5a9f9e71fbc06cccec6ccf19c51dbf83fa8b2ab19459f69f270dbe7446513f1c

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 20:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5a9f9e71fbc06cccec6ccf19c51dbf83fa8b2ab19459f69f270dbe7446513f1c.exe
Size

189KB
MD5

a1a7bf8baf107bea4d656f063cfe0350
SHA1

d17517eebd40a75ab46b1e0ca564a5d13a7356fd
SHA256

5a9f9e71fbc06cccec6ccf19c51dbf83fa8b2ab19459f69f270dbe7446513f1c
SHA512

42dc54587f61cbcd1591bc76517734e1b5c95102b303333e0c9843ac09e88503608f4184cbc3b8373a397a70ff94ddbec29e910f2624f97562f4903f0cba5b2b
SSDEEP

1536:SvVte+7YkayZ+OttmxKLjWlSA8Zp5JAJjsSHoW8Px:SvVteka8+OtAcKlSRz52HoWE

Score

10^/10

persistence

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1984	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
1608	5a9f9e71fbc06cccec6ccf19c51dbf83fa8b2ab19459f69f270dbe7446513f1c.exe
1608	5a9f9e71fbc06cccec6ccf19c51dbf83fa8b2ab19459f69f270dbe7446513f1c.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	5a9f9e71fbc06cccec6ccf19c51dbf83fa8b2ab19459f69f270dbe7446513f1c.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	5a9f9e71fbc06cccec6ccf19c51dbf83fa8b2ab19459f69f270dbe7446513f1c.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\6dd2412\jusched.exe	5a9f9e71fbc06cccec6ccf19c51dbf83fa8b2ab19459f69f270dbe7446513f1c.exe
File created	C:\Program Files (x86)\6dd2412\6dd2412	5a9f9e71fbc06cccec6ccf19c51dbf83fa8b2ab19459f69f270dbe7446513f1c.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	5a9f9e71fbc06cccec6ccf19c51dbf83fa8b2ab19459f69f270dbe7446513f1c.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 1984	1608	5a9f9e71fbc06cccec6ccf19c51dbf83fa8b2ab19459f69f270dbe7446513f1c.exe	26
PID 1608 wrote to memory of 1984	1608	5a9f9e71fbc06cccec6ccf19c51dbf83fa8b2ab19459f69f270dbe7446513f1c.exe	26
PID 1608 wrote to memory of 1984	1608	5a9f9e71fbc06cccec6ccf19c51dbf83fa8b2ab19459f69f270dbe7446513f1c.exe	26
PID 1608 wrote to memory of 1984	1608	5a9f9e71fbc06cccec6ccf19c51dbf83fa8b2ab19459f69f270dbe7446513f1c.exe	26

C:\Users\Admin\AppData\Local\Temp\5a9f9e71fbc06cccec6ccf19c51dbf83fa8b2ab19459f69f270dbe7446513f1c.exe
"C:\Users\Admin\AppData\Local\Temp\5a9f9e71fbc06cccec6ccf19c51dbf83fa8b2ab19459f69f270dbe7446513f1c.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Program Files (x86)\6dd2412\jusched.exe
  "C:\Program Files (x86)\6dd2412\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:1984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\6dd2412\6dd2412

Filesize
17B

MD5
209aa6c14d66621f3aa1cee03a8bf5dc

SHA1
0f5bce2a29d3306586934b6d846a172078ee8e66

SHA256
57ef9e3c809cf3ca41782d4c7119c3ae7e43ccbb1c00d978b745677f14b82c2e

SHA512
8b9fb2bcc8e8785a48d3fe212f852c2f108ef2ab20e9e2a61e9bba5857002abe9111e42411bfc573e50c126031b7ef0433bddfa357de2ca0814f7d31157b9c63

Download Submit
C:\Program Files (x86)\6dd2412\jusched.exe

Filesize
189KB

MD5
8e85ed8df2b92751f4f1c0df37e14a99

SHA1
1f3d77e5db07109c9778c71ced341fd3f922d73e

SHA256
654106778eee6d6b5a24f50a84220e529e2b4291977fe438b511cecd7f1b72bb

SHA512
c9b645dfcde4b26a78caa3f674d74575b658b79cb349d307d681254c7161db7a7517df81ca347d312a4858729df222a6970415d01ee594aef17da00ea13d48a3

Download Submit
\Program Files (x86)\6dd2412\jusched.exe

Filesize
189KB

MD5
8e85ed8df2b92751f4f1c0df37e14a99

SHA1
1f3d77e5db07109c9778c71ced341fd3f922d73e

SHA256
654106778eee6d6b5a24f50a84220e529e2b4291977fe438b511cecd7f1b72bb

SHA512
c9b645dfcde4b26a78caa3f674d74575b658b79cb349d307d681254c7161db7a7517df81ca347d312a4858729df222a6970415d01ee594aef17da00ea13d48a3

Download Submit
\Program Files (x86)\6dd2412\jusched.exe

Filesize
189KB

MD5
8e85ed8df2b92751f4f1c0df37e14a99

SHA1
1f3d77e5db07109c9778c71ced341fd3f922d73e

SHA256
654106778eee6d6b5a24f50a84220e529e2b4291977fe438b511cecd7f1b72bb

SHA512
c9b645dfcde4b26a78caa3f674d74575b658b79cb349d307d681254c7161db7a7517df81ca347d312a4858729df222a6970415d01ee594aef17da00ea13d48a3

Download Submit
memory/1608-54-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download