295462719087e80bdd5c4121811a73a80beb132cf8ea6d6986c65fcb2dca46d4

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
13/07/2023, 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

058244b6d284c0exe_JC.exe
Size

74KB
MD5

058244b6d284c0417a0f0b8371770793
SHA1

1e77a69fe447fe7428a96c63674421a527e1516b
SHA256

295462719087e80bdd5c4121811a73a80beb132cf8ea6d6986c65fcb2dca46d4
SHA512

422c337a1d630581160ee4277402c45c62299b48f4c7ac07046a8619267e20f3ee889efcb628dca784dd01f94ea7ddcf98bf55fc624a0ff214043d0d96ffe61c
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfWajSl:vCjsIOtEvwDpj5H9YvQd2G

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2512	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2468	058244b6d284c0exe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2512	2468	058244b6d284c0exe_JC.exe	28
PID 2468 wrote to memory of 2512	2468	058244b6d284c0exe_JC.exe	28
PID 2468 wrote to memory of 2512	2468	058244b6d284c0exe_JC.exe	28
PID 2468 wrote to memory of 2512	2468	058244b6d284c0exe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\058244b6d284c0exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\058244b6d284c0exe_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2512

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
74KB

MD5
0965f774d422b1b404da2d6e0a2f8539

SHA1
0ea485f24975ad003f203f8144e5b58f3adca2e8

SHA256
0000fbabf50b868c5d8f5577c6c4bbc0b456b1f35ab384039eadbe6822bd43d0

SHA512
07b45695199208f0ed1da431dd1ff7b6b708b055b5e9d53ec0e1886ca29b40bcb6c84fe5dc9c8313fe8536a170cefe599284c7953d723a27e2c3c15e5210ce20

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
74KB

MD5
0965f774d422b1b404da2d6e0a2f8539

SHA1
0ea485f24975ad003f203f8144e5b58f3adca2e8

SHA256
0000fbabf50b868c5d8f5577c6c4bbc0b456b1f35ab384039eadbe6822bd43d0

SHA512
07b45695199208f0ed1da431dd1ff7b6b708b055b5e9d53ec0e1886ca29b40bcb6c84fe5dc9c8313fe8536a170cefe599284c7953d723a27e2c3c15e5210ce20

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
74KB

MD5
0965f774d422b1b404da2d6e0a2f8539

SHA1
0ea485f24975ad003f203f8144e5b58f3adca2e8

SHA256
0000fbabf50b868c5d8f5577c6c4bbc0b456b1f35ab384039eadbe6822bd43d0

SHA512
07b45695199208f0ed1da431dd1ff7b6b708b055b5e9d53ec0e1886ca29b40bcb6c84fe5dc9c8313fe8536a170cefe599284c7953d723a27e2c3c15e5210ce20

Download Submit
memory/2468-54-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2468-56-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2468-55-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/2512-69-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download