4f9d023f62f5f92fe41f829249d8a0a2188feef7af7ad91c7dda9eb168bd63a9

Analysis

max time kernel
137s
max time network
149s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
16/07/2023, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

649c7336a78588_JC.exe
Size

75KB
MD5

649c7336a78588dc01365e8b275ea6ac
SHA1

21b7e2419baffbc82fe8f7293ca8bf6fa63646c6
SHA256

4f9d023f62f5f92fe41f829249d8a0a2188feef7af7ad91c7dda9eb168bd63a9
SHA512

024cc19b938135af1f5b09a4d33bd57cf6ea9bcaafab787978fd649878d085a02d0fe3bcef1951641c76e187c89785ea3a8fd78a67ec2c16e296fcc4a166c9a9
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJNpsAnJYqdIR+2:ZVxkGOtEvwDpjcNI

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2784	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
532	649c7336a78588_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 2784	532	649c7336a78588_JC.exe	28
PID 532 wrote to memory of 2784	532	649c7336a78588_JC.exe	28
PID 532 wrote to memory of 2784	532	649c7336a78588_JC.exe	28
PID 532 wrote to memory of 2784	532	649c7336a78588_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\649c7336a78588_JC.exe
"C:\Users\Admin\AppData\Local\Temp\649c7336a78588_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:532
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
75KB

MD5
70a3255522f777f58ccd78158fcb6404

SHA1
74449e19406478fbf3e939f8e1c9b5f68ce966c5

SHA256
80fc48a915521fc74f5e26e55e11515c07128ada58c2182d0f931df16a8117be

SHA512
0b48e4d46de7004776c82ed15e2cae09891887b19ab78f002dc816ba700482ac798b61ca02b09881b515a55804ede6bfb2bcedec518c390728b9926e8efb55ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
75KB

MD5
70a3255522f777f58ccd78158fcb6404

SHA1
74449e19406478fbf3e939f8e1c9b5f68ce966c5

SHA256
80fc48a915521fc74f5e26e55e11515c07128ada58c2182d0f931df16a8117be

SHA512
0b48e4d46de7004776c82ed15e2cae09891887b19ab78f002dc816ba700482ac798b61ca02b09881b515a55804ede6bfb2bcedec518c390728b9926e8efb55ce

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
75KB

MD5
70a3255522f777f58ccd78158fcb6404

SHA1
74449e19406478fbf3e939f8e1c9b5f68ce966c5

SHA256
80fc48a915521fc74f5e26e55e11515c07128ada58c2182d0f931df16a8117be

SHA512
0b48e4d46de7004776c82ed15e2cae09891887b19ab78f002dc816ba700482ac798b61ca02b09881b515a55804ede6bfb2bcedec518c390728b9926e8efb55ce

Download Submit
memory/532-54-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/532-55-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/532-56-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/532-58-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/2784-69-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2784-71-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2784-72-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2784-79-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download