a86a751c766cdb4cf054e00663dc3b1b83f9aeec69dadfcb2b4573fa5a5df02e

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 09:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a86a751c766cdb4cf054e00663dc3b1b83f9aeec69dadfcb2b4573fa5a5df02e.exe
Size

34KB
MD5

10eac377d3e2e43091730457fda3e352
SHA1

295560b7521e7a9041d006dc17a67885995136cf
SHA256

a86a751c766cdb4cf054e00663dc3b1b83f9aeec69dadfcb2b4573fa5a5df02e
SHA512

8d48409d347e29a0990862bdbee8a5f073a50b03f881d76b5f5f7ede854f61e5fe4a66e9b484d95fdd32d146eaf4da53921e3009422143274adc3bdb33497b74
SSDEEP

768:cflivXrVKpVhKvtxwYHwVFoeAQmmucwUv:ylqrVKprVuQmm

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1948	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
1636	a86a751c766cdb4cf054e00663dc3b1b83f9aeec69dadfcb2b4573fa5a5df02e.exe
1636	a86a751c766cdb4cf054e00663dc3b1b83f9aeec69dadfcb2b4573fa5a5df02e.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\c3f8e1ef\jusched.exe	a86a751c766cdb4cf054e00663dc3b1b83f9aeec69dadfcb2b4573fa5a5df02e.exe
File created	C:\Program Files (x86)\c3f8e1ef\c3f8e1ef	a86a751c766cdb4cf054e00663dc3b1b83f9aeec69dadfcb2b4573fa5a5df02e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe
1948	jusched.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1948	1636	a86a751c766cdb4cf054e00663dc3b1b83f9aeec69dadfcb2b4573fa5a5df02e.exe	28
PID 1636 wrote to memory of 1948	1636	a86a751c766cdb4cf054e00663dc3b1b83f9aeec69dadfcb2b4573fa5a5df02e.exe	28
PID 1636 wrote to memory of 1948	1636	a86a751c766cdb4cf054e00663dc3b1b83f9aeec69dadfcb2b4573fa5a5df02e.exe	28
PID 1636 wrote to memory of 1948	1636	a86a751c766cdb4cf054e00663dc3b1b83f9aeec69dadfcb2b4573fa5a5df02e.exe	28

C:\Users\Admin\AppData\Local\Temp\a86a751c766cdb4cf054e00663dc3b1b83f9aeec69dadfcb2b4573fa5a5df02e.exe
"C:\Users\Admin\AppData\Local\Temp\a86a751c766cdb4cf054e00663dc3b1b83f9aeec69dadfcb2b4573fa5a5df02e.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Program Files (x86)\c3f8e1ef\jusched.exe
  "C:\Program Files (x86)\c3f8e1ef\jusched.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\c3f8e1ef\c3f8e1ef

Filesize
13B

MD5
f253efe302d32ab264a76e0ce65be769

SHA1
768685ca582abd0af2fbb57ca37752aa98c9372b

SHA256
49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd

SHA512
1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4

Download Submit
C:\Program Files (x86)\c3f8e1ef\jusched.exe

Filesize
34KB

MD5
3e1f6766ce324e9f4b738c75b2a6d5da

SHA1
9524c3a82750d285312d779d495a88b4a91fac01

SHA256
545091bbe05b27623c6d2c509624c05367064aa95b62a6ed3a73612b9d5ffeab

SHA512
bcfd4383efe0e848a19743a08667bba9c0e2aae237dd6b9777c54fcb16b7370ce38fe11b59da0b4a3b0da02e6cebfedfbaa7cfb459a7156a66edd8a3f2a7d363

Download Submit
\Program Files (x86)\c3f8e1ef\jusched.exe

Filesize
34KB

MD5
3e1f6766ce324e9f4b738c75b2a6d5da

SHA1
9524c3a82750d285312d779d495a88b4a91fac01

SHA256
545091bbe05b27623c6d2c509624c05367064aa95b62a6ed3a73612b9d5ffeab

SHA512
bcfd4383efe0e848a19743a08667bba9c0e2aae237dd6b9777c54fcb16b7370ce38fe11b59da0b4a3b0da02e6cebfedfbaa7cfb459a7156a66edd8a3f2a7d363

Download Submit
\Program Files (x86)\c3f8e1ef\jusched.exe

Filesize
34KB

MD5
3e1f6766ce324e9f4b738c75b2a6d5da

SHA1
9524c3a82750d285312d779d495a88b4a91fac01

SHA256
545091bbe05b27623c6d2c509624c05367064aa95b62a6ed3a73612b9d5ffeab

SHA512
bcfd4383efe0e848a19743a08667bba9c0e2aae237dd6b9777c54fcb16b7370ce38fe11b59da0b4a3b0da02e6cebfedfbaa7cfb459a7156a66edd8a3f2a7d363

Download Submit
memory/1636-54-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download