c4261fa7e40e1be389cfc1278792e89020d9660a46c88ade187beef0405910c8

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 02:10

Target

c4261fa7e40e1be389cfc1278792e89020d9660a46c88ade187beef0405910c8.exe
Size

46KB
MD5

86e5a136186cff25661ee485a7cd4dcf
SHA1

1e2b95ffcc1e70014cf787578e85abcf07230aad
SHA256

c4261fa7e40e1be389cfc1278792e89020d9660a46c88ade187beef0405910c8
SHA512

cd2cde25b1c3b2f4297b409a4c8f7a60249c03ff88fc5c2ef50bb26d8922b5d0db1563821d462e39a3d85cbd39351c6bee04e050ca3ae4e8fe6efc3286ea8f4f
SSDEEP

768:6zQYScGrIubHuYtv0xwYHw5FAe2Qxncwx8Nwv92emBevS68:8QTIubHR5wQxAyFvSh

Score

10^/10

Credentials

Executes dropped EXE 1 IoCs

pid	Process
2852	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
2176	c4261fa7e40e1be389cfc1278792e89020d9660a46c88ade187beef0405910c8.exe
2176	c4261fa7e40e1be389cfc1278792e89020d9660a46c88ade187beef0405910c8.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\91c1fb89\jusched.exe	c4261fa7e40e1be389cfc1278792e89020d9660a46c88ade187beef0405910c8.exe
File created	C:\Program Files (x86)\91c1fb89\91c1fb89	c4261fa7e40e1be389cfc1278792e89020d9660a46c88ade187beef0405910c8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2852	2176	c4261fa7e40e1be389cfc1278792e89020d9660a46c88ade187beef0405910c8.exe	28
PID 2176 wrote to memory of 2852	2176	c4261fa7e40e1be389cfc1278792e89020d9660a46c88ade187beef0405910c8.exe	28
PID 2176 wrote to memory of 2852	2176	c4261fa7e40e1be389cfc1278792e89020d9660a46c88ade187beef0405910c8.exe	28
PID 2176 wrote to memory of 2852	2176	c4261fa7e40e1be389cfc1278792e89020d9660a46c88ade187beef0405910c8.exe	28

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Program Files (x86)\91c1fb89\91c1fb89

Filesize
13B

MD5
f253efe302d32ab264a76e0ce65be769

SHA1
768685ca582abd0af2fbb57ca37752aa98c9372b

SHA256
49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd

SHA512
1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4

Download Submit
\Program Files (x86)\91c1fb89\jusched.exe

Filesize
46KB

MD5
8177245831889b9f27506c4f5568285f

SHA1
91ee10f82ba446ef33c03d57a7de3f7aee052700

SHA256
583af1703a18df9493e34ad60b973c481ac12674d295d244c673d30d148418f6

SHA512
f5312de6ad0b5ee9c0f118a44b033c86ac24f02800ae20197e1cf76ee93dee8f51423374d9388c25e34553efb9b3510725a328f190bf4139ba0df381127dd371

Download Submit
memory/2176-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2176-11-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2176-10-0x00000000043D0000-0x00000000043FC000-memory.dmp

Filesize
176KB

Download
memory/2852-13-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download