ce02103445f7a1860655189888a7475d288c588843a532851efcc73101b22cc0

Analysis

max time kernel
153s
max time network
162s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
16/07/2023, 10:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6478997fc2cfd2_JC.exe
Size

62KB
MD5

6478997fc2cfd25c3c7eaea7c25b30bd
SHA1

7e8443e35b76e5a31958b0e06d3490c12ecac8d3
SHA256

ce02103445f7a1860655189888a7475d288c588843a532851efcc73101b22cc0
SHA512

defcb8866760e7a1d32fd25cfebb2415133e58c0ec0f94ca3656521b475f23847f07be5d192cdc928c0ab20c266b4f09cc6812cc04370982e1aa3bef465bda20
SSDEEP

1536:vj+jsMQMOtEvwDpj5HyCyh7vtRJ4BqKb1cKtbieS:vCjsIOtEvwDpj5Hv0l7

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2844	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2572	6478997fc2cfd2_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 2844	2572	6478997fc2cfd2_JC.exe	28
PID 2572 wrote to memory of 2844	2572	6478997fc2cfd2_JC.exe	28
PID 2572 wrote to memory of 2844	2572	6478997fc2cfd2_JC.exe	28
PID 2572 wrote to memory of 2844	2572	6478997fc2cfd2_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\6478997fc2cfd2_JC.exe
"C:\Users\Admin\AppData\Local\Temp\6478997fc2cfd2_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
63KB

MD5
5fceb83865135edc3155b9e5aa4f5b6b

SHA1
4c106d456e41d7f01f10288038d37266e2c17da3

SHA256
25684500961e58602517b380a34911600186b3ab69471c73e321001407ac4041

SHA512
73bab3456cf7235cdaa3f3052a63c473df7cb5defda9929ee0f5362f22d24b059bd2d7dab557d5485f90477d6aa2cf2dec70a1fff44e1932d928adb7a8566fe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
63KB

MD5
5fceb83865135edc3155b9e5aa4f5b6b

SHA1
4c106d456e41d7f01f10288038d37266e2c17da3

SHA256
25684500961e58602517b380a34911600186b3ab69471c73e321001407ac4041

SHA512
73bab3456cf7235cdaa3f3052a63c473df7cb5defda9929ee0f5362f22d24b059bd2d7dab557d5485f90477d6aa2cf2dec70a1fff44e1932d928adb7a8566fe8

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
63KB

MD5
5fceb83865135edc3155b9e5aa4f5b6b

SHA1
4c106d456e41d7f01f10288038d37266e2c17da3

SHA256
25684500961e58602517b380a34911600186b3ab69471c73e321001407ac4041

SHA512
73bab3456cf7235cdaa3f3052a63c473df7cb5defda9929ee0f5362f22d24b059bd2d7dab557d5485f90477d6aa2cf2dec70a1fff44e1932d928adb7a8566fe8

Download Submit
memory/2572-54-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2572-55-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2572-56-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2844-69-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2844-70-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download