6653aef857862f1dcc23149ea807a5ae3aa3aabf01589a02c81528f60913538f

Analysis

max time kernel
288s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 00:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6653aef857862f1dcc23149ea807a5ae3aa3aabf01589a02c81528f60913538f.exe
Size

196KB
MD5

ff48131d0a673fa57246fd6b9bb5657a
SHA1

f2fabcccbfdfe8d996c97c8b8db82a29650e12a6
SHA256

6653aef857862f1dcc23149ea807a5ae3aa3aabf01589a02c81528f60913538f
SHA512

54b4cf7d4e8ddf8e4b6b6b96727e5167f913ea50fccff2d5c08bd323b4d11af24a526d597221739df805010f871577b7205aca0f41a21d84e6678e6e7cdef651
SSDEEP

1536:5XBYjfC24mFVsIgvo3X4iZpTha5VlA8mO7aoL8f:5X+0mFmIgvo4iZhha5r7aoL8f

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
448	jusched.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	6653aef857862f1dcc23149ea807a5ae3aa3aabf01589a02c81528f60913538f.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\9636581f\jusched.exe	6653aef857862f1dcc23149ea807a5ae3aa3aabf01589a02c81528f60913538f.exe
File created	C:\Program Files (x86)\9636581f\9636581f	6653aef857862f1dcc23149ea807a5ae3aa3aabf01589a02c81528f60913538f.exe
File created	C:\Program Files (x86)\9636581f\info_a	6653aef857862f1dcc23149ea807a5ae3aa3aabf01589a02c81528f60913538f.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	6653aef857862f1dcc23149ea807a5ae3aa3aabf01589a02c81528f60913538f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 448	3168	6653aef857862f1dcc23149ea807a5ae3aa3aabf01589a02c81528f60913538f.exe	81
PID 3168 wrote to memory of 448	3168	6653aef857862f1dcc23149ea807a5ae3aa3aabf01589a02c81528f60913538f.exe	81
PID 3168 wrote to memory of 448	3168	6653aef857862f1dcc23149ea807a5ae3aa3aabf01589a02c81528f60913538f.exe	81

C:\Users\Admin\AppData\Local\Temp\6653aef857862f1dcc23149ea807a5ae3aa3aabf01589a02c81528f60913538f.exe
"C:\Users\Admin\AppData\Local\Temp\6653aef857862f1dcc23149ea807a5ae3aa3aabf01589a02c81528f60913538f.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Program Files (x86)\9636581f\jusched.exe
  "C:\Program Files (x86)\9636581f\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:448

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\9636581f\9636581f

Filesize
17B

MD5
bff3d8f76e182194c4a2abf1aabba9f3

SHA1
07e5b604bb505a800b3e0ac16fee483b70595768

SHA256
6bc8a4f93eaa1b3e7cfa696855bf6a852cf6555d694bc03e337261a27e58246f

SHA512
0c5def3bb01ed166d4135190e131c27be4b6039987e269b6c3fca07677b3c637868397f207df631a098182a6bd3c795e6dd34541f82c5ecd6062441af0af7f50

Download Submit
C:\Program Files (x86)\9636581f\info_a

Filesize
12B

MD5
8b742f64bbf1982131292de7d1913a25

SHA1
45d56483307f490e6cef6b563a1c147409a1d5e9

SHA256
09b67f5c4e52611829d7e6090043a4006f7760a961dc0c9e6a38a5f7f39db8a9

SHA512
176227de6f486a836956223e3df3416e3e49f24f00f8652eb4fa9a95ebc7e454341a5e48f680ca4aca3d47b3749b724df0b59d801dd7933e96ce04944403fb5d

Download Submit
C:\Program Files (x86)\9636581f\jusched.exe

Filesize
196KB

MD5
088b8a30be891b4787cab1b92e4a3e75

SHA1
d05969ce843c14136e7a0109f4be6ae552ca5ec9

SHA256
0defac712b9d1ade22fdc068aa356d7f87872f49cd1c25c46b84e9c4a31f83ba

SHA512
f2cc3b46b7347bf30deb2ed37a7967b62f22bf0685710daafc092df9f3ea5c54f43df35102e115945c6a070434f7c442c6a720c33a893d727d0f8a104c5a46b6

Download Submit
C:\Program Files (x86)\9636581f\jusched.exe

Filesize
196KB

MD5
088b8a30be891b4787cab1b92e4a3e75

SHA1
d05969ce843c14136e7a0109f4be6ae552ca5ec9

SHA256
0defac712b9d1ade22fdc068aa356d7f87872f49cd1c25c46b84e9c4a31f83ba

SHA512
f2cc3b46b7347bf30deb2ed37a7967b62f22bf0685710daafc092df9f3ea5c54f43df35102e115945c6a070434f7c442c6a720c33a893d727d0f8a104c5a46b6

Download Submit