736f0b4edf52032e8873ccb54ce8fbc1a7e862e5d34d4
SHA512a91d559964195a0bfc00d6aaad68b59d3edc4aa8cc0d7ec5b0693dc95272eaa41a39e49b70720f5d8e859f304df1c5a1564806e33b33d89bca80e83cf6b8bc3b
-
Filesize
210KB
MD5648dd49116d6a706db32e890e9a95c03
SHA19a8655c79fa0f8782e3788cb5840b50bf1367a36
SHA2565b61792671e2e876793736f0b4edf52032e8873ccb54ce8fbc1a7e862e5d34d4
SHA512a91d559964195a0bfc00d6aaad68b59d3edc4aa8cc0d7ec5b0693dc95272eaa41a39e49b70720f5d8e859f304df1c5a1564806e33b33d89bca80e83cf6b8bc3b