Analysis
-
max time kernel
130s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
15-10-2023 19:42
Static task
static1
Behavioral task
behavioral1
Sample
a60cf7efc2377fe9ed86a9fa2f4ba8f0_exe32.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
a60cf7efc2377fe9ed86a9fa2f4ba8f0_exe32.exe
Resource
win10v2004-20230915-en
General
-
Target
a60cf7efc2377fe9ed86a9fa2f4ba8f0_exe32.exe
-
Size
224KB
-
MD5
a60cf7efc2377fe9ed86a9fa2f4ba8f0
-
SHA1
acbe5f92322a52c2f56baa3b6046f0e941e8fb83
-
SHA256
8a09833749c4d48210e885688a7f1208d4a96c00a1ea5c925b0bea552e0f09d3
-
SHA512
f5f37e2c47f43b6e762fd838677a522f8c0c4953dd329ed24959e45090cda6020873d9a78d6e2a719ce8d3ba742c3ce24aa6f9ea10deb05b3d78479a3de1c24c
-
SSDEEP
1536:HvV6iLUWGI3UmkFlgZLu6xXXq5pm9AKTrSrowl+Oy:HvV6iUW5UmkH+lxX6Tmwrowl5y
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation a60cf7efc2377fe9ed86a9fa2f4ba8f0_exe32.exe -
Executes dropped EXE 1 IoCs
pid Process 828 jusched.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\28a89378\jusched.exe a60cf7efc2377fe9ed86a9fa2f4ba8f0_exe32.exe File created C:\Program Files (x86)\28a89378\28a89378 a60cf7efc2377fe9ed86a9fa2f4ba8f0_exe32.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\Update23.job a60cf7efc2377fe9ed86a9fa2f4ba8f0_exe32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 748 wrote to memory of 828 748 a60cf7efc2377fe9ed86a9fa2f4ba8f0_exe32.exe 87 PID 748 wrote to memory of 828 748 a60cf7efc2377fe9ed86a9fa2f4ba8f0_exe32.exe 87 PID 748 wrote to memory of 828 748 a60cf7efc2377fe9ed86a9fa2f4ba8f0_exe32.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\a60cf7efc2377fe9ed86a9fa2f4ba8f0_exe32.exe"C:\Users\Admin\AppData\Local\Temp\a60cf7efc2377fe9ed86a9fa2f4ba8f0_exe32.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Program Files (x86)\28a89378\jusched.exe"C:\Program Files (x86)\28a89378\jusched.exe"2⤵
- Executes dropped EXE
PID:828
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17B
MD57bdf61d37c9adf3e1c6937107016091f
SHA156b8e0c454f9dd16d508a04b3afa7e458453ac41
SHA2564c57d86c256214baa0a5a3322ef5cdd575210455b7e964ad60382bd9d4be12e0
SHA512ff4fc1a427c84f47042375749f45ee6edea73b902ae977f14243ebceb7b9a28f41fe5dd404e3ea381754d9122202bc6b61ed0152b20a1c1be76c225dd20861d1
-
Filesize
224KB
MD52006f825619ab5db04a0cee5f34c8eea
SHA199d13ea8f22e08f08e31b00adc5f9e0def6c7fb7
SHA256cdae350c163b31c8d33dbe3f35119e0696baecf5709ee84e37086ad2ef9f6ffe
SHA51220524e0546ca588b37a269cc7618fcea9689097a53aeb755ce7ee41c92d3d9ebabec55a5c25a3382f4a2628c415f8dba67e396b8f75eb2d66dc00896f7595ef3
-
Filesize
224KB
MD52006f825619ab5db04a0cee5f34c8eea
SHA199d13ea8f22e08f08e31b00adc5f9e0def6c7fb7
SHA256cdae350c163b31c8d33dbe3f35119e0696baecf5709ee84e37086ad2ef9f6ffe
SHA51220524e0546ca588b37a269cc7618fcea9689097a53aeb755ce7ee41c92d3d9ebabec55a5c25a3382f4a2628c415f8dba67e396b8f75eb2d66dc00896f7595ef3
-
Filesize
224KB
MD52006f825619ab5db04a0cee5f34c8eea
SHA199d13ea8f22e08f08e31b00adc5f9e0def6c7fb7
SHA256cdae350c163b31c8d33dbe3f35119e0696baecf5709ee84e37086ad2ef9f6ffe
SHA51220524e0546ca588b37a269cc7618fcea9689097a53aeb755ce7ee41c92d3d9ebabec55a5c25a3382f4a2628c415f8dba67e396b8f75eb2d66dc00896f7595ef3