d23b768c6dd7286a5e329a434ad4da29544807d969ac35a99c2bf739bbc00255

Analysis

max time kernel
132s
max time network
144s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
15/07/2023, 13:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4cd111cd316c52exeexe_JC.exe
Size

61KB
MD5

4cd111cd316c52ab54fffc6ed6638087
SHA1

3a15e8ab4d0b6221fd1f659efa2f09f5dbfdfcd0
SHA256

d23b768c6dd7286a5e329a434ad4da29544807d969ac35a99c2bf739bbc00255
SHA512

04cde57b666d9fbe12245711439412bf60665ec0f7e37119039f6abd6961ecb3152e101b442b979894a4a280881974015c590b2ed74ff516af760c79cc916f19
SSDEEP

1536:vj+jsMQMOtEvwDpj5HyCyh7vtRJ4BqKb1cKtqPT:vCjsIOtEvwDpj5Hv0d

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2424	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1876	4cd111cd316c52exeexe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2424	1876	4cd111cd316c52exeexe_JC.exe	28
PID 1876 wrote to memory of 2424	1876	4cd111cd316c52exeexe_JC.exe	28
PID 1876 wrote to memory of 2424	1876	4cd111cd316c52exeexe_JC.exe	28
PID 1876 wrote to memory of 2424	1876	4cd111cd316c52exeexe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\4cd111cd316c52exeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\4cd111cd316c52exeexe_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
61KB

MD5
13ca7030490c89f0bac4377d4803e02e

SHA1
589f4eeaadc0527a490314f8e55aec7638023d78

SHA256
a99824f008d1f951fda80e6998e507e330207170c25938694d71e93bd17cb66e

SHA512
444a3c1db0a333db2cc1cd8d8834e5456909629fe992ee1cd46795569a81514a6e63e789ae46b2ed44bf6638931c4ab41f2d09ab013eed3f1867d5a583f78f40

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
61KB

MD5
13ca7030490c89f0bac4377d4803e02e

SHA1
589f4eeaadc0527a490314f8e55aec7638023d78

SHA256
a99824f008d1f951fda80e6998e507e330207170c25938694d71e93bd17cb66e

SHA512
444a3c1db0a333db2cc1cd8d8834e5456909629fe992ee1cd46795569a81514a6e63e789ae46b2ed44bf6638931c4ab41f2d09ab013eed3f1867d5a583f78f40

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
61KB

MD5
13ca7030490c89f0bac4377d4803e02e

SHA1
589f4eeaadc0527a490314f8e55aec7638023d78

SHA256
a99824f008d1f951fda80e6998e507e330207170c25938694d71e93bd17cb66e

SHA512
444a3c1db0a333db2cc1cd8d8834e5456909629fe992ee1cd46795569a81514a6e63e789ae46b2ed44bf6638931c4ab41f2d09ab013eed3f1867d5a583f78f40

Download Submit
memory/1876-54-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1876-55-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1876-56-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2424-69-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download