Malware Analysis Report

2025-01-18 15:43

Sample ID 240614-dey1zswfrk
Target b2936b2f92989b0cd5945b8506edb04418777a64ecabff65ef45d5cfb6b5c9e6
SHA256 b2936b2f92989b0cd5945b8506edb04418777a64ecabff65ef45d5cfb6b5c9e6
Tags
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b2936b2f92989b0cd5945b8506edb04418777a64ecabff65ef45d5cfb6b5c9e6

Threat Level: Known bad

The file b2936b2f92989b0cd5945b8506edb04418777a64ecabff65ef45d5cfb6b5c9e6 was found to be: Known bad.

Malicious Activity Summary


Detects executables built or packed with MPress PE compressor

Detects executables built or packed with MPress PE compressor

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-14 02:55

Signatures

Detects executables built or packed with MPress PE compressor

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 02:55

Reported

2024-06-14 02:58

Platform

win7-20240220-en

Max time kernel

150s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b2936b2f92989b0cd5945b8506edb04418777a64ecabff65ef45d5cfb6b5c9e6.exe"

Signatures

Detects executables built or packed with MPress PE compressor

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Java\jre-09\bin\jusched.exe C:\Users\Admin\AppData\Local\Temp\b2936b2f92989b0cd5945b8506edb04418777a64ecabff65ef45d5cfb6b5c9e6.exe N/A
File opened for modification C:\Program Files (x86)\Java\jre-09\bin\jusched.exe C:\Users\Admin\AppData\Local\Temp\b2936b2f92989b0cd5945b8506edb04418777a64ecabff65ef45d5cfb6b5c9e6.exe N/A
File created C:\Program Files (x86)\Java\jre-09\bin\UF C:\Users\Admin\AppData\Local\Temp\b2936b2f92989b0cd5945b8506edb04418777a64ecabff65ef45d5cfb6b5c9e6.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b2936b2f92989b0cd5945b8506edb04418777a64ecabff65ef45d5cfb6b5c9e6.exe

"C:\Users\Admin\AppData\Local\Temp\b2936b2f92989b0cd5945b8506edb04418777a64ecabff65ef45d5cfb6b5c9e6.exe"

C:\Program Files (x86)\Java\jre-09\bin\jusched.exe

"C:\Program Files (x86)\Java\jre-09\bin\jusched.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 hohoho.ho.funpic.org udp
US 8.8.8.8:53 griptoloji.host-ed.net udp
US 8.8.8.8:53 ftp.tripod.com udp
US 209.202.252.54:21 ftp.tripod.com tcp
US 209.202.252.54:21 ftp.tripod.com tcp

Files

memory/3032-0-0x0000000000400000-0x0000000000474000-memory.dmp

\Program Files (x86)\Java\jre-09\bin\jusched.exe

MD5 989c269ea644c1a391fe0b86b7eb1e68
SHA1 a11f5952d71bfe00d92517f07313b00404e4f6c2
SHA256 d89913c3d9bf7ca1406326e426824b89d6926f6d0f9cdc4149df3b2ee63c4ee1
SHA512 9f7319d1e18a702ee872cdf674bc17f2b385ac34c1ffaebd5a8287923d7c1de39484a9a45268d3075a2d2a489efe797c8c1c81282d697f914f2b00b6b631fdf4

memory/3032-12-0x0000000000400000-0x0000000000474000-memory.dmp

memory/3064-14-0x0000000000400000-0x0000000000474000-memory.dmp

memory/3064-15-0x0000000000400000-0x0000000000474000-memory.dmp

memory/3064-20-0x0000000000400000-0x0000000000474000-memory.dmp

memory/3064-21-0x0000000000400000-0x0000000000474000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 02:55

Reported

2024-06-14 02:58

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b2936b2f92989b0cd5945b8506edb04418777a64ecabff65ef45d5cfb6b5c9e6.exe"

Signatures

Detects executables built or packed with MPress PE compressor

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\b2936b2f92989b0cd5945b8506edb04418777a64ecabff65ef45d5cfb6b5c9e6.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Java\jre-09\bin\UF C:\Users\Admin\AppData\Local\Temp\b2936b2f92989b0cd5945b8506edb04418777a64ecabff65ef45d5cfb6b5c9e6.exe N/A
File created C:\Program Files (x86)\Java\jre-09\bin\jusched.exe C:\Users\Admin\AppData\Local\Temp\b2936b2f92989b0cd5945b8506edb04418777a64ecabff65ef45d5cfb6b5c9e6.exe N/A
File opened for modification C:\Program Files (x86)\Java\jre-09\bin\jusched.exe C:\Users\Admin\AppData\Local\Temp\b2936b2f92989b0cd5945b8506edb04418777a64ecabff65ef45d5cfb6b5c9e6.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A
N/A N/A C:\Program Files (x86)\Java\jre-09\bin\jusched.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b2936b2f92989b0cd5945b8506edb04418777a64ecabff65ef45d5cfb6b5c9e6.exe

"C:\Users\Admin\AppData\Local\Temp\b2936b2f92989b0cd5945b8506edb04418777a64ecabff65ef45d5cfb6b5c9e6.exe"

C:\Program Files (x86)\Java\jre-09\bin\jusched.exe

"C:\Program Files (x86)\Java\jre-09\bin\jusched.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3804,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 hohoho.ho.funpic.org udp
US 8.8.8.8:53 ftp.tripod.com udp
US 8.8.8.8:53 hohoho.ho.funpic.org udp
US 8.8.8.8:53 griptoloji.host-ed.net udp
US 8.8.8.8:53 ftp.tripod.com udp
US 8.8.8.8:53 udp

Files

memory/624-0-0x0000000000400000-0x0000000000474000-memory.dmp

C:\Program Files (x86)\Java\jre-09\bin\jusched.exe

MD5 e32d86e3150aefa5a347dbd1e136b814
SHA1 d1a11134b7a31faa9ce1635be8fb2e1acaa0a50f
SHA256 290258f025d72fb7926abad4a88d78fe914dce2ebccc3b47af655b21292c6c2f
SHA512 06511e8eca43b9b21f996ed461fcabdb94664cf76ea94b90b7a0b2ee9186119a44084c5a1da16b709a25f13735dcc152dde8efbe6e17cb2d68f371b6a2ea081f

memory/624-12-0x0000000000400000-0x0000000000474000-memory.dmp

memory/4508-13-0x0000000000400000-0x0000000000474000-memory.dmp

memory/4508-19-0x0000000000400000-0x0000000000474000-memory.dmp

memory/4508-21-0x0000000000400000-0x0000000000474000-memory.dmp