ba42688729765cf811596d050ec7fd0606d68bf9cd1ec6a34aa703bfd2532267

Analysis

max time kernel
132s
max time network
142s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
17-07-2023 18:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a48fbf5868bff7_JC.exe
Size

86KB
MD5

a48fbf5868bff76129525e6e2eda95f8
SHA1

fd015a26a11da2662fba950c6213a5ed63242554
SHA256

ba42688729765cf811596d050ec7fd0606d68bf9cd1ec6a34aa703bfd2532267
SHA512

90a8f6e7c94e136cdc821bace88cdada5fd85b3c2bd2e72e65fa587a331f943069dcd1a70e53c76175ba5f84da703975a1272c998a46ded6411f6adfd6416c0f
SSDEEP

1536:vj+jsMQMOtEvwDpj5H8u8rBN6nqEZNieRpJ:vCjsIOtEvwDpj5H8zPk

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2276	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1688	a48fbf5868bff7_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2276	1688	a48fbf5868bff7_JC.exe	28
PID 1688 wrote to memory of 2276	1688	a48fbf5868bff7_JC.exe	28
PID 1688 wrote to memory of 2276	1688	a48fbf5868bff7_JC.exe	28
PID 1688 wrote to memory of 2276	1688	a48fbf5868bff7_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\a48fbf5868bff7_JC.exe
"C:\Users\Admin\AppData\Local\Temp\a48fbf5868bff7_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
87KB

MD5
2f0fdd778aa49ce1ab5a044d6111dcc2

SHA1
79c3ea7f31c21aebbcb763cf896ac0ffad8b6997

SHA256
91385983808b3d14f78b02278802cc0451162d7e058134ca3a31af3d0ccab0d1

SHA512
c7c494f19138e19981a3c3e7a91c57a44516e5524b22e1b24136912e45d3345d5b11eb54457417b5a947da8431eb479d4b47474df62e3c7a496aed00bad1049a

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
87KB

MD5
2f0fdd778aa49ce1ab5a044d6111dcc2

SHA1
79c3ea7f31c21aebbcb763cf896ac0ffad8b6997

SHA256
91385983808b3d14f78b02278802cc0451162d7e058134ca3a31af3d0ccab0d1

SHA512
c7c494f19138e19981a3c3e7a91c57a44516e5524b22e1b24136912e45d3345d5b11eb54457417b5a947da8431eb479d4b47474df62e3c7a496aed00bad1049a

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
87KB

MD5
2f0fdd778aa49ce1ab5a044d6111dcc2

SHA1
79c3ea7f31c21aebbcb763cf896ac0ffad8b6997

SHA256
91385983808b3d14f78b02278802cc0451162d7e058134ca3a31af3d0ccab0d1

SHA512
c7c494f19138e19981a3c3e7a91c57a44516e5524b22e1b24136912e45d3345d5b11eb54457417b5a947da8431eb479d4b47474df62e3c7a496aed00bad1049a

Download Submit
memory/1688-54-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1688-56-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1688-55-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2276-69-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2276-70-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download