2398cb5d966b6b35d12adc2d6945aada01143aa6c24a27c5247dfd950ee78457

Analysis

max time kernel
149s
max time network
157s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 00:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2398cb5d966b6b35d12adc2d6945aada01143aa6c24a27c5247dfd950ee78457.exe
Size

36KB
MD5

751e66b7f311b58f741ba4b89b0f1b4e
SHA1

862e15262ee72aaed95b9e92617be046583e4653
SHA256

2398cb5d966b6b35d12adc2d6945aada01143aa6c24a27c5247dfd950ee78457
SHA512

4a203367453d470caadaefc8568fade370fdf60d6dbd64e85a2702e3ae0f5c03044d45936d310eba7e1697936e9e253d0f12a97f4ab39dee19694efe31887d88
SSDEEP

768:NqQoj/dSzNVQ1mDNJWbKEdBMQXQ3Cn4eQQDrcwxj:MQoj/YNJcAQDD

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1928	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
1736	2398cb5d966b6b35d12adc2d6945aada01143aa6c24a27c5247dfd950ee78457.exe
1736	2398cb5d966b6b35d12adc2d6945aada01143aa6c24a27c5247dfd950ee78457.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Java\jre-19\bin\UF	2398cb5d966b6b35d12adc2d6945aada01143aa6c24a27c5247dfd950ee78457.exe
File created	C:\Program Files (x86)\Java\jre-19\bin\jusched.exe	2398cb5d966b6b35d12adc2d6945aada01143aa6c24a27c5247dfd950ee78457.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe
1928	jusched.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1928	1736	2398cb5d966b6b35d12adc2d6945aada01143aa6c24a27c5247dfd950ee78457.exe	28
PID 1736 wrote to memory of 1928	1736	2398cb5d966b6b35d12adc2d6945aada01143aa6c24a27c5247dfd950ee78457.exe	28
PID 1736 wrote to memory of 1928	1736	2398cb5d966b6b35d12adc2d6945aada01143aa6c24a27c5247dfd950ee78457.exe	28
PID 1736 wrote to memory of 1928	1736	2398cb5d966b6b35d12adc2d6945aada01143aa6c24a27c5247dfd950ee78457.exe	28

C:\Users\Admin\AppData\Local\Temp\2398cb5d966b6b35d12adc2d6945aada01143aa6c24a27c5247dfd950ee78457.exe
"C:\Users\Admin\AppData\Local\Temp\2398cb5d966b6b35d12adc2d6945aada01143aa6c24a27c5247dfd950ee78457.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Program Files (x86)\Java\jre-19\bin\jusched.exe
  "C:\Program Files (x86)\Java\jre-19\bin\jusched.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Java\jre-19\bin\UF

Filesize
13B

MD5
f253efe302d32ab264a76e0ce65be769

SHA1
768685ca582abd0af2fbb57ca37752aa98c9372b

SHA256
49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd

SHA512
1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4

Download Submit
C:\Program Files (x86)\Java\jre-19\bin\jusched.exe

Filesize
36KB

MD5
2daaf34f2dd2119dcf2627a8433c0ff2

SHA1
e4ed1b6442d2bdaa051a14e63782fbed2d115c7b

SHA256
24fc68229f2a5c4e0e4faa9f9817b68e0442dc1206ddbb289fb979155500ce7b

SHA512
dff9213fbb5fc2bb94038f75f5775a9c4bf8726f2232fe43ad8056e2b92fc23fe01e43675be6806e93dd3d08543dc251e8cbd6ff5f816f9f21acb58ee3882395

Download Submit
\Program Files (x86)\Java\jre-19\bin\jusched.exe

Filesize
36KB

MD5
2daaf34f2dd2119dcf2627a8433c0ff2

SHA1
e4ed1b6442d2bdaa051a14e63782fbed2d115c7b

SHA256
24fc68229f2a5c4e0e4faa9f9817b68e0442dc1206ddbb289fb979155500ce7b

SHA512
dff9213fbb5fc2bb94038f75f5775a9c4bf8726f2232fe43ad8056e2b92fc23fe01e43675be6806e93dd3d08543dc251e8cbd6ff5f816f9f21acb58ee3882395

Download Submit
\Program Files (x86)\Java\jre-19\bin\jusched.exe

Filesize
36KB

MD5
2daaf34f2dd2119dcf2627a8433c0ff2

SHA1
e4ed1b6442d2bdaa051a14e63782fbed2d115c7b

SHA256
24fc68229f2a5c4e0e4faa9f9817b68e0442dc1206ddbb289fb979155500ce7b

SHA512
dff9213fbb5fc2bb94038f75f5775a9c4bf8726f2232fe43ad8056e2b92fc23fe01e43675be6806e93dd3d08543dc251e8cbd6ff5f816f9f21acb58ee3882395

Download Submit
memory/1736-54-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download