06abf045fc0cbd8e7c4962aea5a473473f5863ac62d2f8f293cebd69d6d3d807

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
16/07/2023, 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

587b2f71db722f_JC.exe
Size

65KB
MD5

587b2f71db722f195b2e41ca2bd86a56
SHA1

6cb2bcec63c13b389275691f603ce7d7979fef56
SHA256

06abf045fc0cbd8e7c4962aea5a473473f5863ac62d2f8f293cebd69d6d3d807
SHA512

98e3fae9db735fe22ea9359f753e467814771d57f7ca5c0361f3ce4425cb7ecef957b8f0b30b349e1b7478a5f560310bb471d2a763f1b3fae4cff2870b400737
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJ36n9FQ/zZ:ZVxkGOtEvwDpjcaAw

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2932	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1780	587b2f71db722f_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 2932	1780	587b2f71db722f_JC.exe	30
PID 1780 wrote to memory of 2932	1780	587b2f71db722f_JC.exe	30
PID 1780 wrote to memory of 2932	1780	587b2f71db722f_JC.exe	30
PID 1780 wrote to memory of 2932	1780	587b2f71db722f_JC.exe	30

C:\Users\Admin\AppData\Local\Temp\587b2f71db722f_JC.exe
"C:\Users\Admin\AppData\Local\Temp\587b2f71db722f_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
65KB

MD5
fbfceaa7495d3600f176807a0b1cd9e3

SHA1
a7afeca4f00056507a324a142c1b7f5a45f95176

SHA256
b833d73312258a5cd9708bc258d009f578dc3201d57d3a44e942864fa33d2eb8

SHA512
9b1a34b83c36c8e17316a337a192ba1c2a6273bbe753d14401b27d956550b69f394f867ec07e3aa227db295b89b5031ed855804b69cae06178d99ca76458ebff

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
65KB

MD5
fbfceaa7495d3600f176807a0b1cd9e3

SHA1
a7afeca4f00056507a324a142c1b7f5a45f95176

SHA256
b833d73312258a5cd9708bc258d009f578dc3201d57d3a44e942864fa33d2eb8

SHA512
9b1a34b83c36c8e17316a337a192ba1c2a6273bbe753d14401b27d956550b69f394f867ec07e3aa227db295b89b5031ed855804b69cae06178d99ca76458ebff

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
65KB

MD5
fbfceaa7495d3600f176807a0b1cd9e3

SHA1
a7afeca4f00056507a324a142c1b7f5a45f95176

SHA256
b833d73312258a5cd9708bc258d009f578dc3201d57d3a44e942864fa33d2eb8

SHA512
9b1a34b83c36c8e17316a337a192ba1c2a6273bbe753d14401b27d956550b69f394f867ec07e3aa227db295b89b5031ed855804b69cae06178d99ca76458ebff

Download Submit
memory/1780-54-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/1780-55-0x0000000000230000-0x0000000000270000-memory.dmp

Filesize
256KB

Download
memory/1780-56-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/1780-57-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/1780-69-0x0000000000230000-0x0000000000270000-memory.dmp

Filesize
256KB

Download
memory/2932-70-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2932-72-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2932-79-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2932-80-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download