0600f0c29e7513b060c4634804b2a2ad7e636c8372f7ee927b9e20e72e2bc807

Analysis

max time kernel
132s
max time network
145s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
13/07/2023, 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c74e4d7cb6903exe_JC.exe
Size

56KB
MD5

0c74e4d7cb6903d817a084a866646ff4
SHA1

2963eb32f631c89573f52faf3ae78ae19b67dd2f
SHA256

0600f0c29e7513b060c4634804b2a2ad7e636c8372f7ee927b9e20e72e2bc807
SHA512

c9d87d6538ea493317f4169fbe7549ef36c3eac5c2c83d1cb5bcfe14a2c252abd26fb5ef7e8dbb60ea0da708bc0396346ff34592457963a4049dd67aa26e8f11
SSDEEP

768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I52kcIGYb:6j+1NMOtEvwDpjr8ox8UXYb

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2928	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2896	0c74e4d7cb6903exe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2928	2896	0c74e4d7cb6903exe_JC.exe	28
PID 2896 wrote to memory of 2928	2896	0c74e4d7cb6903exe_JC.exe	28
PID 2896 wrote to memory of 2928	2896	0c74e4d7cb6903exe_JC.exe	28
PID 2896 wrote to memory of 2928	2896	0c74e4d7cb6903exe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\0c74e4d7cb6903exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\0c74e4d7cb6903exe_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
56KB

MD5
e2665cc557ceff2455f158df2b1cce7f

SHA1
b6136263bf03888a6a252de919a5880f842b91ff

SHA256
b5d864ca46c22f473f4b8eab749b9ce1462e3a689bf043baf4db41477ff1566c

SHA512
ad2f2c2fc439b4b8094a1deee08cb98eca4823dde0c0b6c8d75a780b4745da293546f23ca9970822e98d5c63885b9fa925465768e4a756ee3886ee97186f5f51

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
56KB

MD5
e2665cc557ceff2455f158df2b1cce7f

SHA1
b6136263bf03888a6a252de919a5880f842b91ff

SHA256
b5d864ca46c22f473f4b8eab749b9ce1462e3a689bf043baf4db41477ff1566c

SHA512
ad2f2c2fc439b4b8094a1deee08cb98eca4823dde0c0b6c8d75a780b4745da293546f23ca9970822e98d5c63885b9fa925465768e4a756ee3886ee97186f5f51

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
56KB

MD5
e2665cc557ceff2455f158df2b1cce7f

SHA1
b6136263bf03888a6a252de919a5880f842b91ff

SHA256
b5d864ca46c22f473f4b8eab749b9ce1462e3a689bf043baf4db41477ff1566c

SHA512
ad2f2c2fc439b4b8094a1deee08cb98eca4823dde0c0b6c8d75a780b4745da293546f23ca9970822e98d5c63885b9fa925465768e4a756ee3886ee97186f5f51

Download Submit
memory/2896-53-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2896-54-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2896-55-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2896-57-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2896-68-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2928-69-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2928-72-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2928-71-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2928-79-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download