c5c4ec085b2a6de07886170556cbb8df20d699716e520b46fdfad09cf697790f

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-04-2024 02:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c5c4ec085b2a6de07886170556cbb8df20d699716e520b46fdfad09cf697790f.exe
Size

211KB
MD5

1781926557e5016f61aa3ea9f0b20338
SHA1

4a028c0f0dd10a9f422f6cfbdf45d77afdf9dc4d
SHA256

c5c4ec085b2a6de07886170556cbb8df20d699716e520b46fdfad09cf697790f
SHA512

a1fe7a67fc0e9e745549c777576de49fa2e54b59ea3a3e5a57ac78e810f161fa81130b0d6a61bdaa4e827efee624df39c332cd7e3b49fafbd01b58aa153957da
SSDEEP

3072:nVHgCc4xGvbwcU9KQ2BBAHmaPxiVoSb5EdU:OCc4xGxWKQ2BonxfU

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	c5c4ec085b2a6de07886170556cbb8df20d699716e520b46fdfad09cf697790f.exe

Executes dropped EXE 1 IoCs

pid	Process
2140	jusched.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ca74de44\ca74de44	c5c4ec085b2a6de07886170556cbb8df20d699716e520b46fdfad09cf697790f.exe
File created	C:\Program Files (x86)\ca74de44\jusched.exe	c5c4ec085b2a6de07886170556cbb8df20d699716e520b46fdfad09cf697790f.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	c5c4ec085b2a6de07886170556cbb8df20d699716e520b46fdfad09cf697790f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 2140	3936	c5c4ec085b2a6de07886170556cbb8df20d699716e520b46fdfad09cf697790f.exe	91
PID 3936 wrote to memory of 2140	3936	c5c4ec085b2a6de07886170556cbb8df20d699716e520b46fdfad09cf697790f.exe	91
PID 3936 wrote to memory of 2140	3936	c5c4ec085b2a6de07886170556cbb8df20d699716e520b46fdfad09cf697790f.exe	91

C:\Users\Admin\AppData\Local\Temp\c5c4ec085b2a6de07886170556cbb8df20d699716e520b46fdfad09cf697790f.exe
"C:\Users\Admin\AppData\Local\Temp\c5c4ec085b2a6de07886170556cbb8df20d699716e520b46fdfad09cf697790f.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Program Files (x86)\ca74de44\jusched.exe
  "C:\Program Files (x86)\ca74de44\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\ca74de44\ca74de44

Filesize
17B

MD5
134c1d489094d6d3399f65b0e9aebc1f

SHA1
612a57fbe6ed3ab9c15b39451171d813314a28d5

SHA256
54f9150d1268f7b4b83dd9fc3ec32274bf749715a5806ff3ca5262f5427d6781

SHA512
b09bf60e4850d05261d81a124a647dd111f42480224eae8a3bd2f64736c38119953703f868ad34194a7ae6dad6aabff4081ba73df262bbe9f5327867c56a48ed

Download Submit
C:\Program Files (x86)\ca74de44\jusched.exe

Filesize
211KB

MD5
01c50bcf033e343e48eea73e2a4c2e02

SHA1
1e733bcdab6a4fd10a83f37f4c5f8261b21a9c39

SHA256
a2fd0e82ed5d91ee728c078116a0779e41d155ecbf9bd7b51794579345e24c0a

SHA512
0c0378fc31bbd6ede40b007d0a88102db4b36c5e66b7aa58cfc80929b7618cd75150588257067296741ff18e42eadd5fcab7a89638a6aec61aaca20371323332

Download Submit