eda17074819f9ef9a16b6dce998a975b4e0bb89c6216c2ddf280163d60aa7d3a

Analysis

max time kernel
129s
max time network
142s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
17/07/2023, 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9856e0ff8623ce_JC.exe
Size

56KB
MD5

9856e0ff8623ce4e65e093c4306ed09b
SHA1

d046bfd50eb5dcf12858f7a99d8b7a200225c140
SHA256

eda17074819f9ef9a16b6dce998a975b4e0bb89c6216c2ddf280163d60aa7d3a
SHA512

4d9ced5176adcac28da67c3d74e41bd7a17e8f491e3d1360d6a58fe364e32d8793a6fa695ef7bd598c914b038b7ec8faa50b2c716e67073722b0b9d7ca1a7e8c
SSDEEP

768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I52Ft:6j+1NMOtEvwDpjr8ox8U3

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2544	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2192	9856e0ff8623ce_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2544	2192	9856e0ff8623ce_JC.exe	28
PID 2192 wrote to memory of 2544	2192	9856e0ff8623ce_JC.exe	28
PID 2192 wrote to memory of 2544	2192	9856e0ff8623ce_JC.exe	28
PID 2192 wrote to memory of 2544	2192	9856e0ff8623ce_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\9856e0ff8623ce_JC.exe
"C:\Users\Admin\AppData\Local\Temp\9856e0ff8623ce_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
56KB

MD5
5f049ebaf1f36b58d4b0aed21b27b639

SHA1
149cafd8543f4784df3c91da972a4c1315dc2851

SHA256
0279bdcec5bb90b2c344df1556d3ad796038d50363a5dee0606cc2a0911ea39f

SHA512
a163fc997871684bc07484a48ecc49c70fd6ccb3653df3bbbc3d054d3995f118a78e8b3947d520d2a6a06f6d19c611226e9f59f11c0f6abcaf2c0837004225ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
56KB

MD5
5f049ebaf1f36b58d4b0aed21b27b639

SHA1
149cafd8543f4784df3c91da972a4c1315dc2851

SHA256
0279bdcec5bb90b2c344df1556d3ad796038d50363a5dee0606cc2a0911ea39f

SHA512
a163fc997871684bc07484a48ecc49c70fd6ccb3653df3bbbc3d054d3995f118a78e8b3947d520d2a6a06f6d19c611226e9f59f11c0f6abcaf2c0837004225ae

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
56KB

MD5
5f049ebaf1f36b58d4b0aed21b27b639

SHA1
149cafd8543f4784df3c91da972a4c1315dc2851

SHA256
0279bdcec5bb90b2c344df1556d3ad796038d50363a5dee0606cc2a0911ea39f

SHA512
a163fc997871684bc07484a48ecc49c70fd6ccb3653df3bbbc3d054d3995f118a78e8b3947d520d2a6a06f6d19c611226e9f59f11c0f6abcaf2c0837004225ae

Download Submit
memory/2192-54-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2192-55-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2192-56-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download
memory/2192-58-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2192-69-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2544-70-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2544-72-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2544-73-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2544-80-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download