196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063

Analysis

max time kernel
189s
max time network
229s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
07/12/2022, 03:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063.exe
Size

192KB
MD5

c6b6ada4af2228bb4efd739c15fff10e
SHA1

8465461533b24cb90f25b72b17371c37a3095e10
SHA256

196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063
SHA512

4d694056339b5eefdef5736931de1d812505a4ecf41bfbfadf3f2fedc3fa2378bfbfe08a9dcf4ec0d1b04e1659f556e63325efbcb105ec9cc7bd362ed23f257c
SSDEEP

1536:vvVQb4cLIkN+4Weat2RKLjWlC48Pp9JAcjrSrowg:vvVQLIkLWeaA8KlCph9Growg

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1172	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
268	196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063.exe
268	196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\3b1836d9\jusched.exe	196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063.exe
File created	C:\Program Files (x86)\3b1836d9\3b1836d9	196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 268 wrote to memory of 1172	268	196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063.exe	28
PID 268 wrote to memory of 1172	268	196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063.exe	28
PID 268 wrote to memory of 1172	268	196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063.exe	28
PID 268 wrote to memory of 1172	268	196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063.exe	28

C:\Users\Admin\AppData\Local\Temp\196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063.exe
"C:\Users\Admin\AppData\Local\Temp\196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:268
- C:\Program Files (x86)\3b1836d9\jusched.exe
  "C:\Program Files (x86)\3b1836d9\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:1172

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\3b1836d9\3b1836d9

Filesize
17B

MD5
7bdf61d37c9adf3e1c6937107016091f

SHA1
56b8e0c454f9dd16d508a04b3afa7e458453ac41

SHA256
4c57d86c256214baa0a5a3322ef5cdd575210455b7e964ad60382bd9d4be12e0

SHA512
ff4fc1a427c84f47042375749f45ee6edea73b902ae977f14243ebceb7b9a28f41fe5dd404e3ea381754d9122202bc6b61ed0152b20a1c1be76c225dd20861d1

Download Submit
C:\Program Files (x86)\3b1836d9\jusched.exe

Filesize
192KB

MD5
58554760ecb52878502e5661966fb3d6

SHA1
512e7b5e1613f58a63177f6211232675f72093ea

SHA256
59b0dd5ee8c7251ce4aaccff9b24287cbb1c5a8fa9e165242b55fbb4487f34d6

SHA512
d3a9f5ab149a2d758beb6a44fafeecfad41388188ad05c3b467fcec3c6e338f0c244ca48e09a32e38e002e2a1d79299de1f2207756cd029f8cd39ae033526902

Download Submit
\Program Files (x86)\3b1836d9\jusched.exe

Filesize
192KB

MD5
58554760ecb52878502e5661966fb3d6

SHA1
512e7b5e1613f58a63177f6211232675f72093ea

SHA256
59b0dd5ee8c7251ce4aaccff9b24287cbb1c5a8fa9e165242b55fbb4487f34d6

SHA512
d3a9f5ab149a2d758beb6a44fafeecfad41388188ad05c3b467fcec3c6e338f0c244ca48e09a32e38e002e2a1d79299de1f2207756cd029f8cd39ae033526902

Download Submit
\Program Files (x86)\3b1836d9\jusched.exe

Filesize
192KB

MD5
58554760ecb52878502e5661966fb3d6

SHA1
512e7b5e1613f58a63177f6211232675f72093ea

SHA256
59b0dd5ee8c7251ce4aaccff9b24287cbb1c5a8fa9e165242b55fbb4487f34d6

SHA512
d3a9f5ab149a2d758beb6a44fafeecfad41388188ad05c3b467fcec3c6e338f0c244ca48e09a32e38e002e2a1d79299de1f2207756cd029f8cd39ae033526902

Download Submit
memory/268-54-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/268-55-0x0000000075F01000-0x0000000075F03000-memory.dmp

Filesize
8KB

Download
memory/268-56-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/268-60-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1172-62-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download