29e147a6c6cee9512858286552ae641eecc45e9fb83a67554ba0a42487b31352

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18-07-2023 13:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3f7a0d4ebb387_JC.exe
Size

87KB
MD5

b3f7a0d4ebb387185e4f7d1cb4607cf3
SHA1

b7a3f4902cb56e7f0513582983eaf49e4fbf3cf9
SHA256

29e147a6c6cee9512858286552ae641eecc45e9fb83a67554ba0a42487b31352
SHA512

a90ac8c49686cb72f89d1f7ebfd15142cd2ec8740ab146d9d208b0fe93b2ff3bf4e0492a2ea6326202889230c1ced8198356dc7cc376e6187f22578026b17bb1
SSDEEP

1536:vj+jsMQMOtEvwDpj5H8u8rBN6nqEZNieRpp:vCjsIOtEvwDpj5H8zPM

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
932	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2604	b3f7a0d4ebb387_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 932	2604	b3f7a0d4ebb387_JC.exe	30
PID 2604 wrote to memory of 932	2604	b3f7a0d4ebb387_JC.exe	30
PID 2604 wrote to memory of 932	2604	b3f7a0d4ebb387_JC.exe	30
PID 2604 wrote to memory of 932	2604	b3f7a0d4ebb387_JC.exe	30

C:\Users\Admin\AppData\Local\Temp\b3f7a0d4ebb387_JC.exe
"C:\Users\Admin\AppData\Local\Temp\b3f7a0d4ebb387_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
87KB

MD5
0663b931c7ae0ebc28c105f4cb42662d

SHA1
cec3b00eed1b14e1c864a472fb1cd9c68a9ea245

SHA256
3a35ce2f76a3edec440d0b9edb7ae76f07ff720a1665cab23625e8f401236935

SHA512
92211b1098fa75748bd1d034243323024d6b35b60deab68752e2beb0815cdad6cb360e80d5520d7030563bf59ca632b7740156dd1944fcdb4eef345c3ecbb973

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
87KB

MD5
0663b931c7ae0ebc28c105f4cb42662d

SHA1
cec3b00eed1b14e1c864a472fb1cd9c68a9ea245

SHA256
3a35ce2f76a3edec440d0b9edb7ae76f07ff720a1665cab23625e8f401236935

SHA512
92211b1098fa75748bd1d034243323024d6b35b60deab68752e2beb0815cdad6cb360e80d5520d7030563bf59ca632b7740156dd1944fcdb4eef345c3ecbb973

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
87KB

MD5
0663b931c7ae0ebc28c105f4cb42662d

SHA1
cec3b00eed1b14e1c864a472fb1cd9c68a9ea245

SHA256
3a35ce2f76a3edec440d0b9edb7ae76f07ff720a1665cab23625e8f401236935

SHA512
92211b1098fa75748bd1d034243323024d6b35b60deab68752e2beb0815cdad6cb360e80d5520d7030563bf59ca632b7740156dd1944fcdb4eef345c3ecbb973

Download Submit
memory/932-69-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/932-70-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2604-54-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2604-56-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2604-55-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download