fda2a0883de1ffd5a2187e451067dd13e928ff4966af92a68e97515a8246498d

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2023 11:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d45374b46c82a682797573c724eacdc_JC.exe
Size

378KB
MD5

1d45374b46c82a682797573c724eacdc
SHA1

632e0062c53712a8c8ec71174bac34b81a758e70
SHA256

fda2a0883de1ffd5a2187e451067dd13e928ff4966af92a68e97515a8246498d
SHA512

e0fda598baf0c052ba8eea18ad2047e5c97f67bcabeba1040200b031fb2d2b2c160c8e2e940aa4d54053699eeda67b7268884f1b180ccd5568809ed53bd810a8
SSDEEP

6144:YVTarW9Q2dT6VPAKovnQUvmmAF7J77777S40XB8:YVmrW9HGPGvnQUvmmAF7J77777SnXB8

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation	1d45374b46c82a682797573c724eacdc_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
740	jusched.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\c435e491\jusched.exe	1d45374b46c82a682797573c724eacdc_JC.exe
File created	C:\Program Files (x86)\c435e491\c435e491	1d45374b46c82a682797573c724eacdc_JC.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	1d45374b46c82a682797573c724eacdc_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 740	1864	1d45374b46c82a682797573c724eacdc_JC.exe	88
PID 1864 wrote to memory of 740	1864	1d45374b46c82a682797573c724eacdc_JC.exe	88
PID 1864 wrote to memory of 740	1864	1d45374b46c82a682797573c724eacdc_JC.exe	88

C:\Users\Admin\AppData\Local\Temp\1d45374b46c82a682797573c724eacdc_JC.exe
"C:\Users\Admin\AppData\Local\Temp\1d45374b46c82a682797573c724eacdc_JC.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Program Files (x86)\c435e491\jusched.exe
  "C:\Program Files (x86)\c435e491\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\c435e491\c435e491

Filesize
17B

MD5
209aa6c14d66621f3aa1cee03a8bf5dc

SHA1
0f5bce2a29d3306586934b6d846a172078ee8e66

SHA256
57ef9e3c809cf3ca41782d4c7119c3ae7e43ccbb1c00d978b745677f14b82c2e

SHA512
8b9fb2bcc8e8785a48d3fe212f852c2f108ef2ab20e9e2a61e9bba5857002abe9111e42411bfc573e50c126031b7ef0433bddfa357de2ca0814f7d31157b9c63

Download Submit
C:\Program Files (x86)\c435e491\jusched.exe

Filesize
378KB

MD5
6fcf58a708badaaed541ed2b51b20d7a

SHA1
a4f4a9c1f39b43df226285bbdee51bc8b09d8aad

SHA256
0528ed7a802f851cddeca2a5c1ea950598be3049f79206fa6147a90f26206a9f

SHA512
eb75bb2c249d034dcab3e20c0e7d8f2c9c08c6eafcd6217a73e718ec14a707d000baffb0cd8288c01888e9b6a70a5251d6189d91d9f9a92ad66d847918b7f4db

Download Submit
C:\Program Files (x86)\c435e491\jusched.exe

Filesize
378KB

MD5
6fcf58a708badaaed541ed2b51b20d7a

SHA1
a4f4a9c1f39b43df226285bbdee51bc8b09d8aad

SHA256
0528ed7a802f851cddeca2a5c1ea950598be3049f79206fa6147a90f26206a9f

SHA512
eb75bb2c249d034dcab3e20c0e7d8f2c9c08c6eafcd6217a73e718ec14a707d000baffb0cd8288c01888e9b6a70a5251d6189d91d9f9a92ad66d847918b7f4db

Download Submit
C:\Program Files (x86)\c435e491\jusched.exe

Filesize
378KB

MD5
6fcf58a708badaaed541ed2b51b20d7a

SHA1
a4f4a9c1f39b43df226285bbdee51bc8b09d8aad

SHA256
0528ed7a802f851cddeca2a5c1ea950598be3049f79206fa6147a90f26206a9f

SHA512
eb75bb2c249d034dcab3e20c0e7d8f2c9c08c6eafcd6217a73e718ec14a707d000baffb0cd8288c01888e9b6a70a5251d6189d91d9f9a92ad66d847918b7f4db

Download Submit
memory/740-14-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/740-17-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1864-0-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1864-3-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1864-16-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download