533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4

General

Target

533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe
Size

213KB
MD5

3f83802b28a76223445ed1aee2f8cdf0
SHA1

3d68789453f1c68ea396db44b322f0c57d92d66e
SHA256

533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4
SHA512

06f0114cdc4c569a7907ce4abe7190c22a138d6658c36f96446fecafde9e6b5c94fa4ac39de5490792a3636654c563ed74005ca62effb048c6e8740b91e1ff85
SSDEEP

1536:/5AiTLOQ74YDtnlN5UL09atT0mBBAragjSvIYFwAmd/olQpNuI:/53mQ7JtnP5I09qgmBBAWgjSvwN/olWT

Score

10^/10

persistence

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Executes dropped EXE 1 IoCs

pid	Process
952	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
1972	533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe
1972	533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run	533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\23a8a7af\jusched.exe	533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe
File created	C:\Program Files (x86)\23a8a7af\23a8a7af	533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 952	1972	533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe	28
PID 1972 wrote to memory of 952	1972	533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe	28
PID 1972 wrote to memory of 952	1972	533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe	28
PID 1972 wrote to memory of 952	1972	533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe	28

C:\Users\Admin\AppData\Local\Temp\533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe
"C:\Users\Admin\AppData\Local\Temp\533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Program Files (x86)\23a8a7af\jusched.exe
  "C:\Program Files (x86)\23a8a7af\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\23a8a7af\23a8a7af

Filesize
17B

MD5
4d77d6b250ffb567743b8dbcdad695b8

SHA1
d5a8f98f9433f6d36c74df463cef3e2cf524462d

SHA256
7ec7a3a23890c3592f5b762aecf11adbf8831fad11b8048aedfa7315d599c5f2

SHA512
5655153049101fd67125d484c81f1ad30b44f36f00e3aabfe8d730a21661f4b394357b60da549289def4311b4cc7bd508d8fd6b8db254cd442b2152f8902bd71

Download Submit
C:\Program Files (x86)\23a8a7af\jusched.exe

Filesize
213KB

MD5
9d4d58960f1bb104212a0186df62f785

SHA1
3f79cd71c55ea8d73c681ae9fd2f8cc88e158c8a

SHA256
c53ba22014d1b467c665fad6e2e07cd013160d9898af31dbdcd5259aa4872e7d

SHA512
2025a0d0d14b71d3d5837970634053d9045a8d6966d3c983e76e18a2593f16e0f45de4ac77409ea60bccea6891022d86a2651c692d4a3d54404e4929cc903fee

Download Submit
\Program Files (x86)\23a8a7af\jusched.exe

Filesize
213KB

MD5
9d4d58960f1bb104212a0186df62f785

SHA1
3f79cd71c55ea8d73c681ae9fd2f8cc88e158c8a

SHA256
c53ba22014d1b467c665fad6e2e07cd013160d9898af31dbdcd5259aa4872e7d

SHA512
2025a0d0d14b71d3d5837970634053d9045a8d6966d3c983e76e18a2593f16e0f45de4ac77409ea60bccea6891022d86a2651c692d4a3d54404e4929cc903fee

Download Submit
\Program Files (x86)\23a8a7af\jusched.exe

Filesize
213KB

MD5
9d4d58960f1bb104212a0186df62f785

SHA1
3f79cd71c55ea8d73c681ae9fd2f8cc88e158c8a

SHA256
c53ba22014d1b467c665fad6e2e07cd013160d9898af31dbdcd5259aa4872e7d

SHA512
2025a0d0d14b71d3d5837970634053d9045a8d6966d3c983e76e18a2593f16e0f45de4ac77409ea60bccea6891022d86a2651c692d4a3d54404e4929cc903fee

Download Submit
memory/952-62-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1972-54-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1972-55-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download
memory/1972-60-0x0000000001EB0000-0x0000000001F09000-memory.dmp

Filesize
356KB

Download
memory/1972-61-0x0000000001EB0000-0x0000000001F09000-memory.dmp

Filesize
356KB

Download
memory/1972-63-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download

Analysis

Sharing