7376f2b313df7e039946d40e96f35d64953ee20319e92b544492000a50ec8497

General

Target

7376f2b313df7e039946d40e96f35d64953ee20319e92b544492000a50ec8497.exe
Size

232KB
MD5

3a6c36995ac1143df953335d4c38d5a0
SHA1

8ef0107613dfb1fdc2d05d250e532228a9334029
SHA256

7376f2b313df7e039946d40e96f35d64953ee20319e92b544492000a50ec8497
SHA512

f38a078acce721adfd1a5ab3ee7e47d235bdfc28b110e68ad0995492b2755bc3acd165d3159274f9892e5f6a8e01332ebf75f08a66334c120a43e3dd2ad94468
SSDEEP

3072:bfQgicdlGvILcU9KQ2BBAkJaPxsIolx8ha22XX/xU:picdlG5WKQ2BjGx+spY/O

Score

10^/10

persistence

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.byethost12.com
Port:
21
Username:
b12_8082975
Password:
951753zx

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Executes dropped EXE 1 IoCs

Processes:

jusched.exe

pid process

1520 jusched.exe

pid	process
1520	jusched.exe

Loads dropped DLL 2 IoCs

Processes:

7376f2b313df7e039946d40e96f35d64953ee20319e92b544492000a50ec8497.exe

pid	process
1672	7376f2b313df7e039946d40e96f35d64953ee20319e92b544492000a50ec8497.exe
1672	7376f2b313df7e039946d40e96f35d64953ee20319e92b544492000a50ec8497.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

7376f2b313df7e039946d40e96f35d64953ee20319e92b544492000a50ec8497.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	7376f2b313df7e039946d40e96f35d64953ee20319e92b544492000a50ec8497.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	7376f2b313df7e039946d40e96f35d64953ee20319e92b544492000a50ec8497.exe

Drops file in Program Files directory 2 IoCs

Processes:

7376f2b313df7e039946d40e96f35d64953ee20319e92b544492000a50ec8497.exe

description	ioc	process
File created	C:\Program Files (x86)\f74faa18\jusched.exe	7376f2b313df7e039946d40e96f35d64953ee20319e92b544492000a50ec8497.exe
File created	C:\Program Files (x86)\f74faa18\f74faa18	7376f2b313df7e039946d40e96f35d64953ee20319e92b544492000a50ec8497.exe

Drops file in Windows directory 1 IoCs

Processes:

7376f2b313df7e039946d40e96f35d64953ee20319e92b544492000a50ec8497.exe

description ioc process

File created C:\Windows\Tasks\Update23.job 7376f2b313df7e039946d40e96f35d64953ee20319e92b544492000a50ec8497.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\Update23.job	7376f2b313df7e039946d40e96f35d64953ee20319e92b544492000a50ec8497.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7376f2b313df7e039946d40e96f35d64953ee20319e92b544492000a50ec8497.exe

description	pid	process	target process
PID 1672 wrote to memory of 1520	1672	7376f2b313df7e039946d40e96f35d64953ee20319e92b544492000a50ec8497.exe	jusched.exe
PID 1672 wrote to memory of 1520	1672	7376f2b313df7e039946d40e96f35d64953ee20319e92b544492000a50ec8497.exe	jusched.exe
PID 1672 wrote to memory of 1520	1672	7376f2b313df7e039946d40e96f35d64953ee20319e92b544492000a50ec8497.exe	jusched.exe
PID 1672 wrote to memory of 1520	1672	7376f2b313df7e039946d40e96f35d64953ee20319e92b544492000a50ec8497.exe	jusched.exe

C:\Users\Admin\AppData\Local\Temp\7376f2b313df7e039946d40e96f35d64953ee20319e92b544492000a50ec8497.exe
"C:\Users\Admin\AppData\Local\Temp\7376f2b313df7e039946d40e96f35d64953ee20319e92b544492000a50ec8497.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1672

C:\Program Files (x86)\f74faa18\jusched.exe
"C:\Program Files (x86)\f74faa18\jusched.exe"
2⤵
- Executes dropped EXE
PID:1520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\f74faa18\f74faa18

Filesize
17B

MD5
552bb86ed2797d3fd12ac0d273afaf75

SHA1
6e8633f9c24590779acbd3dd14c60f856320bc0a

SHA256
3ef9ff5da8272fd1b14c83f12c8d28fd9dbf32d56bcb714921032b02557fe789

SHA512
dab57227de02f4667cc8e2ec47566088b473caa0387caffbdfde37f3400da7d4f67dd222e83a4fa93592694bbcff7c52a2bcec074868baf221bc47d9370c8d2c

Download Submit
C:\Program Files (x86)\f74faa18\jusched.exe

Filesize
232KB

MD5
2dd3c1b9c09cf43091356ed4e76a2344

SHA1
44d90bf37367974d79cbefc8a6015792331e10dd

SHA256
aab6a8352517b5927d96e901a3963c50a851a5b4b421ea45a797a52c347dc3ca

SHA512
c59c15644b97114d77230a41b33402695f960ddf7d381f4100078157158983eca40ef20f5e9ca70d153f49364c1cb39fe3a694d2b4c2c68e3be6dfaa0c1efb54

Download Submit
\Program Files (x86)\f74faa18\jusched.exe

Filesize
232KB

MD5
2dd3c1b9c09cf43091356ed4e76a2344

SHA1
44d90bf37367974d79cbefc8a6015792331e10dd

SHA256
aab6a8352517b5927d96e901a3963c50a851a5b4b421ea45a797a52c347dc3ca

SHA512
c59c15644b97114d77230a41b33402695f960ddf7d381f4100078157158983eca40ef20f5e9ca70d153f49364c1cb39fe3a694d2b4c2c68e3be6dfaa0c1efb54

Download Submit
\Program Files (x86)\f74faa18\jusched.exe

Filesize
232KB

MD5
2dd3c1b9c09cf43091356ed4e76a2344

SHA1
44d90bf37367974d79cbefc8a6015792331e10dd

SHA256
aab6a8352517b5927d96e901a3963c50a851a5b4b421ea45a797a52c347dc3ca

SHA512
c59c15644b97114d77230a41b33402695f960ddf7d381f4100078157158983eca40ef20f5e9ca70d153f49364c1cb39fe3a694d2b4c2c68e3be6dfaa0c1efb54

Download Submit
memory/1520-59-0x0000000000000000-mapping.dmp

Download
memory/1520-62-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1672-54-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1672-55-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download
memory/1672-56-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1672-61-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads