Analysis
- max time kernel
150s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
08/01/2024, 04:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4a67f9a4a5c41ccb57f0aa2f1cedd45f.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
4a67f9a4a5c41ccb57f0aa2f1cedd45f.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 4a67f9a4a5c41ccb57f0aa2f1cedd45f.exe
- Size 34KB
- Sample240108-esc64sbhc5
- SHA256 30edacbf646e2754e3f5a6dfb7e0d0e5e10b0f8eaad6cc83442bec1659a58db8
- MD5 4a67f9a4a5c41ccb57f0aa2f1cedd45f
- SHA1 a02c7df39ce25f2e9adcaff78f73bbb3a389bb05
- SHA512 3be5bfca0f590c53c836d969fe6196b69d6256f4c80c3a678a6002ec3c8538d47142904c7442bf9b59a265b15934a62883ab3aca1c567af149ecb1eff434e1a2
- SSDEEP 768:cflivXrVKpVhKvtxwYHwVFoeAQBmucwUn:ylqrVKprVuQBK
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation 4a67f9a4a5c41ccb57f0aa2f1cedd45f.exe - Executes dropped EXE 1 IoCs
pid Process 1552 jusched.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\be37def\be37def 4a67f9a4a5c41ccb57f0aa2f1cedd45f.exe File created C:\Program Files (x86)\be37def\jusched.exe 4a67f9a4a5c41ccb57f0aa2f1cedd45f.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe 1552 jusched.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4328 wrote to memory of 1552 4328 4a67f9a4a5c41ccb57f0aa2f1cedd45f.exe 93 PID 4328 wrote to memory of 1552 4328 4a67f9a4a5c41ccb57f0aa2f1cedd45f.exe 93 PID 4328 wrote to memory of 1552 4328 4a67f9a4a5c41ccb57f0aa2f1cedd45f.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a67f9a4a5c41ccb57f0aa2f1cedd45f.exe"C:\Users\Admin\AppData\Local\Temp\4a67f9a4a5c41ccb57f0aa2f1cedd45f.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Program Files (x86)\be37def\jusched.exe"C:\Program Files (x86)\be37def\jusched.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1552
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\be37def\be37def
- Size 13B
- SHA256 49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
- MD5 f253efe302d32ab264a76e0ce65be769
- SHA1 768685ca582abd0af2fbb57ca37752aa98c9372b
- SHA512 1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\be37def\jusched.exe
- Size 34KB
- SHA256 1016ea5639ce7d3893fd6567e8204aa023a0dbdc03981eea9311d357f6e952b9
- MD5 b51f801962a19836550ac7ace06ad588
- SHA1 cf05f80dba39d23b1e727fcaf98aba54cc28af32
- SHA512 5f3df579651de42de1b5d36897866d87ba2977f991dc74d9e584e293ffacf7c3ded417dd083553d87d273e283f021daaaf272454444fcff6097c0349c9496e0c
- SSDEEP 768:cflivXrVKpVhKvtxwYHwVFoeAQImucwUj:ylqrVKprVuQIS
- MD5 SHA1 SHA512 SSDEEP