41767f2e4631992e6280d94855d0a86aec92280836680787ca0aef42c79a4a4f

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
14/07/2023, 12:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1545ac6fd27442exe_JC.exe
Size

53KB
MD5

1545ac6fd27442aa74dccb01685bb700
SHA1

ae062506fd79bdd90616059d3769d076095f6c25
SHA256

41767f2e4631992e6280d94855d0a86aec92280836680787ca0aef42c79a4a4f
SHA512

edef31a45ab4cb0bdcbd955080312750f0382e5301bfe49fccae960d5ec10f773b64a1f73cc7b8c2f3b1ca359c051b4e162a8a55c08e43b9fb26a4c4edaf8cbb
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjIm8lB4dCOBtri2DdgIF4em0StzV:ZzFbxmLPWQMOtEvwDpj38ls+pKHm0+

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
840	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2616	1545ac6fd27442exe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 840	2616	1545ac6fd27442exe_JC.exe	28
PID 2616 wrote to memory of 840	2616	1545ac6fd27442exe_JC.exe	28
PID 2616 wrote to memory of 840	2616	1545ac6fd27442exe_JC.exe	28
PID 2616 wrote to memory of 840	2616	1545ac6fd27442exe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\1545ac6fd27442exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\1545ac6fd27442exe_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
54KB

MD5
c6f0d1bf506588cc205882734f835385

SHA1
2969a2a8c48c9aed78f6a11fe81560403bf505ab

SHA256
d772198a74d24a32462e6698667bdef9f4f3fc9dcac865c1639210ab5e398042

SHA512
002cedaa1360185e3ace9a3245bb50f65ee2d8a61d23229a80e753f15c6599c3d9dad30ebfb20ecb9397b1038335639597268a9ab2e182798531f65e58c47163

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
54KB

MD5
c6f0d1bf506588cc205882734f835385

SHA1
2969a2a8c48c9aed78f6a11fe81560403bf505ab

SHA256
d772198a74d24a32462e6698667bdef9f4f3fc9dcac865c1639210ab5e398042

SHA512
002cedaa1360185e3ace9a3245bb50f65ee2d8a61d23229a80e753f15c6599c3d9dad30ebfb20ecb9397b1038335639597268a9ab2e182798531f65e58c47163

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
54KB

MD5
c6f0d1bf506588cc205882734f835385

SHA1
2969a2a8c48c9aed78f6a11fe81560403bf505ab

SHA256
d772198a74d24a32462e6698667bdef9f4f3fc9dcac865c1639210ab5e398042

SHA512
002cedaa1360185e3ace9a3245bb50f65ee2d8a61d23229a80e753f15c6599c3d9dad30ebfb20ecb9397b1038335639597268a9ab2e182798531f65e58c47163

Download Submit
memory/840-69-0x00000000001E0000-0x00000000001E6000-memory.dmp

Filesize
24KB

Download
memory/840-72-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/840-71-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download
memory/2616-55-0x00000000001E0000-0x00000000001E6000-memory.dmp

Filesize
24KB

Download
memory/2616-54-0x00000000001D0000-0x00000000001D3000-memory.dmp

Filesize
12KB

Download
memory/2616-56-0x00000000001E0000-0x00000000001E6000-memory.dmp

Filesize
24KB

Download
memory/2616-57-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download