71a48bd77b7e2e44dccaae12df707c40991ad0cc0fadd13af5489d6e3b764c37

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
15/07/2023, 11:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

40f31a1df9ee9eexeexe_JC.exe
Size

86KB
MD5

40f31a1df9ee9ef2e3a74b1edc7f5bad
SHA1

3b1ff5fb9ae270e6968011d2ed62e4e6a0b78140
SHA256

71a48bd77b7e2e44dccaae12df707c40991ad0cc0fadd13af5489d6e3b764c37
SHA512

d678b4eeba5b80b278e145ffd6b508b22f839a999a331d3ba72e71536254519d6fe298e590e32da46f3f931465ad9ef03515951fb8a45489e986a6b378741230
SSDEEP

1536:vj+jsMQMOtEvwDpj5H8u8rBN6nqEZNieRpfy:vCjsIOtEvwDpj5H8zP7

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2896	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1144	40f31a1df9ee9eexeexe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 2896	1144	40f31a1df9ee9eexeexe_JC.exe	28
PID 1144 wrote to memory of 2896	1144	40f31a1df9ee9eexeexe_JC.exe	28
PID 1144 wrote to memory of 2896	1144	40f31a1df9ee9eexeexe_JC.exe	28
PID 1144 wrote to memory of 2896	1144	40f31a1df9ee9eexeexe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\40f31a1df9ee9eexeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\40f31a1df9ee9eexeexe_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
86KB

MD5
32946d5be86b32bf1f060f35ffbe8993

SHA1
83e4dac09de83a8e3f550505ecdef92a05e31252

SHA256
280168f2edbae498bd6347c5a29bbc4d815da62f107ec340e4210d9a8ba7253e

SHA512
95bd4fb25aed30dd3aab62d63bb1e9f82626573c3ad10e56a972afd1ca402656d1e0e8e58f962f502bc89bf466d0b3874bf99a1788d1941ef48b689916188fe2

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
86KB

MD5
32946d5be86b32bf1f060f35ffbe8993

SHA1
83e4dac09de83a8e3f550505ecdef92a05e31252

SHA256
280168f2edbae498bd6347c5a29bbc4d815da62f107ec340e4210d9a8ba7253e

SHA512
95bd4fb25aed30dd3aab62d63bb1e9f82626573c3ad10e56a972afd1ca402656d1e0e8e58f962f502bc89bf466d0b3874bf99a1788d1941ef48b689916188fe2

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
86KB

MD5
32946d5be86b32bf1f060f35ffbe8993

SHA1
83e4dac09de83a8e3f550505ecdef92a05e31252

SHA256
280168f2edbae498bd6347c5a29bbc4d815da62f107ec340e4210d9a8ba7253e

SHA512
95bd4fb25aed30dd3aab62d63bb1e9f82626573c3ad10e56a972afd1ca402656d1e0e8e58f962f502bc89bf466d0b3874bf99a1788d1941ef48b689916188fe2

Download Submit
memory/1144-53-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1144-54-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/1144-56-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2896-69-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2896-68-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download