Analysis

  • max time kernel
    126s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-10-2022 07:40

General

  • Target

    3980968bcd1591705c90e998d53bb40ce0d3d88c26ba333d3a4ad2be4d6b7e26.exe

  • Size

    209KB

  • MD5

    80045ee88a5344595b4d951d00ce5157

  • SHA1

    82fa3a2dc67cc622911160d2fe265d3a51fc6fa4

  • SHA256

    3980968bcd1591705c90e998d53bb40ce0d3d88c26ba333d3a4ad2be4d6b7e26

  • SHA512

    02f85336049e34c2055a8d73a9250a32c4f704039b74ed93ab832faee08d6a76f3c6db52b938e472168e0e1a6481360281bc0198b4e4f6931e24568db150b201

  • SSDEEP

    1536:xNSXbc74YTOnlNSUL09atT0mBBA7aKSvIYFwAfdvoZQO5NoLp:xEo75OnPSI09qgmBBAGKSvwovoZ9Tq

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Signatures

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3980968bcd1591705c90e998d53bb40ce0d3d88c26ba333d3a4ad2be4d6b7e26.exe
    "C:\Users\Admin\AppData\Local\Temp\3980968bcd1591705c90e998d53bb40ce0d3d88c26ba333d3a4ad2be4d6b7e26.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4340
    • C:\Program Files (x86)\8af814e6\jusched.exe
      "C:\Program Files (x86)\8af814e6\jusched.exe"
      2⤵
      • Executes dropped EXE
      PID:256

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\8af814e6\8af814e6

    Filesize

    17B

    MD5

    3330ebaaa7e9f4630f4ad4c156be59d8

    SHA1

    40375cf8e68671e0100e725de5cd5c6657b9f722

    SHA256

    2c8451d5dca9e68ec3af7f318c5d874fbdfea9e89e7b5f9922b4dbd65f027e15

    SHA512

    b7631f9685bac9f81aa6bf53afd839910773e108989bbb79ba39cafabbe6b6994ed2fde44911c9f7f24b45c9745d6e80cd9f01975bfb765561df4881f7dad696

  • C:\Program Files (x86)\8af814e6\jusched.exe

    Filesize

    210KB

    MD5

    648dd49116d6a706db32e890e9a95c03

    SHA1

    9a8655c79fa0f8782e3788cb5840b50bf1367a36

    SHA256

    5b61792671e2e876793736f0b4edf52032e8873ccb54ce8fbc1a7e862e5d34d4

    SHA512

    a91d559964195a0bfc00d6aaad68b59d3edc4aa8cc0d7ec5b0693dc95272eaa41a39e49b70720f5d8e859f304df1c5a1564806e33b33d89bca80e83cf6b8bc3b

  • C:\Program Files (x86)\8af814e6\jusched.exe

    Filesize

    210KB

    MD5

    648dd49116d6a706db32e890e9a95c03

    SHA1

    9a8655c79fa0f8782e3788cb5840b50bf1367a36

    SHA256

    5b61792671e2e876793736f0b4edf52032e8873ccb54ce8fbc1a7e862e5d34d4

    SHA512

    a91d559964195a0bfc00d6aaad68b59d3edc4aa8cc0d7ec5b0693dc95272eaa41a39e49b70720f5d8e859f304df1c5a1564806e33b33d89bca80e83cf6b8bc3b

  • memory/256-133-0x0000000000000000-mapping.dmp

  • memory/256-137-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/256-139-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/4340-132-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB

  • memory/4340-136-0x0000000000400000-0x0000000000458000-memory.dmp

    Filesize

    352KB