fc8c65b12abf5ea25a5658b344569f4589806431d619f3c9038d447c4a3f9d5b

Analysis

max time kernel
135s
max time network
147s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
17/07/2023, 13:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89168da8c5ef4f_JC.exe
Size

83KB
MD5

89168da8c5ef4fe5f38ea700590ce79e
SHA1

82ac375e28887446fabe82a102b5ac17b6c04f38
SHA256

fc8c65b12abf5ea25a5658b344569f4589806431d619f3c9038d447c4a3f9d5b
SHA512

beb39febc4a50baaa2529c9395e7f06430025c8819c0034aa4c18d1703e41e7f3e0e0192e9c14926f09eae94e9594961d4f100e07e39c745cb43897639c725c2
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjIm8z2iaSIO/RvDQeduJHqqnzvNG1Q:ZzFbxmLPWQMOtEvwDpj386Sj/RsxQzE

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2056	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1936	89168da8c5ef4f_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2056	1936	89168da8c5ef4f_JC.exe	28
PID 1936 wrote to memory of 2056	1936	89168da8c5ef4f_JC.exe	28
PID 1936 wrote to memory of 2056	1936	89168da8c5ef4f_JC.exe	28
PID 1936 wrote to memory of 2056	1936	89168da8c5ef4f_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\89168da8c5ef4f_JC.exe
"C:\Users\Admin\AppData\Local\Temp\89168da8c5ef4f_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
83KB

MD5
d5f3419b88b88fa5829433d33fd21fb5

SHA1
eb52b5f037adec40b747bb3916c12c42ae9484df

SHA256
e60efd25fbe394751930ad81bf528cbfa5fb4311845e50429d53d5941f084407

SHA512
3b7e20e255ac3d75ff53c4be4d7553a84bb80b708e45f98fa8f241b770bd9761f3c37bed5dd7c03ec58b66aa2790d32ff53c8532ea17d95c9c05b8f0c37c2459

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
83KB

MD5
d5f3419b88b88fa5829433d33fd21fb5

SHA1
eb52b5f037adec40b747bb3916c12c42ae9484df

SHA256
e60efd25fbe394751930ad81bf528cbfa5fb4311845e50429d53d5941f084407

SHA512
3b7e20e255ac3d75ff53c4be4d7553a84bb80b708e45f98fa8f241b770bd9761f3c37bed5dd7c03ec58b66aa2790d32ff53c8532ea17d95c9c05b8f0c37c2459

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
83KB

MD5
d5f3419b88b88fa5829433d33fd21fb5

SHA1
eb52b5f037adec40b747bb3916c12c42ae9484df

SHA256
e60efd25fbe394751930ad81bf528cbfa5fb4311845e50429d53d5941f084407

SHA512
3b7e20e255ac3d75ff53c4be4d7553a84bb80b708e45f98fa8f241b770bd9761f3c37bed5dd7c03ec58b66aa2790d32ff53c8532ea17d95c9c05b8f0c37c2459

Download Submit
memory/1936-54-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1936-56-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/1936-55-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1936-68-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2056-70-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2056-71-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2056-78-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download