2e386bea909fa70b61b495012677ebff3293165fe575ecd8980dbfcc149c5250

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
16/07/2023, 13:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

731cae0cdf0f99_JC.exe
Size

62KB
MD5

731cae0cdf0f991eb761bc70fe54214e
SHA1

d5eb00140a2d20e17a285d3651469a508d0b4a7a
SHA256

2e386bea909fa70b61b495012677ebff3293165fe575ecd8980dbfcc149c5250
SHA512

1672ed7bf20177c59b75ca79c6f128a46e7585380ae596f6dbaf775125e5da45441bd05411a3b58156db5b7714f763c92a57315885a0c98987b5828c189a6ce8
SSDEEP

1536:vj+jsMQMOtEvwDpj5HyCyh7vtRJ4BqKb1cKtbiM5:vCjsIOtEvwDpj5Hv0lG

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2148	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2560	731cae0cdf0f99_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2148	2560	731cae0cdf0f99_JC.exe	28
PID 2560 wrote to memory of 2148	2560	731cae0cdf0f99_JC.exe	28
PID 2560 wrote to memory of 2148	2560	731cae0cdf0f99_JC.exe	28
PID 2560 wrote to memory of 2148	2560	731cae0cdf0f99_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\731cae0cdf0f99_JC.exe
"C:\Users\Admin\AppData\Local\Temp\731cae0cdf0f99_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
62KB

MD5
04a7d9ef9729a30388b04271a3dff1f5

SHA1
f745fc8c9fd00f6cc8a11c6bbd4e6ce4557b9894

SHA256
b1d3a2d0964cc4d9f2347d0dd5619639f749986df9592b49f1f7d5f26f23b0c6

SHA512
4b9f06c3a588f37d47730d06a0dcdb4ccf7db7d7acecc0dc55a41e94b6af1aa74c65b970fb0c86653379b90858a0e5396e5260737fad9a7e237b21973775c020

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
62KB

MD5
04a7d9ef9729a30388b04271a3dff1f5

SHA1
f745fc8c9fd00f6cc8a11c6bbd4e6ce4557b9894

SHA256
b1d3a2d0964cc4d9f2347d0dd5619639f749986df9592b49f1f7d5f26f23b0c6

SHA512
4b9f06c3a588f37d47730d06a0dcdb4ccf7db7d7acecc0dc55a41e94b6af1aa74c65b970fb0c86653379b90858a0e5396e5260737fad9a7e237b21973775c020

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
62KB

MD5
04a7d9ef9729a30388b04271a3dff1f5

SHA1
f745fc8c9fd00f6cc8a11c6bbd4e6ce4557b9894

SHA256
b1d3a2d0964cc4d9f2347d0dd5619639f749986df9592b49f1f7d5f26f23b0c6

SHA512
4b9f06c3a588f37d47730d06a0dcdb4ccf7db7d7acecc0dc55a41e94b6af1aa74c65b970fb0c86653379b90858a0e5396e5260737fad9a7e237b21973775c020

Download Submit
memory/2148-69-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2148-70-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/2560-54-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2560-55-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2560-58-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download