533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4

Analysis

max time kernel
112s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe
Size

213KB
MD5

3f83802b28a76223445ed1aee2f8cdf0
SHA1

3d68789453f1c68ea396db44b322f0c57d92d66e
SHA256

533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4
SHA512

06f0114cdc4c569a7907ce4abe7190c22a138d6658c36f96446fecafde9e6b5c94fa4ac39de5490792a3636654c563ed74005ca62effb048c6e8740b91e1ff85
SSDEEP

1536:/5AiTLOQ74YDtnlN5UL09atT0mBBAragjSvIYFwAmd/olQpNuI:/53mQ7JtnP5I09qgmBBAWgjSvwN/olWT

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4244	jusched.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\b0fd3d68\jusched.exe	533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe
File created	C:\Program Files (x86)\b0fd3d68\b0fd3d68	533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 4244	5044	533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe	82
PID 5044 wrote to memory of 4244	5044	533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe	82
PID 5044 wrote to memory of 4244	5044	533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe	82

C:\Users\Admin\AppData\Local\Temp\533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe
"C:\Users\Admin\AppData\Local\Temp\533f16a00d77e02b7d5a99c9e7fded1bb8764654f58aa56ef6a6979c1dc56bc4.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Program Files (x86)\b0fd3d68\jusched.exe
  "C:\Program Files (x86)\b0fd3d68\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:4244

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\b0fd3d68\b0fd3d68

Filesize
17B

MD5
4d77d6b250ffb567743b8dbcdad695b8

SHA1
d5a8f98f9433f6d36c74df463cef3e2cf524462d

SHA256
7ec7a3a23890c3592f5b762aecf11adbf8831fad11b8048aedfa7315d599c5f2

SHA512
5655153049101fd67125d484c81f1ad30b44f36f00e3aabfe8d730a21661f4b394357b60da549289def4311b4cc7bd508d8fd6b8db254cd442b2152f8902bd71

Download Submit
C:\Program Files (x86)\b0fd3d68\jusched.exe

Filesize
213KB

MD5
3b1b35d1ba1fb64882084d3877069d52

SHA1
886ca818fe4340e8c8358648408873b1b73433ca

SHA256
ad847c4f2ef02655207f7b8943ce2707340ca91436ee5f9a877acd3b6f906ea1

SHA512
479e34033d0b74218590d2d4a089e44596315f08c615e73c39ffb2f565a4c9aa00c99c91eda5f0691ea94bf1b0a4fed1fca376bc6a30319d53bacde626fe060d

Download Submit
C:\Program Files (x86)\b0fd3d68\jusched.exe

Filesize
213KB

MD5
3b1b35d1ba1fb64882084d3877069d52

SHA1
886ca818fe4340e8c8358648408873b1b73433ca

SHA256
ad847c4f2ef02655207f7b8943ce2707340ca91436ee5f9a877acd3b6f906ea1

SHA512
479e34033d0b74218590d2d4a089e44596315f08c615e73c39ffb2f565a4c9aa00c99c91eda5f0691ea94bf1b0a4fed1fca376bc6a30319d53bacde626fe060d

Download Submit
memory/4244-137-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/4244-139-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5044-132-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/5044-136-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download