Analysis
-
max time kernel
91s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 16:55
Static task
static1
Behavioral task
behavioral1
Sample
75062f0c176769202af8cfe712bc141b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
75062f0c176769202af8cfe712bc141b.exe
Resource
win10v2004-20231215-en
General
-
Target
75062f0c176769202af8cfe712bc141b.exe
-
Size
4.0MB
-
MD5
75062f0c176769202af8cfe712bc141b
-
SHA1
0847ff0777e9017bb71f5de6700e82baf7a0d3de
-
SHA256
446f5d4bdeb230747be93d2559e93006951730671d62d6ac1af8f7675fa29916
-
SHA512
93745d7a3373df154781236efbed2dbfc8b7306f9ae301daa0db21ba0240f6e2373af6448864d22f35f00f39a116b5bba836a9862bdf33a3de8dbff147af0d5d
-
SSDEEP
98304:7JoTa2NqO3oE6d5u889y15uxobSRWGR0IS2FVErAgEXqH+2:4amqS6ds8Qoux9rejaELQ2+2
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
75062f0c176769202af8cfe712bc141b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jusched.exe = "C:\\Windows\\System32\\jusched.exe" 75062f0c176769202af8cfe712bc141b.exe -
Drops file in System32 directory 2 IoCs
Processes:
75062f0c176769202af8cfe712bc141b.exedescription ioc process File created C:\Windows\SysWOW64\jusched.exe 75062f0c176769202af8cfe712bc141b.exe File opened for modification C:\Windows\SysWOW64\jusched.exe 75062f0c176769202af8cfe712bc141b.exe -
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3860 2460 WerFault.exe 75062f0c176769202af8cfe712bc141b.exe 3372 2460 WerFault.exe 75062f0c176769202af8cfe712bc141b.exe 2544 2460 WerFault.exe 75062f0c176769202af8cfe712bc141b.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
75062f0c176769202af8cfe712bc141b.exedescription pid process target process PID 2460 wrote to memory of 1388 2460 75062f0c176769202af8cfe712bc141b.exe schtasks.exe PID 2460 wrote to memory of 1388 2460 75062f0c176769202af8cfe712bc141b.exe schtasks.exe PID 2460 wrote to memory of 1388 2460 75062f0c176769202af8cfe712bc141b.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\75062f0c176769202af8cfe712bc141b.exe"C:\Users\Admin\AppData\Local\Temp\75062f0c176769202af8cfe712bc141b.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 3882⤵
- Program crash
PID:3860 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn startt /tr c:\autoexec.bat /sc onstart /ru system2⤵
- Creates scheduled task(s)
PID:1388 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 6562⤵
- Program crash
PID:3372 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 5882⤵
- Program crash
PID:2544
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2460 -ip 24601⤵PID:3928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2460 -ip 24601⤵PID:1584
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2460 -ip 24601⤵PID:4272
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2460-1-0x0000000000400000-0x0000000001334000-memory.dmpFilesize
15.2MB
-
memory/2460-2-0x0000000001480000-0x00000000014C7000-memory.dmpFilesize
284KB
-
memory/2460-3-0x0000000000400000-0x0000000001334000-memory.dmpFilesize
15.2MB
-
memory/2460-5-0x0000000005EA0000-0x0000000005F22000-memory.dmpFilesize
520KB
-
memory/2460-8-0x0000000003530000-0x0000000003531000-memory.dmpFilesize
4KB
-
memory/2460-4-0x0000000001430000-0x000000000143E000-memory.dmpFilesize
56KB
-
memory/2460-9-0x0000000000400000-0x0000000001334000-memory.dmpFilesize
15.2MB
-
memory/2460-10-0x0000000001480000-0x00000000014C7000-memory.dmpFilesize
284KB