Analysis
-
max time kernel
197s -
max time network
213s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
03-12-2022 10:24
General
-
Target
7956405085d6e7d9c65725d6462a108d1ddd6d4b55e67eb707482b6dcf9c4b4e.exe
-
Size
34KB
-
MD5
5fe9eb1fb846909ee9303cba9bf19133
-
SHA1
9ec87abafef4684e98cb53be5d4bb57d5cf434bb
-
SHA256
7956405085d6e7d9c65725d6462a108d1ddd6d4b55e67eb707482b6dcf9c4b4e
-
SHA512
58ad2553c5dcbb87e6d46b5190b8ab5a7e8879dc342f4735bc656a3708999b321fbd2b28593339779e7abf064d28c30e087b5b7015a73a4288b2261a2e046f1c
-
SSDEEP
768:3zQYScGrIubHuYtvdxwYHw5FAe2QzncwxM:jQTIubHy5wQzw
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops file in Program Files directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7956405085d6e7d9c65725d6462a108d1ddd6d4b55e67eb707482b6dcf9c4b4e.exe"C:\Users\Admin\AppData\Local\Temp\7956405085d6e7d9c65725d6462a108d1ddd6d4b55e67eb707482b6dcf9c4b4e.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\2ba0fe2c\jusched.exe"C:\Program Files (x86)\2ba0fe2c\jusched.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD5f253efe302d32ab264a76e0ce65be769
SHA1768685ca582abd0af2fbb57ca37752aa98c9372b
SHA25649dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
SHA5121990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
-
Filesize
34KB
MD501a8d0797d15ee0e578f6da2d1cd8273
SHA1acacb5b092ab1375cf422f4000fd18f53e379b77
SHA256c0e7375af08b06cee8bd16c39b485c06b5a07975bc380696e4463384cd73a175
SHA512a9e3a0ad24b3b5dd0165055de78120daa8f561e144650869e2585d8775dcec24c6ab3154d5bb2d823aa7886c40a82afdeb35638e1faba62a448591dad7996f46
-
Filesize
34KB
MD501a8d0797d15ee0e578f6da2d1cd8273
SHA1acacb5b092ab1375cf422f4000fd18f53e379b77
SHA256c0e7375af08b06cee8bd16c39b485c06b5a07975bc380696e4463384cd73a175
SHA512a9e3a0ad24b3b5dd0165055de78120daa8f561e144650869e2585d8775dcec24c6ab3154d5bb2d823aa7886c40a82afdeb35638e1faba62a448591dad7996f46
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB