01b1aaca704576f89374224a406687105fafd696e060422799d6dc04c8957717

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
14/07/2023, 15:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

280dd57992b8dbexeexe_JC.exe
Size

105KB
MD5

280dd57992b8db0eae9f2e6200983aad
SHA1

5d79dc21d66d7e8abc080b8331178cc56c47768f
SHA256

01b1aaca704576f89374224a406687105fafd696e060422799d6dc04c8957717
SHA512

9e92d86b1214fd1557fbf17975e6d0cf3bb25fdcc7ea159090f100e2175630a278ca7726e0cd15aebfecd62027db5d42439a86a6e10a2379326b4f610d519bfb
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRiWCCy9j09MUaiK/:xj+VGMOtEvwDpjubwQEIie6

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2904	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
3000	280dd57992b8dbexeexe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2904	3000	280dd57992b8dbexeexe_JC.exe	28
PID 3000 wrote to memory of 2904	3000	280dd57992b8dbexeexe_JC.exe	28
PID 3000 wrote to memory of 2904	3000	280dd57992b8dbexeexe_JC.exe	28
PID 3000 wrote to memory of 2904	3000	280dd57992b8dbexeexe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\280dd57992b8dbexeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\280dd57992b8dbexeexe_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
105KB

MD5
e74276288bfb80a3e6cbc55dc543965c

SHA1
fb90ce8a7093b09b46076ea934e016d1ccef6f76

SHA256
090e8abb577b7dc50d6f963541dfd4194444e0cdad6d2845c94110c7833ac868

SHA512
fa254a7cd392b1e4c11580fdb4f048613d3a8ea452eb98c33a71c1dbceb22472dd4b02c6ecaee97f8a6c5a6ce1e209b523c0e5e8e6b1641d327bdd53ed9b5814

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
105KB

MD5
e74276288bfb80a3e6cbc55dc543965c

SHA1
fb90ce8a7093b09b46076ea934e016d1ccef6f76

SHA256
090e8abb577b7dc50d6f963541dfd4194444e0cdad6d2845c94110c7833ac868

SHA512
fa254a7cd392b1e4c11580fdb4f048613d3a8ea452eb98c33a71c1dbceb22472dd4b02c6ecaee97f8a6c5a6ce1e209b523c0e5e8e6b1641d327bdd53ed9b5814

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
105KB

MD5
e74276288bfb80a3e6cbc55dc543965c

SHA1
fb90ce8a7093b09b46076ea934e016d1ccef6f76

SHA256
090e8abb577b7dc50d6f963541dfd4194444e0cdad6d2845c94110c7833ac868

SHA512
fa254a7cd392b1e4c11580fdb4f048613d3a8ea452eb98c33a71c1dbceb22472dd4b02c6ecaee97f8a6c5a6ce1e209b523c0e5e8e6b1641d327bdd53ed9b5814

Download Submit
memory/2904-70-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2904-72-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2904-79-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3000-54-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3000-55-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3000-57-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3000-56-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/3000-69-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download