69512411d319793d3099db229dabbfdec7ec0236190cfc3b81c64e72d7ca44ee

Analysis

max time kernel
152s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-03-2024 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b54d74580c6003ce1c1a41b4b664a702.exe
Size

120KB
MD5

b54d74580c6003ce1c1a41b4b664a702
SHA1

c620b29ba0dd7522d1d235aa7c0dc97f0eee6645
SHA256

69512411d319793d3099db229dabbfdec7ec0236190cfc3b81c64e72d7ca44ee
SHA512

e90de3fb152f46e25555f69c7e10706067b049e37660e2a5d203b5c9a03c5b7a6df9206bbe3eca8e9b213d02bcd3e7cc09f8851f369121c0d9784485e3060ba6
SSDEEP

1536:HxFu5bNlaLnVGhjL/jUpKiLRfMNMcEMIhrHRrwcLyWUgkbQOsuXzznVdrIPZfPl:+5PfjUtRfxjRhbRrBGlRsujzVdr+ft

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\b54d74580c6003ce1c1a41b4b664a702.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b54d74580c6003ce1c1a41b4b664a702.exe:*:Enabled:Java developer Script Browse"	b54d74580c6003ce1c1a41b4b664a702.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\b54d74580c6003ce1c1a41b4b664a702.exe = "C:\\Windows\\jusched.exe:*:Enabled:Java developer Script Browse"	b54d74580c6003ce1c1a41b4b664a702.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	b54d74580c6003ce1c1a41b4b664a702.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	b54d74580c6003ce1c1a41b4b664a702.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	b54d74580c6003ce1c1a41b4b664a702.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3852	netsh.exe
2880	netsh.exe

Executes dropped EXE 3 IoCs

pid	Process
392	jusched.exe
1284	jusched.exe
4904	jusched.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Java developer Script Browse = "C:\\Windows\\jusched.exe"	b54d74580c6003ce1c1a41b4b664a702.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java developer Script Browse = "C:\\Windows\\jusched.exe"	b54d74580c6003ce1c1a41b4b664a702.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2860 set thread context of 1792	2860	b54d74580c6003ce1c1a41b4b664a702.exe	94
PID 1792 set thread context of 2168	1792	b54d74580c6003ce1c1a41b4b664a702.exe	95
PID 392 set thread context of 1284	392	jusched.exe	100
PID 1284 set thread context of 4904	1284	jusched.exe	102

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\mdll.dl	jusched.exe
File opened for modification	C:\Windows\mtdll.dl	jusched.exe
File opened for modification	C:\Windows\jusched.exe	jusched.exe
File created	C:\Windows\jusched.exb	b54d74580c6003ce1c1a41b4b664a702.exe
File opened for modification	C:\Windows\jusched.exb	b54d74580c6003ce1c1a41b4b664a702.exe
File opened for modification	C:\Windows\jusched.exe	b54d74580c6003ce1c1a41b4b664a702.exe
File created	C:\Windows\jusched.exe	b54d74580c6003ce1c1a41b4b664a702.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4604	sc.exe

Runs net.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 1792	2860	b54d74580c6003ce1c1a41b4b664a702.exe	94
PID 2860 wrote to memory of 1792	2860	b54d74580c6003ce1c1a41b4b664a702.exe	94
PID 2860 wrote to memory of 1792	2860	b54d74580c6003ce1c1a41b4b664a702.exe	94
PID 2860 wrote to memory of 1792	2860	b54d74580c6003ce1c1a41b4b664a702.exe	94
PID 2860 wrote to memory of 1792	2860	b54d74580c6003ce1c1a41b4b664a702.exe	94
PID 2860 wrote to memory of 1792	2860	b54d74580c6003ce1c1a41b4b664a702.exe	94
PID 2860 wrote to memory of 1792	2860	b54d74580c6003ce1c1a41b4b664a702.exe	94
PID 1792 wrote to memory of 2168	1792	b54d74580c6003ce1c1a41b4b664a702.exe	95
PID 1792 wrote to memory of 2168	1792	b54d74580c6003ce1c1a41b4b664a702.exe	95
PID 1792 wrote to memory of 2168	1792	b54d74580c6003ce1c1a41b4b664a702.exe	95
PID 1792 wrote to memory of 2168	1792	b54d74580c6003ce1c1a41b4b664a702.exe	95
PID 1792 wrote to memory of 2168	1792	b54d74580c6003ce1c1a41b4b664a702.exe	95
PID 2168 wrote to memory of 3852	2168	b54d74580c6003ce1c1a41b4b664a702.exe	98
PID 2168 wrote to memory of 3852	2168	b54d74580c6003ce1c1a41b4b664a702.exe	98
PID 2168 wrote to memory of 3852	2168	b54d74580c6003ce1c1a41b4b664a702.exe	98
PID 2168 wrote to memory of 392	2168	b54d74580c6003ce1c1a41b4b664a702.exe	99
PID 2168 wrote to memory of 392	2168	b54d74580c6003ce1c1a41b4b664a702.exe	99
PID 2168 wrote to memory of 392	2168	b54d74580c6003ce1c1a41b4b664a702.exe	99
PID 392 wrote to memory of 1284	392	jusched.exe	100
PID 392 wrote to memory of 1284	392	jusched.exe	100
PID 392 wrote to memory of 1284	392	jusched.exe	100
PID 392 wrote to memory of 1284	392	jusched.exe	100
PID 392 wrote to memory of 1284	392	jusched.exe	100
PID 392 wrote to memory of 1284	392	jusched.exe	100
PID 392 wrote to memory of 1284	392	jusched.exe	100
PID 1284 wrote to memory of 4904	1284	jusched.exe	102
PID 1284 wrote to memory of 4904	1284	jusched.exe	102
PID 1284 wrote to memory of 4904	1284	jusched.exe	102
PID 1284 wrote to memory of 4904	1284	jusched.exe	102
PID 1284 wrote to memory of 4904	1284	jusched.exe	102
PID 2168 wrote to memory of 512	2168	b54d74580c6003ce1c1a41b4b664a702.exe	101
PID 2168 wrote to memory of 512	2168	b54d74580c6003ce1c1a41b4b664a702.exe	101
PID 2168 wrote to memory of 512	2168	b54d74580c6003ce1c1a41b4b664a702.exe	101
PID 4904 wrote to memory of 2880	4904	jusched.exe	103
PID 4904 wrote to memory of 2880	4904	jusched.exe	103
PID 4904 wrote to memory of 2880	4904	jusched.exe	103
PID 4904 wrote to memory of 3336	4904	jusched.exe	104
PID 4904 wrote to memory of 3336	4904	jusched.exe	104
PID 4904 wrote to memory of 3336	4904	jusched.exe	104
PID 4904 wrote to memory of 4604	4904	jusched.exe	105
PID 4904 wrote to memory of 4604	4904	jusched.exe	105
PID 4904 wrote to memory of 4604	4904	jusched.exe	105
PID 3336 wrote to memory of 4072	3336	net.exe	109
PID 3336 wrote to memory of 4072	3336	net.exe	109
PID 3336 wrote to memory of 4072	3336	net.exe	109
PID 864 wrote to memory of 4884	864	explorer.exe	110
PID 864 wrote to memory of 4884	864	explorer.exe	110

C:\Users\Admin\AppData\Local\Temp\b54d74580c6003ce1c1a41b4b664a702.exe
"C:\Users\Admin\AppData\Local\Temp\b54d74580c6003ce1c1a41b4b664a702.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Users\Admin\AppData\Local\Temp\b54d74580c6003ce1c1a41b4b664a702.exe
  C:\Users\Admin\AppData\Local\Temp\b54d74580c6003ce1c1a41b4b664a702.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Users\Admin\AppData\Local\Temp\b54d74580c6003ce1c1a41b4b664a702.exe
    C:\Users\Admin\AppData\Local\Temp\b54d74580c6003ce1c1a41b4b664a702.exe
    3⤵
    - Modifies firewall policy service
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram 1.exe 1 ENABLE
      4⤵
      Modifies Windows Firewall
      PID:3852
  - - C:\Windows\jusched.exe
      "C:\Windows\jusched.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:392
    - - C:\Windows\jusched.exe
        
        C:\Windows\jusched.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1284
      - C:\Windows\jusched.exe
        
        C:\Windows\jusched.exe
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4904
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram 1.exe 1 ENABLE
        7⤵
        Modifies Windows Firewall
        
        PID:2880
        
        C:\Windows\SysWOW64\net.exe
        
        net stop wuauserv
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3336
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        8⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\sc.exe
        
        sc config wuauserv start= disabled
        7⤵
        Launches sc.exe
        
        PID:4604
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe http://browseusers.myspace.com/Browse/Browse.aspx
      4⤵
      PID:512

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://browseusers.myspace.com/Browse/Browse.aspx
  2⤵
  PID:4884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=3504 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:1
1⤵
PID:1552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4508 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:1
1⤵
PID:2176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5036 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5376 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:1
1⤵
PID:3688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=5720 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:1
1⤵
PID:3648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=5624 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:1
1⤵
PID:2852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --mojo-platform-channel-handle=5596 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:1
1⤵
PID:2352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=5456 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:4348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\jusched.exb

Filesize
1KB

MD5
4af70e81696e5eb5db88f33ff23f8ee0

SHA1
4a237da0997a6fb9ac6c2fa1fef05dd5b7d3aa74

SHA256
4e83a3f11da5b0031507b24ae76698ae3095a8899c11cc1e46ad3bd6dd0449e1

SHA512
cd3def36e9b0331b2d9bf84be5fe286471c757087c61ff2497476f9fbd331bdb08b1d764147ba891ac40434565e878109830487a3c977b5cabaec0d38f90464c

Download Submit
C:\Windows\jusched.exe

Filesize
120KB

MD5
b54d74580c6003ce1c1a41b4b664a702

SHA1
c620b29ba0dd7522d1d235aa7c0dc97f0eee6645

SHA256
69512411d319793d3099db229dabbfdec7ec0236190cfc3b81c64e72d7ca44ee

SHA512
e90de3fb152f46e25555f69c7e10706067b049e37660e2a5d203b5c9a03c5b7a6df9206bbe3eca8e9b213d02bcd3e7cc09f8851f369121c0d9784485e3060ba6

Download Submit
C:\Windows\jusched.exe

Filesize
90KB

MD5
16335c58142fbbd283c7bd6a14fa6f04

SHA1
271e168e8bb6c895cb914ef45db787402f448c8a

SHA256
2412a7f68b196b922980c2c81decfd2f8f3e8f4488c3e2734380d5f858463095

SHA512
e116876ec8d3484836bc4af97081670df20597380235b5f679f9767d378d19385e312e9526b710dad72480b9b1c89e2f8b57c50b940daf09bfb962a4858fdddd

Download Submit
memory/392-74-0x0000000000760000-0x0000000000770000-memory.dmp

Filesize
64KB

Download
memory/392-56-0x0000000000760000-0x0000000000770000-memory.dmp

Filesize
64KB

Download
memory/1284-63-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1284-60-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1792-19-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1792-21-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1792-22-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1792-25-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2168-24-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/2168-71-0x0000000000400000-0x00000000006FF000-memory.dmp

Filesize
3.0MB

Download
memory/2168-27-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/2168-23-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/2168-70-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/2168-28-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/2860-16-0x0000000000930000-0x0000000000940000-memory.dmp

Filesize
64KB

Download
memory/2860-9-0x0000000000930000-0x0000000000940000-memory.dmp

Filesize
64KB

Download
memory/2860-8-0x0000000000930000-0x0000000000940000-memory.dmp

Filesize
64KB

Download
memory/2860-15-0x0000000000930000-0x0000000000940000-memory.dmp

Filesize
64KB

Download
memory/4904-75-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/4904-72-0x0000000000400000-0x00000000006FF000-memory.dmp

Filesize
3.0MB

Download
memory/4904-67-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/4904-66-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/4904-77-0x0000000000400000-0x00000000006FF000-memory.dmp

Filesize
3.0MB

Download
memory/4904-79-0x0000000000400000-0x0000000000700000-memory.dmp

Filesize
3.0MB

Download
memory/4904-81-0x0000000000400000-0x00000000006FF000-memory.dmp

Filesize
3.0MB

Download
memory/4904-82-0x0000000000400000-0x00000000006FF000-memory.dmp

Filesize
3.0MB

Download
memory/4904-84-0x0000000000400000-0x00000000006FF000-memory.dmp

Filesize
3.0MB

Download
memory/4904-87-0x0000000000400000-0x00000000006FF000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads