09dd251d854b0e8e20b8d3577e50c135632bf0dc364dda90f8c055f5b2b4346d

General

Target

09dd251d854b0e8e20b8d3577e50c135632bf0dc364dda90f8c055f5b2b4346d.exe
Size

190KB
MD5

42f8720babf6023d3dc12b289833a2e0
SHA1

9850b915e50b25909cbf4b0b8989c1c019ba91ab
SHA256

09dd251d854b0e8e20b8d3577e50c135632bf0dc364dda90f8c055f5b2b4346d
SHA512

0e54a8c89575bd2aa651591b0ea9039f87669f6d0e08da5a06e8614837d9ada91ae40e566db1390a40da25109378e0887dd86eb88a62afb6ab3d85fe972b7504
SSDEEP

1536:pvVQb4cLIkN+4Weat2RKLjWlC48Pp9JAcjrSrowuCS:pvVQLIkLWeaA8KlCph9Growur

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

jusched.exe

pid process

1408 jusched.exe

pid	process
1408	jusched.exe

Loads dropped DLL 2 IoCs

Processes:

09dd251d854b0e8e20b8d3577e50c135632bf0dc364dda90f8c055f5b2b4346d.exe

pid	process
1736	09dd251d854b0e8e20b8d3577e50c135632bf0dc364dda90f8c055f5b2b4346d.exe
1736	09dd251d854b0e8e20b8d3577e50c135632bf0dc364dda90f8c055f5b2b4346d.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

09dd251d854b0e8e20b8d3577e50c135632bf0dc364dda90f8c055f5b2b4346d.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	09dd251d854b0e8e20b8d3577e50c135632bf0dc364dda90f8c055f5b2b4346d.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run	09dd251d854b0e8e20b8d3577e50c135632bf0dc364dda90f8c055f5b2b4346d.exe

Drops file in Program Files directory 2 IoCs

Processes:

09dd251d854b0e8e20b8d3577e50c135632bf0dc364dda90f8c055f5b2b4346d.exe

description	ioc	process
File created	C:\Program Files (x86)\8c9281e3\jusched.exe	09dd251d854b0e8e20b8d3577e50c135632bf0dc364dda90f8c055f5b2b4346d.exe
File created	C:\Program Files (x86)\8c9281e3\8c9281e3	09dd251d854b0e8e20b8d3577e50c135632bf0dc364dda90f8c055f5b2b4346d.exe

Drops file in Windows directory 1 IoCs

Processes:

09dd251d854b0e8e20b8d3577e50c135632bf0dc364dda90f8c055f5b2b4346d.exe

description ioc process

File created C:\Windows\Tasks\Update23.job 09dd251d854b0e8e20b8d3577e50c135632bf0dc364dda90f8c055f5b2b4346d.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\Update23.job	09dd251d854b0e8e20b8d3577e50c135632bf0dc364dda90f8c055f5b2b4346d.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

09dd251d854b0e8e20b8d3577e50c135632bf0dc364dda90f8c055f5b2b4346d.exe

description	pid	process	target process
PID 1736 wrote to memory of 1408	1736	09dd251d854b0e8e20b8d3577e50c135632bf0dc364dda90f8c055f5b2b4346d.exe	jusched.exe
PID 1736 wrote to memory of 1408	1736	09dd251d854b0e8e20b8d3577e50c135632bf0dc364dda90f8c055f5b2b4346d.exe	jusched.exe
PID 1736 wrote to memory of 1408	1736	09dd251d854b0e8e20b8d3577e50c135632bf0dc364dda90f8c055f5b2b4346d.exe	jusched.exe
PID 1736 wrote to memory of 1408	1736	09dd251d854b0e8e20b8d3577e50c135632bf0dc364dda90f8c055f5b2b4346d.exe	jusched.exe

C:\Users\Admin\AppData\Local\Temp\09dd251d854b0e8e20b8d3577e50c135632bf0dc364dda90f8c055f5b2b4346d.exe
"C:\Users\Admin\AppData\Local\Temp\09dd251d854b0e8e20b8d3577e50c135632bf0dc364dda90f8c055f5b2b4346d.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1736

C:\Program Files (x86)\8c9281e3\jusched.exe
"C:\Program Files (x86)\8c9281e3\jusched.exe"
2⤵
- Executes dropped EXE
PID:1408

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\8c9281e3\jusched.exe

Filesize
190KB

MD5
afd3789cfdf16032b4b58ec0f39ec31e

SHA1
4802a50c22013038ddd9436bd84ab5424653ca4e

SHA256
f2a0bd00320beaaf3de392e8042b76bd7db0636b27e553de738010b0faab5a54

SHA512
9dff51fa76f0348b5aa066cf3a8f471eb09a17f97e198f2fba27538bfc1f3fdce363727bdfa29776537389cc3b94396bc7f6586285e197a34a925659df0f34b3

Download Submit
\Program Files (x86)\8c9281e3\jusched.exe

Filesize
190KB

MD5
afd3789cfdf16032b4b58ec0f39ec31e

SHA1
4802a50c22013038ddd9436bd84ab5424653ca4e

SHA256
f2a0bd00320beaaf3de392e8042b76bd7db0636b27e553de738010b0faab5a54

SHA512
9dff51fa76f0348b5aa066cf3a8f471eb09a17f97e198f2fba27538bfc1f3fdce363727bdfa29776537389cc3b94396bc7f6586285e197a34a925659df0f34b3

Download Submit
\Program Files (x86)\8c9281e3\jusched.exe

Filesize
190KB

MD5
afd3789cfdf16032b4b58ec0f39ec31e

SHA1
4802a50c22013038ddd9436bd84ab5424653ca4e

SHA256
f2a0bd00320beaaf3de392e8042b76bd7db0636b27e553de738010b0faab5a54

SHA512
9dff51fa76f0348b5aa066cf3a8f471eb09a17f97e198f2fba27538bfc1f3fdce363727bdfa29776537389cc3b94396bc7f6586285e197a34a925659df0f34b3

Download Submit
memory/1408-58-0x0000000000000000-mapping.dmp

Download
memory/1408-61-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1736-54-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1736-55-0x0000000075E81000-0x0000000075E83000-memory.dmp

Filesize
8KB

Download
memory/1736-60-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads