c403e4a8f6bf3014a916e38e81ee2fe1d2a59b7caf561bc45b0c9380c121ae74

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
13/07/2023, 20:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12160ee56280f1exe_JC.exe
Size

67KB
MD5

12160ee56280f1590a0ed0803754c423
SHA1

a452c936081ff6ac79d012e2efa9709a09967ebd
SHA256

c403e4a8f6bf3014a916e38e81ee2fe1d2a59b7caf561bc45b0c9380c121ae74
SHA512

3be9ddc15de8b5fd554086d2e77a097716ce9fafbc218ddd5402cc90b65c7b750bd45cf734bb0ad87ab5c7c135925a94db161bd1f5dcc175c39ee24349f32a85
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJ36n9QN+:ZVxkGOtEvwDpjcaAV

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1988	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2100	12160ee56280f1exe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 1988	2100	12160ee56280f1exe_JC.exe	28
PID 2100 wrote to memory of 1988	2100	12160ee56280f1exe_JC.exe	28
PID 2100 wrote to memory of 1988	2100	12160ee56280f1exe_JC.exe	28
PID 2100 wrote to memory of 1988	2100	12160ee56280f1exe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\12160ee56280f1exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\12160ee56280f1exe_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
67KB

MD5
190f6de91f6ffb0a30a16306c7bddaba

SHA1
02b6535ae782b21a79f085204ed60b2db2748f9f

SHA256
1fd438f4fcf8951ba38693e506431e8ed04ebe139177067cf63c8348ba9d88f8

SHA512
fe808fb33e8d0bb34429e9aa4f6fd7ab6179f8fe1294ba445863ffac0c4bd5ef0c831b8cc8a1d397eff2630f9afa07e427e8992048c1d9740d29038fdde986d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
67KB

MD5
190f6de91f6ffb0a30a16306c7bddaba

SHA1
02b6535ae782b21a79f085204ed60b2db2748f9f

SHA256
1fd438f4fcf8951ba38693e506431e8ed04ebe139177067cf63c8348ba9d88f8

SHA512
fe808fb33e8d0bb34429e9aa4f6fd7ab6179f8fe1294ba445863ffac0c4bd5ef0c831b8cc8a1d397eff2630f9afa07e427e8992048c1d9740d29038fdde986d1

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
67KB

MD5
190f6de91f6ffb0a30a16306c7bddaba

SHA1
02b6535ae782b21a79f085204ed60b2db2748f9f

SHA256
1fd438f4fcf8951ba38693e506431e8ed04ebe139177067cf63c8348ba9d88f8

SHA512
fe808fb33e8d0bb34429e9aa4f6fd7ab6179f8fe1294ba445863ffac0c4bd5ef0c831b8cc8a1d397eff2630f9afa07e427e8992048c1d9740d29038fdde986d1

Download Submit
memory/1988-68-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download
memory/1988-71-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/1988-70-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1988-78-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download
memory/2100-53-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download
memory/2100-54-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2100-56-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download
memory/2100-55-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download