25fbb82c835a300f42e532d6ee96ba247b589a6201385bca4c9118d6f3288668

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 19:44

Target

25fbb82c835a300f42e532d6ee96ba247b589a6201385bca4c9118d6f3288668.exe
Size

50KB
MD5

454ee8168e041c79206f7edae00de5d6
SHA1

d51b815dc28d62ef760b2a1892609948958ad3cd
SHA256

25fbb82c835a300f42e532d6ee96ba247b589a6201385bca4c9118d6f3288668
SHA512

86566a9a4d57f602254b3dbd6dcb3ae9351dbfb1c9ba443ddd61b4c620db0dd342e13488da6bc2a097eabdf5ce237aba73ae517cda46a473f02ae13e7df1b942
SSDEEP

768:9qSqC8+N5ozQQRncwxWmNXMX3cX8tcXmcX8/XrX8/uUjyc2:9rqfzQQRamN88xjm7c7Oc2

Score

10^/10

Credentials

Executes dropped EXE 1 IoCs

pid	Process
1236	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
1244	25fbb82c835a300f42e532d6ee96ba247b589a6201385bca4c9118d6f3288668.exe
1244	25fbb82c835a300f42e532d6ee96ba247b589a6201385bca4c9118d6f3288668.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\bc863c3d\jusched.exe	25fbb82c835a300f42e532d6ee96ba247b589a6201385bca4c9118d6f3288668.exe
File created	C:\Program Files (x86)\bc863c3d\bc863c3d	25fbb82c835a300f42e532d6ee96ba247b589a6201385bca4c9118d6f3288668.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 1236	1244	25fbb82c835a300f42e532d6ee96ba247b589a6201385bca4c9118d6f3288668.exe	28
PID 1244 wrote to memory of 1236	1244	25fbb82c835a300f42e532d6ee96ba247b589a6201385bca4c9118d6f3288668.exe	28
PID 1244 wrote to memory of 1236	1244	25fbb82c835a300f42e532d6ee96ba247b589a6201385bca4c9118d6f3288668.exe	28
PID 1244 wrote to memory of 1236	1244	25fbb82c835a300f42e532d6ee96ba247b589a6201385bca4c9118d6f3288668.exe	28

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Program Files (x86)\bc863c3d\bc863c3d

Filesize
13B

MD5
f253efe302d32ab264a76e0ce65be769

SHA1
768685ca582abd0af2fbb57ca37752aa98c9372b

SHA256
49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd

SHA512
1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4

Download Submit
\Program Files (x86)\bc863c3d\jusched.exe

Filesize
50KB

MD5
4a9a3a098f942359c23a59cf928fc8db

SHA1
bd856ad53625a026d1d2bb540c0c4f17b934d660

SHA256
bb785b9575718376c9962a43439954f0d362de1bbc8f8f36f3643ffef7e7617f

SHA512
d4df598feb1dfb7552d1d9ccf6ab20df12156b012642dcb8cd1feb6a28384e16b6d358083888b0779203ed15d2fbab76fb5264a0bbe36c087592e5a1198187b6

Download Submit
memory/1236-17-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1236-18-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1236-21-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1244-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1244-5-0x0000000000401000-0x0000000000406000-memory.dmp

Filesize
20KB

Download
memory/1244-4-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download
memory/1244-3-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1244-15-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download