add9cb601efd62e91af92edf7b2e5deede03f83a039ac054d96f839e57535e8c

Analysis

max time kernel
156s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 03:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

add9cb601efd62e91af92edf7b2e5deede03f83a039ac054d96f839e57535e8c.exe
Size

208KB
MD5

760681f702cd40def7f901cab0918169
SHA1

7296bb9cd23a31878a0f0734c4a346000ed1a5b0
SHA256

add9cb601efd62e91af92edf7b2e5deede03f83a039ac054d96f839e57535e8c
SHA512

3ad5b9ec2f10687e0ec39b8a78ba5a3fa930cffa338c45aae6fe2fef4e8803a01a977ea4fc575cea85621eae75cfc64874eae8b08431bf53f3554336d90b3f58
SSDEEP

1536:a5AiTLOQ74YDtnlN5UL09atT0mBBAragjSvIYFwAmd/odQpNuf:a53mQ7JtnP5I09qgmBBAWgjSvwN/odWm

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2164	jusched.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	add9cb601efd62e91af92edf7b2e5deede03f83a039ac054d96f839e57535e8c.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	add9cb601efd62e91af92edf7b2e5deede03f83a039ac054d96f839e57535e8c.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	add9cb601efd62e91af92edf7b2e5deede03f83a039ac054d96f839e57535e8c.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\a168a66c\a168a66c	add9cb601efd62e91af92edf7b2e5deede03f83a039ac054d96f839e57535e8c.exe
File created	C:\Program Files (x86)\a168a66c\jusched.exe	add9cb601efd62e91af92edf7b2e5deede03f83a039ac054d96f839e57535e8c.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	add9cb601efd62e91af92edf7b2e5deede03f83a039ac054d96f839e57535e8c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 2164	544	add9cb601efd62e91af92edf7b2e5deede03f83a039ac054d96f839e57535e8c.exe	80
PID 544 wrote to memory of 2164	544	add9cb601efd62e91af92edf7b2e5deede03f83a039ac054d96f839e57535e8c.exe	80
PID 544 wrote to memory of 2164	544	add9cb601efd62e91af92edf7b2e5deede03f83a039ac054d96f839e57535e8c.exe	80

C:\Users\Admin\AppData\Local\Temp\add9cb601efd62e91af92edf7b2e5deede03f83a039ac054d96f839e57535e8c.exe
"C:\Users\Admin\AppData\Local\Temp\add9cb601efd62e91af92edf7b2e5deede03f83a039ac054d96f839e57535e8c.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:544
- C:\Program Files (x86)\a168a66c\jusched.exe
  "C:\Program Files (x86)\a168a66c\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:2164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\a168a66c\a168a66c

Filesize
17B

MD5
4d77d6b250ffb567743b8dbcdad695b8

SHA1
d5a8f98f9433f6d36c74df463cef3e2cf524462d

SHA256
7ec7a3a23890c3592f5b762aecf11adbf8831fad11b8048aedfa7315d599c5f2

SHA512
5655153049101fd67125d484c81f1ad30b44f36f00e3aabfe8d730a21661f4b394357b60da549289def4311b4cc7bd508d8fd6b8db254cd442b2152f8902bd71

Download Submit
C:\Program Files (x86)\a168a66c\jusched.exe

Filesize
208KB

MD5
8a95aace4d87eef5ae49e45594c4a60d

SHA1
cf89dbcf2dbdb78147ad5d28c62171a0fbfb4da5

SHA256
1d862b04be02d38ee36c8c129e44ee549065c18a041bd9a564707465e92f9209

SHA512
26bc6d285d9b9d2d7a1a6bebe1587dbbc233f46d6a301ccc4aeb6701a37fa8e07bf85d2c6fa26c019406c3f778c2affea2b8a5bea80d326dac8998a3f7306641

Download Submit
C:\Program Files (x86)\a168a66c\jusched.exe

Filesize
208KB

MD5
8a95aace4d87eef5ae49e45594c4a60d

SHA1
cf89dbcf2dbdb78147ad5d28c62171a0fbfb4da5

SHA256
1d862b04be02d38ee36c8c129e44ee549065c18a041bd9a564707465e92f9209

SHA512
26bc6d285d9b9d2d7a1a6bebe1587dbbc233f46d6a301ccc4aeb6701a37fa8e07bf85d2c6fa26c019406c3f778c2affea2b8a5bea80d326dac8998a3f7306641

Download Submit