Analysis
- max time kernel
153s - max time network
174s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
29/11/2022, 04:57
Static task
static1
Behavioral task
behavioral1
Sample
96ef0e56a246839f80e2fd37e7b909e91e7fb7259da9eeffc4a297915142f00d.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
96ef0e56a246839f80e2fd37e7b909e91e7fb7259da9eeffc4a297915142f00d.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 96ef0e56a246839f80e2fd37e7b909e91e7fb7259da9eeffc4a297915142f00d.exe
- Size 36KB
- Sample221129-fla9lsbd6z
- SHA256 96ef0e56a246839f80e2fd37e7b909e91e7fb7259da9eeffc4a297915142f00d
- MD5 9adab4a07b0dce16ba53ddfa6b2451d9
- SHA1 1647b5447d44d9ec260b7cc58ead59c5321a1700
- SHA512 5fcf6d6c646b26c52159859f0036ba4d640e25b8f2ff0d0b7b2542888c6422301bdec068f7166a3256b1d2b5e1dce080000f4c89b628cfe304493db8d9d73f9e
- SSDEEP 768:zqqYMYa/TMfwvmjdZBMZXQ3Qin4e/QPhcwxeI:+qYMz2wvdivQPQI
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Credentials
-
Protocol
ftp
-
Host
ftp.tripod.com
-
Port
21
-
Username
onthelinux
-
Password
741852abc
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1996 jusched.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 96ef0e56a246839f80e2fd37e7b909e91e7fb7259da9eeffc4a297915142f00d.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Java\jre-20\bin\jusched.exe 96ef0e56a246839f80e2fd37e7b909e91e7fb7259da9eeffc4a297915142f00d.exe File created C:\Program Files (x86)\Java\jre-20\bin\UF 96ef0e56a246839f80e2fd37e7b909e91e7fb7259da9eeffc4a297915142f00d.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe 1996 jusched.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4060 wrote to memory of 1996 4060 96ef0e56a246839f80e2fd37e7b909e91e7fb7259da9eeffc4a297915142f00d.exe 83 PID 4060 wrote to memory of 1996 4060 96ef0e56a246839f80e2fd37e7b909e91e7fb7259da9eeffc4a297915142f00d.exe 83 PID 4060 wrote to memory of 1996 4060 96ef0e56a246839f80e2fd37e7b909e91e7fb7259da9eeffc4a297915142f00d.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\96ef0e56a246839f80e2fd37e7b909e91e7fb7259da9eeffc4a297915142f00d.exe"C:\Users\Admin\AppData\Local\Temp\96ef0e56a246839f80e2fd37e7b909e91e7fb7259da9eeffc4a297915142f00d.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Program Files (x86)\Java\jre-20\bin\jusched.exe"C:\Program Files (x86)\Java\jre-20\bin\jusched.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1996
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Java\jre-20\bin\UF
- Size 13B
- SHA256 49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
- MD5 f253efe302d32ab264a76e0ce65be769
- SHA1 768685ca582abd0af2fbb57ca37752aa98c9372b
- SHA512 1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Java\jre-20\bin\jusched.exe
- Size 36KB
- SHA256 fbbf93805fa70472c8a7f92a79b7ada916b30258088f204a4331b098b345a708
- MD5 3d0238ebbeec013dfb76049b9405e2ad
- SHA1 42d98052586e2ffa930239d5e502caff5084798e
- SHA512 1a169be2a6f38ab670c34ccafdb21d46b42745b803d95ffb87a0c752c27ae8eaacb7f741db1840e86552cbb9666c3d1cedaca2b0343dd7b0b68c57e3721fc091
- SSDEEP 768:zqqYMYa/TMfwvmjdZBMZXQ3Qin4e/Qrhcwxe+o:+qYMz2wvdivQrQ+o
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Java\jre-20\bin\jusched.exe
- Size 36KB
- SHA256 fbbf93805fa70472c8a7f92a79b7ada916b30258088f204a4331b098b345a708
- MD5 3d0238ebbeec013dfb76049b9405e2ad
- SHA1 42d98052586e2ffa930239d5e502caff5084798e
- SHA512 1a169be2a6f38ab670c34ccafdb21d46b42745b803d95ffb87a0c752c27ae8eaacb7f741db1840e86552cbb9666c3d1cedaca2b0343dd7b0b68c57e3721fc091
- SSDEEP 768:zqqYMYa/TMfwvmjdZBMZXQ3Qin4e/Qrhcwxe+o:+qYMz2wvdivQrQ+o
- MD5 SHA1 SHA512 SSDEEP