Overview

overview

8

Static

static

2398cb5d96...57.exe

windows7-x64

8

2398cb5d96...57.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    152s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/12/2022, 00:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2398cb5d966b6b35d12adc2d6945aada01143aa6c24a27c5247dfd950ee78457.exe

  • Size

    36KB

  • MD5

    751e66b7f311b58f741ba4b89b0f1b4e

  • SHA1

    862e15262ee72aaed95b9e92617be046583e4653

  • SHA256

    2398cb5d966b6b35d12adc2d6945aada01143aa6c24a27c5247dfd950ee78457

  • SHA512

    4a203367453d470caadaefc8568fade370fdf60d6dbd64e85a2702e3ae0f5c03044d45936d310eba7e1697936e9e253d0f12a97f4ab39dee19694efe31887d88

  • SSDEEP

    768:NqQoj/dSzNVQ1mDNJWbKEdBMQXQ3Cn4eQQDrcwxj:MQoj/YNJcAQDD

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2398cb5d966b6b35d12adc2d6945aada01143aa6c24a27c5247dfd950ee78457.exe
    "C:\Users\Admin\AppData\Local\Temp\2398cb5d966b6b35d12adc2d6945aada01143aa6c24a27c5247dfd950ee78457.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2376
    • C:\Program Files (x86)\Java\jre-19\bin\jusched.exe
      "C:\Program Files (x86)\Java\jre-19\bin\jusched.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4692

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Java\jre-19\bin\UF
          Filesize

          13B

          MD5

          f253efe302d32ab264a76e0ce65be769

          SHA1

          768685ca582abd0af2fbb57ca37752aa98c9372b

          SHA256

          49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd

          SHA512

          1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4

          Download Submit

        • C:\Program Files (x86)\Java\jre-19\bin\jusched.exe
          Filesize

          36KB

          MD5

          52d867e6e0c284dac6918a331f79c696

          SHA1

          4ef18fa70c436f580615224c10fbadf0cb0bed41

          SHA256

          9ff236e7d83b075c98ffbc35dcf666cba6354366a9ad56af9dade8175bcf09d3

          SHA512

          0f1299b79d73bb76bbabee16377fdefb0f8f086c295b9d53f2d3194de179caa9eda1658109e5d31e7470cfcd7e59f593b7ed50bec86b18cebfc5d9d43cb8f4c7

          Download Submit

        • C:\Program Files (x86)\Java\jre-19\bin\jusched.exe
          Filesize

          36KB

          MD5

          52d867e6e0c284dac6918a331f79c696

          SHA1

          4ef18fa70c436f580615224c10fbadf0cb0bed41

          SHA256

          9ff236e7d83b075c98ffbc35dcf666cba6354366a9ad56af9dade8175bcf09d3

          SHA512

          0f1299b79d73bb76bbabee16377fdefb0f8f086c295b9d53f2d3194de179caa9eda1658109e5d31e7470cfcd7e59f593b7ed50bec86b18cebfc5d9d43cb8f4c7

          Download Submit