a0ebac1fa7079ea847edd32ab787eabeca78ef952da6d7ee52abe33e8c812318

Analysis

max time kernel
119s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0ebac1fa7079ea847edd32ab787eabeca78ef952da6d7ee52abe33e8c812318N.exe
Size

231KB
MD5

9d8abefe3d23bec56e27e0c415811b30
SHA1

45c144797428e839b25120ef823422fab1d2fa46
SHA256

a0ebac1fa7079ea847edd32ab787eabeca78ef952da6d7ee52abe33e8c812318
SHA512

02680d4c5a31d1cc9de8aff88945f3d43ca30dd022e6fb24c4e3386d3c1a6d397a926e84424d791c5fe10b31c5e2240439df9b69aaaced928cdebf52c93a9d6d
SSDEEP

1536:SvVQb4cLIkN+4Weat2RKLjWlC48Pp9JAcj6SrowK3pAzxqLXq:SvVQLIkLWeaA8KlCph97rowK3pU6Xq

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	a0ebac1fa7079ea847edd32ab787eabeca78ef952da6d7ee52abe33e8c812318N.exe

Executes dropped EXE 1 IoCs

pid	Process
4208	jusched.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\f2cb01f8\jusched.exe	a0ebac1fa7079ea847edd32ab787eabeca78ef952da6d7ee52abe33e8c812318N.exe
File created	C:\Program Files (x86)\f2cb01f8\f2cb01f8	a0ebac1fa7079ea847edd32ab787eabeca78ef952da6d7ee52abe33e8c812318N.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	a0ebac1fa7079ea847edd32ab787eabeca78ef952da6d7ee52abe33e8c812318N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a0ebac1fa7079ea847edd32ab787eabeca78ef952da6d7ee52abe33e8c812318N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jusched.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 4208	2660	a0ebac1fa7079ea847edd32ab787eabeca78ef952da6d7ee52abe33e8c812318N.exe	86
PID 2660 wrote to memory of 4208	2660	a0ebac1fa7079ea847edd32ab787eabeca78ef952da6d7ee52abe33e8c812318N.exe	86
PID 2660 wrote to memory of 4208	2660	a0ebac1fa7079ea847edd32ab787eabeca78ef952da6d7ee52abe33e8c812318N.exe	86

C:\Users\Admin\AppData\Local\Temp\a0ebac1fa7079ea847edd32ab787eabeca78ef952da6d7ee52abe33e8c812318N.exe
"C:\Users\Admin\AppData\Local\Temp\a0ebac1fa7079ea847edd32ab787eabeca78ef952da6d7ee52abe33e8c812318N.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Program Files (x86)\f2cb01f8\jusched.exe
  "C:\Program Files (x86)\f2cb01f8\jusched.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\f2cb01f8\f2cb01f8

Filesize
17B

MD5
7bdf61d37c9adf3e1c6937107016091f

SHA1
56b8e0c454f9dd16d508a04b3afa7e458453ac41

SHA256
4c57d86c256214baa0a5a3322ef5cdd575210455b7e964ad60382bd9d4be12e0

SHA512
ff4fc1a427c84f47042375749f45ee6edea73b902ae977f14243ebceb7b9a28f41fe5dd404e3ea381754d9122202bc6b61ed0152b20a1c1be76c225dd20861d1

Download Submit
C:\Program Files (x86)\f2cb01f8\jusched.exe

Filesize
231KB

MD5
1e996be2124cfe5edd21c44a54585d10

SHA1
d6ff6d12cda04323864ac18f352a804f37614349

SHA256
36bc59d1a9e1465956931d00b0443c879d59d380bb1b04affab31d2b74dce6dc

SHA512
480c06aafea10b9444b157842f5c5bdaa6d2814aa615af17ef1080e4764690902456c493d3c986ccb02b7f2bf52f68e62dbd6a7d96f29ba7e9621c73e26c0696

Download Submit
memory/2660-0-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2660-15-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4208-13-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4208-16-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download