acecb6b732c0ec99ebca0ef508ee398f9c50eba5d29558df06d496994c1001ec

General

Target

acecb6b732c0ec99ebca0ef508ee398f9c50eba5d29558df06d496994c1001ec.exe
Size

209KB
MD5

513175e6e8d8c0bcd42d8b55d5114b80
SHA1

bafcf71ab9b09745bd76b7526da99890111e48c3
SHA256

acecb6b732c0ec99ebca0ef508ee398f9c50eba5d29558df06d496994c1001ec
SHA512

52ed4c9a55375f6ba8be60ba52461638b1866e2f87a4b076cbbe47860d2b599efc8c18c1251c296138d0c0840b1f346d62139fc207794fa22b2b2c7efc6904cc
SSDEEP

1536:kwQBHvoYUWjzlZLXf4QJpUT0mSBAgapetc8o/Kdgo4QGuG3g5r:kBlvaWjzrLXQQJKgmSBAVpet2Ago4lu

Score

10^/10

persistence

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Executes dropped EXE 1 IoCs

Processes:

jusched.exe

pid process

1444 jusched.exe

pid	process
1444	jusched.exe

Loads dropped DLL 2 IoCs

Processes:

acecb6b732c0ec99ebca0ef508ee398f9c50eba5d29558df06d496994c1001ec.exe

pid	process
1404	acecb6b732c0ec99ebca0ef508ee398f9c50eba5d29558df06d496994c1001ec.exe
1404	acecb6b732c0ec99ebca0ef508ee398f9c50eba5d29558df06d496994c1001ec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

acecb6b732c0ec99ebca0ef508ee398f9c50eba5d29558df06d496994c1001ec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	acecb6b732c0ec99ebca0ef508ee398f9c50eba5d29558df06d496994c1001ec.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	acecb6b732c0ec99ebca0ef508ee398f9c50eba5d29558df06d496994c1001ec.exe

Drops file in Program Files directory 2 IoCs

Processes:

acecb6b732c0ec99ebca0ef508ee398f9c50eba5d29558df06d496994c1001ec.exe

description	ioc	process
File created	C:\Program Files (x86)\85afd4b6\85afd4b6	acecb6b732c0ec99ebca0ef508ee398f9c50eba5d29558df06d496994c1001ec.exe
File created	C:\Program Files (x86)\85afd4b6\jusched.exe	acecb6b732c0ec99ebca0ef508ee398f9c50eba5d29558df06d496994c1001ec.exe

Drops file in Windows directory 1 IoCs

Processes:

acecb6b732c0ec99ebca0ef508ee398f9c50eba5d29558df06d496994c1001ec.exe

description ioc process

File created C:\Windows\Tasks\Update23.job acecb6b732c0ec99ebca0ef508ee398f9c50eba5d29558df06d496994c1001ec.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\Update23.job	acecb6b732c0ec99ebca0ef508ee398f9c50eba5d29558df06d496994c1001ec.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

acecb6b732c0ec99ebca0ef508ee398f9c50eba5d29558df06d496994c1001ec.exe

description	pid	process	target process
PID 1404 wrote to memory of 1444	1404	acecb6b732c0ec99ebca0ef508ee398f9c50eba5d29558df06d496994c1001ec.exe	jusched.exe
PID 1404 wrote to memory of 1444	1404	acecb6b732c0ec99ebca0ef508ee398f9c50eba5d29558df06d496994c1001ec.exe	jusched.exe
PID 1404 wrote to memory of 1444	1404	acecb6b732c0ec99ebca0ef508ee398f9c50eba5d29558df06d496994c1001ec.exe	jusched.exe
PID 1404 wrote to memory of 1444	1404	acecb6b732c0ec99ebca0ef508ee398f9c50eba5d29558df06d496994c1001ec.exe	jusched.exe

C:\Users\Admin\AppData\Local\Temp\acecb6b732c0ec99ebca0ef508ee398f9c50eba5d29558df06d496994c1001ec.exe
"C:\Users\Admin\AppData\Local\Temp\acecb6b732c0ec99ebca0ef508ee398f9c50eba5d29558df06d496994c1001ec.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1404

C:\Program Files (x86)\85afd4b6\jusched.exe
"C:\Program Files (x86)\85afd4b6\jusched.exe"
2⤵
- Executes dropped EXE
PID:1444

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\85afd4b6\85afd4b6
Filesize
17B

MD5
2130fee70fc3f7c10d5279f96f98ad1e

SHA1
4307cef89171fa230048ea22546802198d888780

SHA256
3506e286f6223ccaf1665d4e457b712abeb527266ff28327ce60e37b9fbeb404

SHA512
67fa1bb31028ff3ba125f184207499b9205f58c9eef2ac948f5824475515c396b3d5f93e207cb96deffe1aedb286b1f935cc689c5d84449e51c517da1cffe2e5

Download Submit
C:\Program Files (x86)\85afd4b6\jusched.exe
Filesize
209KB

MD5
e5ecec3bb80e118a1250e53d285d2f1d

SHA1
91a3ef3cdc4ccffbc395178e808cd3f415c4fa2a

SHA256
b766c472dc1b01796c91bf2e53bb37c0598fddf68e9590ea8c43b1f0b3c7e35c

SHA512
3ad4cc3932c3320b87a8184b35e838b254127cffd9e2f92ca8f057879f9af40508bfdd680f2c54c5a2bb62c024aea802d6e9a7ad6d47c718aa6d30bea84ec8d7

Download Submit
\Program Files (x86)\85afd4b6\jusched.exe
Filesize
209KB

MD5
e5ecec3bb80e118a1250e53d285d2f1d

SHA1
91a3ef3cdc4ccffbc395178e808cd3f415c4fa2a

SHA256
b766c472dc1b01796c91bf2e53bb37c0598fddf68e9590ea8c43b1f0b3c7e35c

SHA512
3ad4cc3932c3320b87a8184b35e838b254127cffd9e2f92ca8f057879f9af40508bfdd680f2c54c5a2bb62c024aea802d6e9a7ad6d47c718aa6d30bea84ec8d7

Download Submit
\Program Files (x86)\85afd4b6\jusched.exe
Filesize
209KB

MD5
e5ecec3bb80e118a1250e53d285d2f1d

SHA1
91a3ef3cdc4ccffbc395178e808cd3f415c4fa2a

SHA256
b766c472dc1b01796c91bf2e53bb37c0598fddf68e9590ea8c43b1f0b3c7e35c

SHA512
3ad4cc3932c3320b87a8184b35e838b254127cffd9e2f92ca8f057879f9af40508bfdd680f2c54c5a2bb62c024aea802d6e9a7ad6d47c718aa6d30bea84ec8d7

Download Submit
memory/1404-54-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/1444-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads