758e5b347e6df5b666bd1dd553afe3244f79707a09c8788023b3308b0697b34e

Analysis

max time kernel
120s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ce734b560d7b8b8893c6cfcc36dbf890N.exe
Size

47KB
MD5

ce734b560d7b8b8893c6cfcc36dbf890
SHA1

be059883232d53880e4a4bed6e41bae2993efc05
SHA256

758e5b347e6df5b666bd1dd553afe3244f79707a09c8788023b3308b0697b34e
SHA512

68b201e465700bb23b85627bf5bb0d9765ee9a3dae8cfb9a14ffb2509468669354c6fc6f62b61897cc1d0d17d0f255fb0a64ec34e6306b2e2b23362027e9101f
SSDEEP

768:kflivXrVKpVhKvtxwYHwVFoeAQXmucwUKzdlPPKE04+:alqrVKprVuQX7z7PV+

Score

10^/10

discovery

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.tripod.com
Port:
21
Username:
onthelinux
Password:
741852abc

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	ce734b560d7b8b8893c6cfcc36dbf890N.exe

Executes dropped EXE 1 IoCs

pid	Process
5108	jusched.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\cf61bef9\jusched.exe	ce734b560d7b8b8893c6cfcc36dbf890N.exe
File created	C:\Program Files (x86)\cf61bef9\cf61bef9	ce734b560d7b8b8893c6cfcc36dbf890N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ce734b560d7b8b8893c6cfcc36dbf890N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jusched.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe
5108	jusched.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 5108	3192	ce734b560d7b8b8893c6cfcc36dbf890N.exe	88
PID 3192 wrote to memory of 5108	3192	ce734b560d7b8b8893c6cfcc36dbf890N.exe	88
PID 3192 wrote to memory of 5108	3192	ce734b560d7b8b8893c6cfcc36dbf890N.exe	88

C:\Users\Admin\AppData\Local\Temp\ce734b560d7b8b8893c6cfcc36dbf890N.exe
"C:\Users\Admin\AppData\Local\Temp\ce734b560d7b8b8893c6cfcc36dbf890N.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Program Files (x86)\cf61bef9\jusched.exe
  "C:\Program Files (x86)\cf61bef9\jusched.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\cf61bef9\cf61bef9

Filesize
13B

MD5
f253efe302d32ab264a76e0ce65be769

SHA1
768685ca582abd0af2fbb57ca37752aa98c9372b

SHA256
49dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd

SHA512
1990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4

Download Submit
C:\Program Files (x86)\cf61bef9\jusched.exe

Filesize
47KB

MD5
cb339216fb13d94e76e1d3c8dc11a375

SHA1
fdd8e3ee9c2681e307dc3b78c72de008f807e1bd

SHA256
c7b18c3b3515019018af49839495cb8efb87fcdd4c16ed2427e5bcdaefe5baa4

SHA512
a2c125ea7fea1e72bed89d00ac52337061e9d66ce9fd31d7df564c67477df63b9f377334a278776d582f92a3b3d7e31473d6ef4b939f4a27e91811eba23e2eb1

Download Submit
memory/3192-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3192-11-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/5108-9-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/5108-12-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download