bc536dad2849c890546ff3c195df0f341c7b04f97fcd1d4e08fe1385b3f2643c

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
17/07/2023, 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3bec9fb7bcb83_JC.exe
Size

35KB
MD5

a3bec9fb7bcb83d090fda4b2d9d6d1b6
SHA1

69951b375a0741ce41bc815a5f91592115329f19
SHA256

bc536dad2849c890546ff3c195df0f341c7b04f97fcd1d4e08fe1385b3f2643c
SHA512

e6a8f44bd22871d14833b98650625f4b4abdb1c0dc9ffb514e6ca71a61dceb545aca9a67def4ca364c46e0ef7a50b8eed85312e8b3b22ce0b93a83372ae5f515
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjxgqAhqOMpmTNAfu:ZzFbxmLPWQMOtEvwDpjx0qrmGG

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2944	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2284	a3bec9fb7bcb83_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2944	2284	a3bec9fb7bcb83_JC.exe	28
PID 2284 wrote to memory of 2944	2284	a3bec9fb7bcb83_JC.exe	28
PID 2284 wrote to memory of 2944	2284	a3bec9fb7bcb83_JC.exe	28
PID 2284 wrote to memory of 2944	2284	a3bec9fb7bcb83_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\a3bec9fb7bcb83_JC.exe
"C:\Users\Admin\AppData\Local\Temp\a3bec9fb7bcb83_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
35KB

MD5
803e7639f5d495cd89697b39db551cb4

SHA1
39c4d260c5d7921fe8aed833c43267fd4fff9e5c

SHA256
9a9a64128416b2ad3d8df6caa154ba4a2993b368a42e71145253d854cba3428d

SHA512
9b2a724d9c8953184d7e3c66dc6fea5bf84443f86e9eb5396a5be8ac026757cfa7e3eaed100c9113db34799155800262f30d437951606b5bc9f870721d8e23c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
35KB

MD5
803e7639f5d495cd89697b39db551cb4

SHA1
39c4d260c5d7921fe8aed833c43267fd4fff9e5c

SHA256
9a9a64128416b2ad3d8df6caa154ba4a2993b368a42e71145253d854cba3428d

SHA512
9b2a724d9c8953184d7e3c66dc6fea5bf84443f86e9eb5396a5be8ac026757cfa7e3eaed100c9113db34799155800262f30d437951606b5bc9f870721d8e23c8

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
35KB

MD5
803e7639f5d495cd89697b39db551cb4

SHA1
39c4d260c5d7921fe8aed833c43267fd4fff9e5c

SHA256
9a9a64128416b2ad3d8df6caa154ba4a2993b368a42e71145253d854cba3428d

SHA512
9b2a724d9c8953184d7e3c66dc6fea5bf84443f86e9eb5396a5be8ac026757cfa7e3eaed100c9113db34799155800262f30d437951606b5bc9f870721d8e23c8

Download Submit
memory/2284-54-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2284-55-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2284-56-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2944-68-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2944-77-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download