74f5b39bc7388e8dff9ec642368e5121cdb65eaa697b42ddfeb1c406c533c8ea

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
16-07-2023 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7cf33d1885ad3b_JC.exe
Size

83KB
MD5

7cf33d1885ad3b4c9881f0cc1f0af957
SHA1

30f6467e10eb00cc9de9498d7fa91820b34a6491
SHA256

74f5b39bc7388e8dff9ec642368e5121cdb65eaa697b42ddfeb1c406c533c8ea
SHA512

2f2a787f60d4310523ec5e87aaa4f91a4373eb42970ad4bd4ccc713494bd23fdb5a3428c7041507069a44149dd9c167300d327b2ff08cd9b4d39aec678fc0cb2
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRXrZSUfFKaw2QdDXDc:xj+VGMOtEvwDpjubwQEI8UtwQ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2056	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1988	7cf33d1885ad3b_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2056	1988	7cf33d1885ad3b_JC.exe	28
PID 1988 wrote to memory of 2056	1988	7cf33d1885ad3b_JC.exe	28
PID 1988 wrote to memory of 2056	1988	7cf33d1885ad3b_JC.exe	28
PID 1988 wrote to memory of 2056	1988	7cf33d1885ad3b_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\7cf33d1885ad3b_JC.exe
"C:\Users\Admin\AppData\Local\Temp\7cf33d1885ad3b_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
83KB

MD5
0cb778d7fd996be837bddc3427500421

SHA1
84e4a6eeda6bde14de1e4b7c16c0a360c7ee5132

SHA256
daf31bd43a9b78d469ad1e28df9ddb9fa2e81e7d4e568e728d037af89725a647

SHA512
ce1188af424a214ac504c524c9a4d938271c1adaeb6f0aa572489cb56a545693f32acc2a602468d18bdbfdda27c55982afbac5b8996bccfeb59d8bb56fe940e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
83KB

MD5
0cb778d7fd996be837bddc3427500421

SHA1
84e4a6eeda6bde14de1e4b7c16c0a360c7ee5132

SHA256
daf31bd43a9b78d469ad1e28df9ddb9fa2e81e7d4e568e728d037af89725a647

SHA512
ce1188af424a214ac504c524c9a4d938271c1adaeb6f0aa572489cb56a545693f32acc2a602468d18bdbfdda27c55982afbac5b8996bccfeb59d8bb56fe940e2

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
83KB

MD5
0cb778d7fd996be837bddc3427500421

SHA1
84e4a6eeda6bde14de1e4b7c16c0a360c7ee5132

SHA256
daf31bd43a9b78d469ad1e28df9ddb9fa2e81e7d4e568e728d037af89725a647

SHA512
ce1188af424a214ac504c524c9a4d938271c1adaeb6f0aa572489cb56a545693f32acc2a602468d18bdbfdda27c55982afbac5b8996bccfeb59d8bb56fe940e2

Download Submit
memory/1988-54-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1988-55-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1988-56-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/1988-58-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1988-70-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2056-69-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2056-72-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download
memory/2056-73-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2056-80-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download