3a9d5f0879793f2758b2d0399ff7164370c2c388f23eca724ba59342d37382eb

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-02-2024 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a234c470b33e60e90adcede0a28124e6.exe
Size

196KB
MD5

a234c470b33e60e90adcede0a28124e6
SHA1

1147bc85efaf30ef8d61e525080aee70a1ecc6cd
SHA256

3a9d5f0879793f2758b2d0399ff7164370c2c388f23eca724ba59342d37382eb
SHA512

439c2f24e53abc152d890ff763de10741a11204c45b8cf95da4cf8b543273ee4065d7f15ea34327050bc98caac8f5509cc95340b726a12673814276132949ffd
SSDEEP

1536:lXBYjfC24mFVsIgvo3X4iZpTha5VlA8mx7aoL8R:lX+0mFmIgvo4iZhha5rEaoL8R

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3052	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
2208	a234c470b33e60e90adcede0a28124e6.exe
2208	a234c470b33e60e90adcede0a28124e6.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\303964ef\jusched.exe	a234c470b33e60e90adcede0a28124e6.exe
File created	C:\Program Files (x86)\303964ef\303964ef	a234c470b33e60e90adcede0a28124e6.exe
File created	C:\Program Files (x86)\303964ef\info_a	a234c470b33e60e90adcede0a28124e6.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	a234c470b33e60e90adcede0a28124e6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 3052	2208	a234c470b33e60e90adcede0a28124e6.exe	28
PID 2208 wrote to memory of 3052	2208	a234c470b33e60e90adcede0a28124e6.exe	28
PID 2208 wrote to memory of 3052	2208	a234c470b33e60e90adcede0a28124e6.exe	28
PID 2208 wrote to memory of 3052	2208	a234c470b33e60e90adcede0a28124e6.exe	28

C:\Users\Admin\AppData\Local\Temp\a234c470b33e60e90adcede0a28124e6.exe
"C:\Users\Admin\AppData\Local\Temp\a234c470b33e60e90adcede0a28124e6.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\303964ef\jusched.exe
  "C:\Program Files (x86)\303964ef\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\303964ef\303964ef

Filesize
17B

MD5
bff3d8f76e182194c4a2abf1aabba9f3

SHA1
07e5b604bb505a800b3e0ac16fee483b70595768

SHA256
6bc8a4f93eaa1b3e7cfa696855bf6a852cf6555d694bc03e337261a27e58246f

SHA512
0c5def3bb01ed166d4135190e131c27be4b6039987e269b6c3fca07677b3c637868397f207df631a098182a6bd3c795e6dd34541f82c5ecd6062441af0af7f50

Download Submit
C:\Program Files (x86)\303964ef\info_a

Filesize
12B

MD5
51cfc67c73fa2a86eed542492e8dd4a4

SHA1
6d71aa0d9b0c8c68ac958b34c59502ec723f97c6

SHA256
272d645a7c06bcd76eca300979cb20b0f5c74c1a9f66ac5280486fd172e59d09

SHA512
a6756ed9d767ad90971e07dd082c57533efbfb2bcf00460827f862e3957a8f84644978866cc58e6017efe552156c4bc8c171bfd482b139c93e9bb356a1e47549

Download Submit
\Program Files (x86)\303964ef\jusched.exe

Filesize
196KB

MD5
6f5ec404a122a5495a99df03dc6269ca

SHA1
93c30dc8cd095240a409f8d6dc69d1616bcbad87

SHA256
a42af31237e3366ca55272b885cdc8466e466c56212db505806173cbb67c495f

SHA512
bf94db8e800e373c88693fe7810e667d0b2e10872fde86c5743dbab49daecc97a0eb718ed05c74c4901628bc5e5ef25ab54f5a6a5f6d0ec1101dd1184ccbdc43

Download Submit