68dde4abe393fa85b868799a8057acd8feae9ba5864b7bfe4c6f239bd6c5ceaa

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
11-07-2023 06:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1ffe32a6af116exeexeexeex.exe
Size

75KB
MD5

e1ffe32a6af11670b0c6c1dd3c151595
SHA1

3fe51b7df2156dabfa87ed18d7d24b490078085d
SHA256

68dde4abe393fa85b868799a8057acd8feae9ba5864b7bfe4c6f239bd6c5ceaa
SHA512

2d3f3ad3839ac98bdfbcef51df09ab372fbe700634e865fd70ba17aa41e0688f40744cdf1ac703c2f550c46e521ff46705dfef9ecf83827f0c29618b1a9d93f3
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJNpsAnJYqdIR+L:ZVxkGOtEvwDpjcN5

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
816	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2420	e1ffe32a6af116exeexeexeex.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 816	2420	e1ffe32a6af116exeexeexeex.exe	29
PID 2420 wrote to memory of 816	2420	e1ffe32a6af116exeexeexeex.exe	29
PID 2420 wrote to memory of 816	2420	e1ffe32a6af116exeexeexeex.exe	29
PID 2420 wrote to memory of 816	2420	e1ffe32a6af116exeexeexeex.exe	29

C:\Users\Admin\AppData\Local\Temp\e1ffe32a6af116exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\e1ffe32a6af116exeexeexeex.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
76KB

MD5
68480c74e5dd58e56e6edbb338c14af6

SHA1
1f6715cb48430b0645a25169f6addf64eecedb7a

SHA256
1e595cd52f9d214c18863dea644e0b363ae8bd51bb1662c2cc7263def69beb1e

SHA512
ecbe5f6b6073e81c6a30a4ef120c166f20e12bb832ba1fd9a35a631da18ecfecec2bc1eecd36220046f7a651a532a2f713c4d69581f717e0d2dd8adaae2ed28b

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
76KB

MD5
68480c74e5dd58e56e6edbb338c14af6

SHA1
1f6715cb48430b0645a25169f6addf64eecedb7a

SHA256
1e595cd52f9d214c18863dea644e0b363ae8bd51bb1662c2cc7263def69beb1e

SHA512
ecbe5f6b6073e81c6a30a4ef120c166f20e12bb832ba1fd9a35a631da18ecfecec2bc1eecd36220046f7a651a532a2f713c4d69581f717e0d2dd8adaae2ed28b

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
76KB

MD5
68480c74e5dd58e56e6edbb338c14af6

SHA1
1f6715cb48430b0645a25169f6addf64eecedb7a

SHA256
1e595cd52f9d214c18863dea644e0b363ae8bd51bb1662c2cc7263def69beb1e

SHA512
ecbe5f6b6073e81c6a30a4ef120c166f20e12bb832ba1fd9a35a631da18ecfecec2bc1eecd36220046f7a651a532a2f713c4d69581f717e0d2dd8adaae2ed28b

Download Submit
memory/816-68-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download
memory/2420-54-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2420-55-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download