ccfb464feac36f66017500e1a3fa632a9e41658d18fb1a97a5b41cdbc1cac055

General

Target

ccfb464feac36f66017500e1a3fa632a9e41658d18fb1a97a5b41cdbc1cac055.exe
Size

208KB
MD5

32fbc3d203fef6345a8963d60c216cd0
SHA1

3ca4786b9af5efae74b5fcb435c712d448f5bf74
SHA256

ccfb464feac36f66017500e1a3fa632a9e41658d18fb1a97a5b41cdbc1cac055
SHA512

a73beb496a96d329a3384a75fd7181b16a31af74a42cdcd62cba9c6411419f3d99c657aa7034c6d084997d18171da154bfd263565857a6be50d7ba661f889a53
SSDEEP

3072:JVHgCc4xGvbwcU9KQ2BBAHmaPxiVoSb5E2:MCc4xGxWKQ2Bonxw

Score

10^/10

persistence

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.byethost12.com
Port:
21
Username:
b12_8082975
Password:
951753zx

Signatures

Executes dropped EXE 1 IoCs

Processes:

jusched.exe

pid process

1028 jusched.exe

pid	process
1028	jusched.exe

Loads dropped DLL 2 IoCs

Processes:

ccfb464feac36f66017500e1a3fa632a9e41658d18fb1a97a5b41cdbc1cac055.exe

pid	process
2032	ccfb464feac36f66017500e1a3fa632a9e41658d18fb1a97a5b41cdbc1cac055.exe
2032	ccfb464feac36f66017500e1a3fa632a9e41658d18fb1a97a5b41cdbc1cac055.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ccfb464feac36f66017500e1a3fa632a9e41658d18fb1a97a5b41cdbc1cac055.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	ccfb464feac36f66017500e1a3fa632a9e41658d18fb1a97a5b41cdbc1cac055.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run	ccfb464feac36f66017500e1a3fa632a9e41658d18fb1a97a5b41cdbc1cac055.exe

Drops file in Program Files directory 2 IoCs

Processes:

ccfb464feac36f66017500e1a3fa632a9e41658d18fb1a97a5b41cdbc1cac055.exe

description	ioc	process
File created	C:\Program Files (x86)\f1b5f31d\jusched.exe	ccfb464feac36f66017500e1a3fa632a9e41658d18fb1a97a5b41cdbc1cac055.exe
File created	C:\Program Files (x86)\f1b5f31d\f1b5f31d	ccfb464feac36f66017500e1a3fa632a9e41658d18fb1a97a5b41cdbc1cac055.exe

Drops file in Windows directory 1 IoCs

Processes:

ccfb464feac36f66017500e1a3fa632a9e41658d18fb1a97a5b41cdbc1cac055.exe

description ioc process

File created C:\Windows\Tasks\Update23.job ccfb464feac36f66017500e1a3fa632a9e41658d18fb1a97a5b41cdbc1cac055.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\Update23.job	ccfb464feac36f66017500e1a3fa632a9e41658d18fb1a97a5b41cdbc1cac055.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ccfb464feac36f66017500e1a3fa632a9e41658d18fb1a97a5b41cdbc1cac055.exe

description	pid	process	target process
PID 2032 wrote to memory of 1028	2032	ccfb464feac36f66017500e1a3fa632a9e41658d18fb1a97a5b41cdbc1cac055.exe	jusched.exe
PID 2032 wrote to memory of 1028	2032	ccfb464feac36f66017500e1a3fa632a9e41658d18fb1a97a5b41cdbc1cac055.exe	jusched.exe
PID 2032 wrote to memory of 1028	2032	ccfb464feac36f66017500e1a3fa632a9e41658d18fb1a97a5b41cdbc1cac055.exe	jusched.exe
PID 2032 wrote to memory of 1028	2032	ccfb464feac36f66017500e1a3fa632a9e41658d18fb1a97a5b41cdbc1cac055.exe	jusched.exe

C:\Users\Admin\AppData\Local\Temp\ccfb464feac36f66017500e1a3fa632a9e41658d18fb1a97a5b41cdbc1cac055.exe
"C:\Users\Admin\AppData\Local\Temp\ccfb464feac36f66017500e1a3fa632a9e41658d18fb1a97a5b41cdbc1cac055.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2032

C:\Program Files (x86)\f1b5f31d\jusched.exe
"C:\Program Files (x86)\f1b5f31d\jusched.exe"
2⤵
- Executes dropped EXE
PID:1028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\f1b5f31d\f1b5f31d

Filesize
17B

MD5
134c1d489094d6d3399f65b0e9aebc1f

SHA1
612a57fbe6ed3ab9c15b39451171d813314a28d5

SHA256
54f9150d1268f7b4b83dd9fc3ec32274bf749715a5806ff3ca5262f5427d6781

SHA512
b09bf60e4850d05261d81a124a647dd111f42480224eae8a3bd2f64736c38119953703f868ad34194a7ae6dad6aabff4081ba73df262bbe9f5327867c56a48ed

Download Submit
C:\Program Files (x86)\f1b5f31d\jusched.exe

Filesize
208KB

MD5
4b7c8e015f819d553e94bbb0b8affbc0

SHA1
16d5b09bc8365c80463d814114812621ec755dc2

SHA256
bf65cfebf4ef3c4e3f23eea890a6895df73a3062af8695f206a240ed44aa0919

SHA512
96948b012883ebe4ff717640a7cf458fffd73a2271e0dee43bc117bffef57bfc418000a5280a1ee20618be9429baaa4966b3cea4798f6c1d57898a2f778ed3b9

Download Submit
\Program Files (x86)\f1b5f31d\jusched.exe

Filesize
208KB

MD5
4b7c8e015f819d553e94bbb0b8affbc0

SHA1
16d5b09bc8365c80463d814114812621ec755dc2

SHA256
bf65cfebf4ef3c4e3f23eea890a6895df73a3062af8695f206a240ed44aa0919

SHA512
96948b012883ebe4ff717640a7cf458fffd73a2271e0dee43bc117bffef57bfc418000a5280a1ee20618be9429baaa4966b3cea4798f6c1d57898a2f778ed3b9

Download Submit
\Program Files (x86)\f1b5f31d\jusched.exe

Filesize
208KB

MD5
4b7c8e015f819d553e94bbb0b8affbc0

SHA1
16d5b09bc8365c80463d814114812621ec755dc2

SHA256
bf65cfebf4ef3c4e3f23eea890a6895df73a3062af8695f206a240ed44aa0919

SHA512
96948b012883ebe4ff717640a7cf458fffd73a2271e0dee43bc117bffef57bfc418000a5280a1ee20618be9429baaa4966b3cea4798f6c1d57898a2f778ed3b9

Download Submit
memory/1028-59-0x0000000000000000-mapping.dmp

Download
memory/1028-62-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2032-54-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2032-55-0x0000000075C21000-0x0000000075C23000-memory.dmp

Filesize
8KB

Download
memory/2032-56-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/2032-61-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads