05b5c118ba6da52f6329eaba4976854ad3d9b4de5d159540144dafeff7b7b9b0

Analysis

max time kernel
120s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e6080ff6dda7a1de01cc5c42e8cb9a0N.exe
Size

35KB
MD5

5e6080ff6dda7a1de01cc5c42e8cb9a0
SHA1

2e7f4d53e22e91c0e0e931066861cfdebb058b43
SHA256

05b5c118ba6da52f6329eaba4976854ad3d9b4de5d159540144dafeff7b7b9b0
SHA512

f4f7e07892917a265ae7d303a16389293538c8b30a3c528e70ad2836547be0b539090989476f3936b0c7bfcbd03b200bea6692fd87e43a99ae3a6491e2db1a67
SSDEEP

768:+zQYScGrIubHuYtvdxwYHw5FAe2QCncwx0V:YQTIubHy5wQCS

Score

10^/10

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	5e6080ff6dda7a1de01cc5c42e8cb9a0N.exe

Executes dropped EXE 1 IoCs

pid	Process
4044	jusched.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\771d409e\jusched.exe	5e6080ff6dda7a1de01cc5c42e8cb9a0N.exe
File created	C:\Program Files (x86)\771d409e\771d409e	5e6080ff6dda7a1de01cc5c42e8cb9a0N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe
4044	jusched.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 4044	2956	5e6080ff6dda7a1de01cc5c42e8cb9a0N.exe	88
PID 2956 wrote to memory of 4044	2956	5e6080ff6dda7a1de01cc5c42e8cb9a0N.exe	88
PID 2956 wrote to memory of 4044	2956	5e6080ff6dda7a1de01cc5c42e8cb9a0N.exe	88

C:\Users\Admin\AppData\Local\Temp\5e6080ff6dda7a1de01cc5c42e8cb9a0N.exe
"C:\Users\Admin\AppData\Local\Temp\5e6080ff6dda7a1de01cc5c42e8cb9a0N.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Program Files (x86)\771d409e\jusched.exe
  "C:\Program Files (x86)\771d409e\jusched.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\771d409e\771d409e

Filesize
13B

MD5
f253efe302d32ab264a76e0ce65be769

SHA1
768685ca582abd0af2fbb57ca37752aa98c9372b

SHA256
49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd

SHA512
1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4

Download Submit
C:\Program Files (x86)\771d409e\jusched.exe

Filesize
36KB

MD5
e5f0d88cf9fe9f68f9cdd1d72c40e593

SHA1
c0c76ae0e07dc42055270d9084d103aabcd2218c

SHA256
39af612dd4e53c1f157c62ebcf8ce101f82a4411ec0bf577a270966da9fbd639

SHA512
577a87bfd68579d6ec7b1c4b667b77bcb89458ed230c16e979554692b88da648cedd24f831e3dc0b68d1eaa9661b44a46f79561da59152425b00023de00e257d

Download Submit