583382fb9f7e6897e466df0c8a34d2773ff9f52b5e4c489f7c1e554e316c0856

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
17/07/2023, 16:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a02358329eff7_JC.exe
Size

103KB
MD5

9a02358329eff74e716b5eb4c8e19b43
SHA1

a32b16df2d1a719e780aeb340aabe85063b37f01
SHA256

583382fb9f7e6897e466df0c8a34d2773ff9f52b5e4c489f7c1e554e316c0856
SHA512

490ab25283001a63bc4c4592efb4f5ee3891209066c5c4a6ece30f14b570127059a1ea232388caadb533cb66fcb3ab068343adc62fd4601e8aaac82323f8e40a
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRiWCCyDLKASkjcYC9mnQww:xj+VGMOtEvwDpjubwQEIie8+ASkZQv

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2812	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1152	9a02358329eff7_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2812	1152	9a02358329eff7_JC.exe	1
PID 1152 wrote to memory of 2812	1152	9a02358329eff7_JC.exe	1
PID 1152 wrote to memory of 2812	1152	9a02358329eff7_JC.exe	1
PID 1152 wrote to memory of 2812	1152	9a02358329eff7_JC.exe	1

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
1⤵
- Executes dropped EXE
PID:2812

C:\Users\Admin\AppData\Local\Temp\9a02358329eff7_JC.exe
"C:\Users\Admin\AppData\Local\Temp\9a02358329eff7_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1152

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
103KB

MD5
e85be246a63d1f72d8a1f8df4a66aaad

SHA1
15f61f43a5f5a7e73891a6a736761ee538cd58fb

SHA256
f0397bdd15ede5cd9de67cee67d68261ea6d09ea56429aef59e5310761cd5e9b

SHA512
0f9fc3f028bd8eca42ad538900684ac97574a2b78aeb2b9938716782ee618c03df4cf155437f36cbbbe811913172b13b06c20fd35f25316959e15f589106cdf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
103KB

MD5
e85be246a63d1f72d8a1f8df4a66aaad

SHA1
15f61f43a5f5a7e73891a6a736761ee538cd58fb

SHA256
f0397bdd15ede5cd9de67cee67d68261ea6d09ea56429aef59e5310761cd5e9b

SHA512
0f9fc3f028bd8eca42ad538900684ac97574a2b78aeb2b9938716782ee618c03df4cf155437f36cbbbe811913172b13b06c20fd35f25316959e15f589106cdf3

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
103KB

MD5
e85be246a63d1f72d8a1f8df4a66aaad

SHA1
15f61f43a5f5a7e73891a6a736761ee538cd58fb

SHA256
f0397bdd15ede5cd9de67cee67d68261ea6d09ea56429aef59e5310761cd5e9b

SHA512
0f9fc3f028bd8eca42ad538900684ac97574a2b78aeb2b9938716782ee618c03df4cf155437f36cbbbe811913172b13b06c20fd35f25316959e15f589106cdf3

Download Submit
memory/1152-69-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1152-57-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1152-56-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download
memory/1152-55-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1152-54-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2812-73-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2812-72-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/2812-70-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2812-80-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download