cb2da95f12635030c237ae01fc61de2283693b82b348f5d099f5d5508604a7d4

Analysis

max time kernel
174s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/11/2022, 23:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb2da95f12635030c237ae01fc61de2283693b82b348f5d099f5d5508604a7d4.exe
Size

1.1MB
MD5

a97e986c7cb1677f21c04b94d8bf5ad6
SHA1

8ac497688ab1b3cb9323fcb161af9ffd1d758185
SHA256

cb2da95f12635030c237ae01fc61de2283693b82b348f5d099f5d5508604a7d4
SHA512

68590ef8223776476dd50b870430a1211e71152b9bfe4d5f84bce64ad6950ed7946f69b79c2781395c9cbae02183de678e85ff147a13fd4376c6458832e650fa
SSDEEP

768:O/5inm+cd5rHemPXkqUEphjVuvios1rPr4adL0NqlJMU60+ppQ1TTGfLw:ORsvcdcQjosnvnZ6LQ1Ew

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
griptoloji
Password:
741852

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1932	jusched.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	cb2da95f12635030c237ae01fc61de2283693b82b348f5d099f5d5508604a7d4.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Java\jre-09\bin\jusched.exe	cb2da95f12635030c237ae01fc61de2283693b82b348f5d099f5d5508604a7d4.exe
File opened for modification	C:\Program Files (x86)\Java\jre-09\bin\jusched.exe	cb2da95f12635030c237ae01fc61de2283693b82b348f5d099f5d5508604a7d4.exe
File created	C:\Program Files (x86)\Java\jre-09\bin\UF	cb2da95f12635030c237ae01fc61de2283693b82b348f5d099f5d5508604a7d4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe
1932	jusched.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 1932	3216	cb2da95f12635030c237ae01fc61de2283693b82b348f5d099f5d5508604a7d4.exe	79
PID 3216 wrote to memory of 1932	3216	cb2da95f12635030c237ae01fc61de2283693b82b348f5d099f5d5508604a7d4.exe	79
PID 3216 wrote to memory of 1932	3216	cb2da95f12635030c237ae01fc61de2283693b82b348f5d099f5d5508604a7d4.exe	79

C:\Users\Admin\AppData\Local\Temp\cb2da95f12635030c237ae01fc61de2283693b82b348f5d099f5d5508604a7d4.exe
"C:\Users\Admin\AppData\Local\Temp\cb2da95f12635030c237ae01fc61de2283693b82b348f5d099f5d5508604a7d4.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Program Files (x86)\Java\jre-09\bin\jusched.exe
  "C:\Program Files (x86)\Java\jre-09\bin\jusched.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Java\jre-09\bin\jusched.exe

Filesize
1.1MB

MD5
e5201bef31787375f0a214010bf55035

SHA1
9ae9233c4b98206a805ec216601bd2d59478be8f

SHA256
43ac575ca9787b18a27d7c31fcea8fe38f80589d3c84bf4dbc8afdfb0778420b

SHA512
6f3c4d2bc2e545dbaec1542dd2a074c1299324c2927f3cd096f0a4aef553dea70858cbdbb7c92974b2e37a96d94ad1ba3d376fc8e356464800a1af31d9bdde89

Download Submit
C:\Program Files (x86)\Java\jre-09\bin\jusched.exe

Filesize
1.1MB

MD5
e5201bef31787375f0a214010bf55035

SHA1
9ae9233c4b98206a805ec216601bd2d59478be8f

SHA256
43ac575ca9787b18a27d7c31fcea8fe38f80589d3c84bf4dbc8afdfb0778420b

SHA512
6f3c4d2bc2e545dbaec1542dd2a074c1299324c2927f3cd096f0a4aef553dea70858cbdbb7c92974b2e37a96d94ad1ba3d376fc8e356464800a1af31d9bdde89

Download Submit
memory/1932-137-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1932-138-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3216-132-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3216-136-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download