2875161cfde428b51978abb6c5bc537303283ec617611ae402a7a1735f90fcf3

Analysis

max time kernel
130s
max time network
142s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
13-07-2023 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f62e1b7c9bee1exe_JC.exe
Size

56KB
MD5

0f62e1b7c9bee193f34bd75606a85767
SHA1

743f06b553a342f3088dc1521284853203476ff4
SHA256

2875161cfde428b51978abb6c5bc537303283ec617611ae402a7a1735f90fcf3
SHA512

316c6a02374d468a4666a9143d5dfcffc1fcda69e0ed88dde64b304d96ada30f591a437da4bb1f86dc6042e5b90fdeba6a407537902d43f51f33d1352e5a9f83
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjIm8lB4dCOBy/cMFqeo9e1dWSk:ZzFbxmLPWQMOtEvwDpj38lD/cMAPOi

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1640	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2496	0f62e1b7c9bee1exe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 1640	2496	0f62e1b7c9bee1exe_JC.exe	1
PID 2496 wrote to memory of 1640	2496	0f62e1b7c9bee1exe_JC.exe	1
PID 2496 wrote to memory of 1640	2496	0f62e1b7c9bee1exe_JC.exe	1
PID 2496 wrote to memory of 1640	2496	0f62e1b7c9bee1exe_JC.exe	1

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
1⤵
- Executes dropped EXE
PID:1640

C:\Users\Admin\AppData\Local\Temp\0f62e1b7c9bee1exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\0f62e1b7c9bee1exe_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
56KB

MD5
96df9972e1d855ad125a3e075ff21ea1

SHA1
8e6c917c8318b4b47a311a4a90e72a599c694bdf

SHA256
50f5190839abe6b99857c411db4074c047090599fed08df2b5f763c8b068fcbb

SHA512
9a1501e6b57d83a7655ae6768de44dc878180c2aeeffcd222f5ca6264b767d3cf30fde58399a76d6fe67d5bbd5a2a8e7410ac6c31adfa9e24ce5db8f36695f6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
56KB

MD5
96df9972e1d855ad125a3e075ff21ea1

SHA1
8e6c917c8318b4b47a311a4a90e72a599c694bdf

SHA256
50f5190839abe6b99857c411db4074c047090599fed08df2b5f763c8b068fcbb

SHA512
9a1501e6b57d83a7655ae6768de44dc878180c2aeeffcd222f5ca6264b767d3cf30fde58399a76d6fe67d5bbd5a2a8e7410ac6c31adfa9e24ce5db8f36695f6f

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
56KB

MD5
96df9972e1d855ad125a3e075ff21ea1

SHA1
8e6c917c8318b4b47a311a4a90e72a599c694bdf

SHA256
50f5190839abe6b99857c411db4074c047090599fed08df2b5f763c8b068fcbb

SHA512
9a1501e6b57d83a7655ae6768de44dc878180c2aeeffcd222f5ca6264b767d3cf30fde58399a76d6fe67d5bbd5a2a8e7410ac6c31adfa9e24ce5db8f36695f6f

Download Submit
memory/1640-70-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/1640-69-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2496-57-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2496-55-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2496-54-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download