e6ee91f443db207e5fae91ed0f35d24bd1d89cb7f6c720fade0894ff5ae60a38

Analysis

max time kernel
146s
max time network
151s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
17-07-2023 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82056079e0e55c_JC.exe
Size

82KB
MD5

82056079e0e55c2aa417bff193e93adc
SHA1

c84298fc43aa9d06678961702f159bf51439da91
SHA256

e6ee91f443db207e5fae91ed0f35d24bd1d89cb7f6c720fade0894ff5ae60a38
SHA512

0be2c3b9ea493371d45b9768f2d320f85c512c57838a3f0e23eb58f82d970f4fa589586ba802c1de2bc0015af6dd73920ac1096cded972f4c08a98fdcfffe507
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/RsxQzYFR:ZVxkGOtEvwDpjcE

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1456	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2396	82056079e0e55c_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 1456	2396	82056079e0e55c_JC.exe	29
PID 2396 wrote to memory of 1456	2396	82056079e0e55c_JC.exe	29
PID 2396 wrote to memory of 1456	2396	82056079e0e55c_JC.exe	29
PID 2396 wrote to memory of 1456	2396	82056079e0e55c_JC.exe	29

C:\Users\Admin\AppData\Local\Temp\82056079e0e55c_JC.exe
"C:\Users\Admin\AppData\Local\Temp\82056079e0e55c_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1456

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
82KB

MD5
a7fc6b14f7f1636ddfdd543b363d90fd

SHA1
b419bd34321a94d644c753ebbdcd27654efeb27b

SHA256
5bc077c7a3e19acaf744efca5a8c54b3952fa344da99977ad69a29ce2c5b435c

SHA512
e8eba0eaf2f280d5dc1dab4e80d0873f061010972f64811039502a1cf950bd1bb3a1b6ae453102c098c04ab5cd1a50de5baf06a3fed82065e1b897a52c40944c

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
82KB

MD5
a7fc6b14f7f1636ddfdd543b363d90fd

SHA1
b419bd34321a94d644c753ebbdcd27654efeb27b

SHA256
5bc077c7a3e19acaf744efca5a8c54b3952fa344da99977ad69a29ce2c5b435c

SHA512
e8eba0eaf2f280d5dc1dab4e80d0873f061010972f64811039502a1cf950bd1bb3a1b6ae453102c098c04ab5cd1a50de5baf06a3fed82065e1b897a52c40944c

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
82KB

MD5
a7fc6b14f7f1636ddfdd543b363d90fd

SHA1
b419bd34321a94d644c753ebbdcd27654efeb27b

SHA256
5bc077c7a3e19acaf744efca5a8c54b3952fa344da99977ad69a29ce2c5b435c

SHA512
e8eba0eaf2f280d5dc1dab4e80d0873f061010972f64811039502a1cf950bd1bb3a1b6ae453102c098c04ab5cd1a50de5baf06a3fed82065e1b897a52c40944c

Download Submit
memory/1456-69-0x0000000000230000-0x00000000002B0000-memory.dmp

Filesize
512KB

Download
memory/1456-71-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/1456-70-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2396-53-0x0000000000240000-0x0000000000243000-memory.dmp

Filesize
12KB

Download
memory/2396-54-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download
memory/2396-55-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download
memory/2396-56-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2396-73-0x0000000000240000-0x0000000000243000-memory.dmp

Filesize
12KB

Download