4864ca5e3006717bbfd2e5f90773f2cdb93315e64ce96676dc17e70583eebe93

Analysis

max time kernel
155s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 20:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4864ca5e3006717bbfd2e5f90773f2cdb93315e64ce96676dc17e70583eebe93.exe
Size

204KB
MD5

1b6408d5e0f222e83040ea1977628aa5
SHA1

58e413af8bc8687693a73e57b7bd0d0d7d6506bc
SHA256

4864ca5e3006717bbfd2e5f90773f2cdb93315e64ce96676dc17e70583eebe93
SHA512

474e98b1b60c1d07de8a2f2fbe2338b105f0c69978390a975246898760a692e6f86e2205e48f5639c070dba3a8ad526f822d9bdf4ec412e01688d3012a608ddf
SSDEEP

1536:tAnW+c+GL2VanyEAGHo7P1QAxdz28f9hLonUDjtNHorJ4:tec+E2wnC/P1QAxdznLonUvcJ4

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	4864ca5e3006717bbfd2e5f90773f2cdb93315e64ce96676dc17e70583eebe93.exe

Executes dropped EXE 1 IoCs

pid	Process
4436	jusched.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\dca349c7\jusched.exe	4864ca5e3006717bbfd2e5f90773f2cdb93315e64ce96676dc17e70583eebe93.exe
File created	C:\Program Files (x86)\dca349c7\dca349c7	4864ca5e3006717bbfd2e5f90773f2cdb93315e64ce96676dc17e70583eebe93.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	4864ca5e3006717bbfd2e5f90773f2cdb93315e64ce96676dc17e70583eebe93.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 4436	3720	4864ca5e3006717bbfd2e5f90773f2cdb93315e64ce96676dc17e70583eebe93.exe	97
PID 3720 wrote to memory of 4436	3720	4864ca5e3006717bbfd2e5f90773f2cdb93315e64ce96676dc17e70583eebe93.exe	97
PID 3720 wrote to memory of 4436	3720	4864ca5e3006717bbfd2e5f90773f2cdb93315e64ce96676dc17e70583eebe93.exe	97

C:\Users\Admin\AppData\Local\Temp\4864ca5e3006717bbfd2e5f90773f2cdb93315e64ce96676dc17e70583eebe93.exe
"C:\Users\Admin\AppData\Local\Temp\4864ca5e3006717bbfd2e5f90773f2cdb93315e64ce96676dc17e70583eebe93.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Program Files (x86)\dca349c7\jusched.exe
  "C:\Program Files (x86)\dca349c7\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3408 --field-trial-handle=2232,i,11267738607351977302,107266978269557304,262144 --variations-seed-version /prefetch:8
1⤵
PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\dca349c7\jusched.exe

Filesize
205KB

MD5
bb966cccfa8a4a0ce86f2c64b540b41e

SHA1
4ba2c356f9fcc56af1325570bf7aca37db80078b

SHA256
6ce99d6d342b7a17361e670462da3774c8405dc9569d35e082cce97b080af3f2

SHA512
f0c2ecc620b15c5bfe18706a63ec2a5f10c428eefe525af81e8d87f7d99c0716c76d71782f7c2fa27291d002b12a8269bbf19c0c64bc322fa21c50559e3b3d58

Download Submit
memory/3720-0-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/3720-15-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/4436-14-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/4436-16-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download