11c83375b6ac3ba8c1f48182edb693ca383f8f7312a9a7d337425abfe87d2fd6

Analysis

max time kernel
133s
max time network
145s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
16-07-2023 17:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b9b8feb4df6d5_JC.exe
Size

74KB
MD5

7b9b8feb4df6d5bd529d65ce277d4258
SHA1

95befb2c391c12568bb01a738dc09a2b702a67a1
SHA256

11c83375b6ac3ba8c1f48182edb693ca383f8f7312a9a7d337425abfe87d2fd6
SHA512

c41a1d66b40807fa0dd57bfc363ec446ca08af6f920019ff6aa7a65621eb357e9f2439357887cb4cd033b14a691be8650556f9dd153ddf11e8a7629bd74779a9
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfWant:vCjsIOtEvwDpj5H9YvQd2Lt

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1064	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2476	7b9b8feb4df6d5_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 1064	2476	7b9b8feb4df6d5_JC.exe	28
PID 2476 wrote to memory of 1064	2476	7b9b8feb4df6d5_JC.exe	28
PID 2476 wrote to memory of 1064	2476	7b9b8feb4df6d5_JC.exe	28
PID 2476 wrote to memory of 1064	2476	7b9b8feb4df6d5_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\7b9b8feb4df6d5_JC.exe
"C:\Users\Admin\AppData\Local\Temp\7b9b8feb4df6d5_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
74KB

MD5
bb7f1eefc0f9fc6bbe5923e5d6a35f82

SHA1
f15cf0b0070e405d727f78580bf57021cf101b51

SHA256
ac2d4e52178b186696a042d8233235ce84516a8c47e3694c55c1d21e31a9ae40

SHA512
f8f3d78edb7f43192b6ca0ce696a2a4c56c63187531e950206d1f8daf20aabd46e540e4ca853a775e479e774a50fde0e7289f3a8373f380878ab8220a3e1a96a

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
74KB

MD5
bb7f1eefc0f9fc6bbe5923e5d6a35f82

SHA1
f15cf0b0070e405d727f78580bf57021cf101b51

SHA256
ac2d4e52178b186696a042d8233235ce84516a8c47e3694c55c1d21e31a9ae40

SHA512
f8f3d78edb7f43192b6ca0ce696a2a4c56c63187531e950206d1f8daf20aabd46e540e4ca853a775e479e774a50fde0e7289f3a8373f380878ab8220a3e1a96a

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
74KB

MD5
bb7f1eefc0f9fc6bbe5923e5d6a35f82

SHA1
f15cf0b0070e405d727f78580bf57021cf101b51

SHA256
ac2d4e52178b186696a042d8233235ce84516a8c47e3694c55c1d21e31a9ae40

SHA512
f8f3d78edb7f43192b6ca0ce696a2a4c56c63187531e950206d1f8daf20aabd46e540e4ca853a775e479e774a50fde0e7289f3a8373f380878ab8220a3e1a96a

Download Submit
memory/1064-70-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/1064-69-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2476-54-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2476-55-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2476-56-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download