983a20e7f5d7f017dc3ee875fb507eb32dec20a0882dedecdb39a1a7894e7bc7

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 10:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

983a20e7f5d7f017dc3ee875fb507eb32dec20a0882dedecdb39a1a7894e7bc7.exe
Size

204KB
MD5

6cd2c8464799c4d1e79d3d2ce724a4da
SHA1

1b4aae8c61f128bdc769c3e4f2de3d63f46a079c
SHA256

983a20e7f5d7f017dc3ee875fb507eb32dec20a0882dedecdb39a1a7894e7bc7
SHA512

b5e79cdb5545c6ee68c4a2ddb7e422f6e7ecc0ee9e3795d0e7fd479e8995e25fbd5086e39639cd60c6b6f8c790eba854655380db418351e085109dd8406430ff
SSDEEP

3072:dePgCctxGv4QcU9KQ2BBA2waPxGtmolQt:hCctxGsWKQ2Bx5x2ct

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2004	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
1372	983a20e7f5d7f017dc3ee875fb507eb32dec20a0882dedecdb39a1a7894e7bc7.exe
1372	983a20e7f5d7f017dc3ee875fb507eb32dec20a0882dedecdb39a1a7894e7bc7.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	983a20e7f5d7f017dc3ee875fb507eb32dec20a0882dedecdb39a1a7894e7bc7.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	983a20e7f5d7f017dc3ee875fb507eb32dec20a0882dedecdb39a1a7894e7bc7.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\813b3d5b\jusched.exe	983a20e7f5d7f017dc3ee875fb507eb32dec20a0882dedecdb39a1a7894e7bc7.exe
File created	C:\Program Files (x86)\813b3d5b\813b3d5b	983a20e7f5d7f017dc3ee875fb507eb32dec20a0882dedecdb39a1a7894e7bc7.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	983a20e7f5d7f017dc3ee875fb507eb32dec20a0882dedecdb39a1a7894e7bc7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 2004	1372	983a20e7f5d7f017dc3ee875fb507eb32dec20a0882dedecdb39a1a7894e7bc7.exe	28
PID 1372 wrote to memory of 2004	1372	983a20e7f5d7f017dc3ee875fb507eb32dec20a0882dedecdb39a1a7894e7bc7.exe	28
PID 1372 wrote to memory of 2004	1372	983a20e7f5d7f017dc3ee875fb507eb32dec20a0882dedecdb39a1a7894e7bc7.exe	28
PID 1372 wrote to memory of 2004	1372	983a20e7f5d7f017dc3ee875fb507eb32dec20a0882dedecdb39a1a7894e7bc7.exe	28

C:\Users\Admin\AppData\Local\Temp\983a20e7f5d7f017dc3ee875fb507eb32dec20a0882dedecdb39a1a7894e7bc7.exe
"C:\Users\Admin\AppData\Local\Temp\983a20e7f5d7f017dc3ee875fb507eb32dec20a0882dedecdb39a1a7894e7bc7.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Program Files (x86)\813b3d5b\jusched.exe
  "C:\Program Files (x86)\813b3d5b\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:2004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\813b3d5b\813b3d5b

Filesize
17B

MD5
552bb86ed2797d3fd12ac0d273afaf75

SHA1
6e8633f9c24590779acbd3dd14c60f856320bc0a

SHA256
3ef9ff5da8272fd1b14c83f12c8d28fd9dbf32d56bcb714921032b02557fe789

SHA512
dab57227de02f4667cc8e2ec47566088b473caa0387caffbdfde37f3400da7d4f67dd222e83a4fa93592694bbcff7c52a2bcec074868baf221bc47d9370c8d2c

Download Submit
C:\Program Files (x86)\813b3d5b\jusched.exe

Filesize
204KB

MD5
15b1a1ae2a2b4daa5821ebc7eabba987

SHA1
d1d725e6c56b50c17575bd5ec4747a0b66fe3804

SHA256
2b54c4743b33f0a6cf8e932395654564f103be09b41666ed4452dcf5c10e6ab0

SHA512
a05e33b3d367295d1cf862b6ae2937910349c476d193a96611795d3fda28860276764fc1a0a51ad8d17652030e3d598afda937ff423e06529366dd21b1d7d1ce

Download Submit
\Program Files (x86)\813b3d5b\jusched.exe

Filesize
204KB

MD5
15b1a1ae2a2b4daa5821ebc7eabba987

SHA1
d1d725e6c56b50c17575bd5ec4747a0b66fe3804

SHA256
2b54c4743b33f0a6cf8e932395654564f103be09b41666ed4452dcf5c10e6ab0

SHA512
a05e33b3d367295d1cf862b6ae2937910349c476d193a96611795d3fda28860276764fc1a0a51ad8d17652030e3d598afda937ff423e06529366dd21b1d7d1ce

Download Submit
\Program Files (x86)\813b3d5b\jusched.exe

Filesize
204KB

MD5
15b1a1ae2a2b4daa5821ebc7eabba987

SHA1
d1d725e6c56b50c17575bd5ec4747a0b66fe3804

SHA256
2b54c4743b33f0a6cf8e932395654564f103be09b41666ed4452dcf5c10e6ab0

SHA512
a05e33b3d367295d1cf862b6ae2937910349c476d193a96611795d3fda28860276764fc1a0a51ad8d17652030e3d598afda937ff423e06529366dd21b1d7d1ce

Download Submit
memory/1372-54-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1372-55-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download
memory/1372-60-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2004-61-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download