4864ca5e3006717bbfd2e5f90773f2cdb93315e64ce96676dc17e70583eebe93

Analysis

max time kernel
125s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/04/2024, 20:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4864ca5e3006717bbfd2e5f90773f2cdb93315e64ce96676dc17e70583eebe93.exe
Size

204KB
MD5

1b6408d5e0f222e83040ea1977628aa5
SHA1

58e413af8bc8687693a73e57b7bd0d0d7d6506bc
SHA256

4864ca5e3006717bbfd2e5f90773f2cdb93315e64ce96676dc17e70583eebe93
SHA512

474e98b1b60c1d07de8a2f2fbe2338b105f0c69978390a975246898760a692e6f86e2205e48f5639c070dba3a8ad526f822d9bdf4ec412e01688d3012a608ddf
SSDEEP

1536:tAnW+c+GL2VanyEAGHo7P1QAxdz28f9hLonUDjtNHorJ4:tec+E2wnC/P1QAxdznLonUvcJ4

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2892	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
2868	4864ca5e3006717bbfd2e5f90773f2cdb93315e64ce96676dc17e70583eebe93.exe
2868	4864ca5e3006717bbfd2e5f90773f2cdb93315e64ce96676dc17e70583eebe93.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\59da301\jusched.exe	4864ca5e3006717bbfd2e5f90773f2cdb93315e64ce96676dc17e70583eebe93.exe
File created	C:\Program Files (x86)\59da301\59da301	4864ca5e3006717bbfd2e5f90773f2cdb93315e64ce96676dc17e70583eebe93.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	4864ca5e3006717bbfd2e5f90773f2cdb93315e64ce96676dc17e70583eebe93.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2892	2868	4864ca5e3006717bbfd2e5f90773f2cdb93315e64ce96676dc17e70583eebe93.exe	28
PID 2868 wrote to memory of 2892	2868	4864ca5e3006717bbfd2e5f90773f2cdb93315e64ce96676dc17e70583eebe93.exe	28
PID 2868 wrote to memory of 2892	2868	4864ca5e3006717bbfd2e5f90773f2cdb93315e64ce96676dc17e70583eebe93.exe	28
PID 2868 wrote to memory of 2892	2868	4864ca5e3006717bbfd2e5f90773f2cdb93315e64ce96676dc17e70583eebe93.exe	28

C:\Users\Admin\AppData\Local\Temp\4864ca5e3006717bbfd2e5f90773f2cdb93315e64ce96676dc17e70583eebe93.exe
"C:\Users\Admin\AppData\Local\Temp\4864ca5e3006717bbfd2e5f90773f2cdb93315e64ce96676dc17e70583eebe93.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\59da301\jusched.exe
  "C:\Program Files (x86)\59da301\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\59da301\59da301

Filesize
17B

MD5
e99ce30360eb1b1de948d951ea86c500

SHA1
5c04a9c49bb19af7b481dbaa287e309693fcc857

SHA256
38ecebbb3d06a5a83f4e8a37b4ee8d32ea13cc6ab2acc8c065cffb9345529b1b

SHA512
81426bd7336e05f9ddccfd6e74847493b4e107802c46d559da77ff96b614f36cffb93c96380c2d9f970b32f899f88cb039dd7b60e0d450125776d5511885bfb2

Download Submit
\Program Files (x86)\59da301\jusched.exe

Filesize
204KB

MD5
5531f7b5f9eb082e4671d333ad6d4a73

SHA1
d44e289be685347b7e2b3f8b2a073527cc8e8e18

SHA256
7320b514af3f861a4f93573fd8d62f2b8171601d5a9c9045ba835c17fe146741

SHA512
fc62bf8c70548c846558845530fc005890dc9a72b7d4128593d1eb2b634453687fcb86daf47514f6864cbeb9bf1d78acadbb49ab1ea50a3d046a03c7af9cc83c

Download Submit
memory/2868-0-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/2868-7-0x0000000002690000-0x00000000026E1000-memory.dmp

Filesize
324KB

Download
memory/2868-13-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/2868-12-0x0000000002690000-0x00000000026E1000-memory.dmp

Filesize
324KB

Download
memory/2892-15-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/2892-16-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download