196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063

Analysis

max time kernel
188s
max time network
228s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 03:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063.exe
Size

192KB
MD5

c6b6ada4af2228bb4efd739c15fff10e
SHA1

8465461533b24cb90f25b72b17371c37a3095e10
SHA256

196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063
SHA512

4d694056339b5eefdef5736931de1d812505a4ecf41bfbfadf3f2fedc3fa2378bfbfe08a9dcf4ec0d1b04e1659f556e63325efbcb105ec9cc7bd362ed23f257c
SSDEEP

1536:vvVQb4cLIkN+4Weat2RKLjWlC48Pp9JAcjrSrowg:vvVQLIkLWeaA8KlCph9Growg

Score

10^/10

persistence

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Executes dropped EXE 1 IoCs

pid	Process
400	jusched.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run	196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\5a457554\jusched.exe	196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063.exe
File created	C:\Program Files (x86)\5a457554\5a457554	196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 400	4380	196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063.exe	81
PID 4380 wrote to memory of 400	4380	196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063.exe	81
PID 4380 wrote to memory of 400	4380	196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063.exe	81

C:\Users\Admin\AppData\Local\Temp\196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063.exe
"C:\Users\Admin\AppData\Local\Temp\196155f5683076612302454a3c5923a7d45a955d421a4d3044d2cd972d350063.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Program Files (x86)\5a457554\jusched.exe
  "C:\Program Files (x86)\5a457554\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:400

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\5a457554\5a457554

Filesize
17B

MD5
7bdf61d37c9adf3e1c6937107016091f

SHA1
56b8e0c454f9dd16d508a04b3afa7e458453ac41

SHA256
4c57d86c256214baa0a5a3322ef5cdd575210455b7e964ad60382bd9d4be12e0

SHA512
ff4fc1a427c84f47042375749f45ee6edea73b902ae977f14243ebceb7b9a28f41fe5dd404e3ea381754d9122202bc6b61ed0152b20a1c1be76c225dd20861d1

Download Submit
C:\Program Files (x86)\5a457554\jusched.exe

Filesize
192KB

MD5
871995ecd5da4e1498af737f98243ed5

SHA1
d553d29ae5031c1469390ed5dc933ba238f3fefa

SHA256
1a77301759053ecd8e35a533c059b76d7e79fa5fcceb29f4ade3403644828621

SHA512
f67c2d76ad2163e567371262e056f5088a15c3c4c8c18b26a520fafc34d5210b10778c146d2cad6d4b85d161944d5e39689b28b04f8077c3d4fbd739a713b353

Download Submit
C:\Program Files (x86)\5a457554\jusched.exe

Filesize
192KB

MD5
871995ecd5da4e1498af737f98243ed5

SHA1
d553d29ae5031c1469390ed5dc933ba238f3fefa

SHA256
1a77301759053ecd8e35a533c059b76d7e79fa5fcceb29f4ade3403644828621

SHA512
f67c2d76ad2163e567371262e056f5088a15c3c4c8c18b26a520fafc34d5210b10778c146d2cad6d4b85d161944d5e39689b28b04f8077c3d4fbd739a713b353

Download Submit
memory/400-137-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4380-132-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4380-136-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download