d6ad2d4035ce47bdb52ddc0658a8eed9fc72c88f25a765850440a3a69f9a0b6b

Analysis

max time kernel
145s
max time network
149s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
15/07/2023, 12:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44845a5596f1cfexeexe_JC.exe
Size

77KB
MD5

44845a5596f1cf34f55eef90725d65ab
SHA1

0d4e555e6a1397b06aed12c7b9d2bfde232fce2c
SHA256

d6ad2d4035ce47bdb52ddc0658a8eed9fc72c88f25a765850440a3a69f9a0b6b
SHA512

66785232e33e384d1d49e7ec62e4d228bc4b16d3a4fd6b2a69840bb2f922e7cc92b9f9d73f71a3f17752a57ae4133fc6ba9cc5ec883f21d8746ceeb7d581e170
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJNpsAnJYqdIRhpH8Ss:ZVxkGOtEvwDpjcNx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2908	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
3048	44845a5596f1cfexeexe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2908	3048	44845a5596f1cfexeexe_JC.exe	28
PID 3048 wrote to memory of 2908	3048	44845a5596f1cfexeexe_JC.exe	28
PID 3048 wrote to memory of 2908	3048	44845a5596f1cfexeexe_JC.exe	28
PID 3048 wrote to memory of 2908	3048	44845a5596f1cfexeexe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\44845a5596f1cfexeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\44845a5596f1cfexeexe_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
77KB

MD5
1fa52a4c6ef694957f427bec037d2f54

SHA1
3cc22c553ef77d337b408d2e7c2817d5110ce2df

SHA256
69c8e6aa7567ce5a9fbb631b84e4e21f6271d60305be31bebff70440fc5ac0c3

SHA512
67ba8520b279a3fb2bd0ee7ab680e0e169eab29693b40a93bd6116c4bd2ade7799ecda64727f6fad0add5b88acaa1882b5c016c71d3575175e6149d99bb02399

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
77KB

MD5
1fa52a4c6ef694957f427bec037d2f54

SHA1
3cc22c553ef77d337b408d2e7c2817d5110ce2df

SHA256
69c8e6aa7567ce5a9fbb631b84e4e21f6271d60305be31bebff70440fc5ac0c3

SHA512
67ba8520b279a3fb2bd0ee7ab680e0e169eab29693b40a93bd6116c4bd2ade7799ecda64727f6fad0add5b88acaa1882b5c016c71d3575175e6149d99bb02399

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
77KB

MD5
1fa52a4c6ef694957f427bec037d2f54

SHA1
3cc22c553ef77d337b408d2e7c2817d5110ce2df

SHA256
69c8e6aa7567ce5a9fbb631b84e4e21f6271d60305be31bebff70440fc5ac0c3

SHA512
67ba8520b279a3fb2bd0ee7ab680e0e169eab29693b40a93bd6116c4bd2ade7799ecda64727f6fad0add5b88acaa1882b5c016c71d3575175e6149d99bb02399

Download Submit
memory/2908-69-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2908-71-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/2908-72-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2908-79-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/3048-54-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/3048-55-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/3048-57-0x0000000000230000-0x00000000002B0000-memory.dmp

Filesize
512KB

Download
memory/3048-59-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download