Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 16:55
Static task
static1
Behavioral task
behavioral1
Sample
75062f0c176769202af8cfe712bc141b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
75062f0c176769202af8cfe712bc141b.exe
Resource
win10v2004-20231215-en
General
-
Target
75062f0c176769202af8cfe712bc141b.exe
-
Size
4.0MB
-
MD5
75062f0c176769202af8cfe712bc141b
-
SHA1
0847ff0777e9017bb71f5de6700e82baf7a0d3de
-
SHA256
446f5d4bdeb230747be93d2559e93006951730671d62d6ac1af8f7675fa29916
-
SHA512
93745d7a3373df154781236efbed2dbfc8b7306f9ae301daa0db21ba0240f6e2373af6448864d22f35f00f39a116b5bba836a9862bdf33a3de8dbff147af0d5d
-
SSDEEP
98304:7JoTa2NqO3oE6d5u889y15uxobSRWGR0IS2FVErAgEXqH+2:4amqS6ds8Qoux9rejaELQ2+2
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
75062f0c176769202af8cfe712bc141b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\jusched.exe = "C:\\Windows\\System32\\jusched.exe" 75062f0c176769202af8cfe712bc141b.exe -
Drops file in System32 directory 2 IoCs
Processes:
75062f0c176769202af8cfe712bc141b.exedescription ioc process File created C:\Windows\SysWOW64\jusched.exe 75062f0c176769202af8cfe712bc141b.exe File opened for modification C:\Windows\SysWOW64\jusched.exe 75062f0c176769202af8cfe712bc141b.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
75062f0c176769202af8cfe712bc141b.exepid process 2408 75062f0c176769202af8cfe712bc141b.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
75062f0c176769202af8cfe712bc141b.exedescription pid process target process PID 2408 wrote to memory of 3032 2408 75062f0c176769202af8cfe712bc141b.exe schtasks.exe PID 2408 wrote to memory of 3032 2408 75062f0c176769202af8cfe712bc141b.exe schtasks.exe PID 2408 wrote to memory of 3032 2408 75062f0c176769202af8cfe712bc141b.exe schtasks.exe PID 2408 wrote to memory of 3032 2408 75062f0c176769202af8cfe712bc141b.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\75062f0c176769202af8cfe712bc141b.exe"C:\Users\Admin\AppData\Local\Temp\75062f0c176769202af8cfe712bc141b.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn startt /tr c:\autoexec.bat /sc onstart /ru system2⤵
- Creates scheduled task(s)
PID:3032
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2408-1-0x0000000000400000-0x0000000001334000-memory.dmpFilesize
15.2MB
-
memory/2408-2-0x0000000000340000-0x0000000000387000-memory.dmpFilesize
284KB
-
memory/2408-3-0x0000000000400000-0x0000000001334000-memory.dmpFilesize
15.2MB
-
memory/2408-4-0x0000000000230000-0x000000000023E000-memory.dmpFilesize
56KB
-
memory/2408-5-0x0000000001340000-0x00000000013C2000-memory.dmpFilesize
520KB
-
memory/2408-6-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2408-10-0x0000000000400000-0x0000000001334000-memory.dmpFilesize
15.2MB
-
memory/2408-11-0x0000000000340000-0x0000000000387000-memory.dmpFilesize
284KB
-
memory/2408-12-0x0000000000400000-0x0000000001334000-memory.dmpFilesize
15.2MB
-
memory/2408-13-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2408-14-0x0000000000400000-0x0000000001334000-memory.dmpFilesize
15.2MB
-
memory/2408-15-0x0000000000400000-0x0000000001334000-memory.dmpFilesize
15.2MB
-
memory/2408-16-0x0000000000400000-0x0000000001334000-memory.dmpFilesize
15.2MB
-
memory/2408-20-0x0000000000400000-0x0000000001334000-memory.dmpFilesize
15.2MB