2d84a546b178349a98abd171030811840cf7987ad7d8ae5a835f5fa518af98cd

Analysis

max time kernel
130s
max time network
143s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18-07-2023 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c279089b9962cf_JC.exe
Size

46KB
MD5

c279089b9962cfb2ec8ed9482c8ca0eb
SHA1

cdfbffcb07678f4e0f6d906b11bd5b6031cebe0f
SHA256

2d84a546b178349a98abd171030811840cf7987ad7d8ae5a835f5fa518af98cd
SHA512

cec2648fbbcb04efd407cb1894114559ec199399106d99d536c708da359661d3262f344fb11011f0b803e812c375644d66a7fb6f67a7e4adda4f6d6f37573693
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4/Uth8igNrnGsrTu:vj+jsMQMOtEvwDpj5HczerGsrTu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2476	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1788	c279089b9962cf_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 2476	1788	c279089b9962cf_JC.exe	28
PID 1788 wrote to memory of 2476	1788	c279089b9962cf_JC.exe	28
PID 1788 wrote to memory of 2476	1788	c279089b9962cf_JC.exe	28
PID 1788 wrote to memory of 2476	1788	c279089b9962cf_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\c279089b9962cf_JC.exe
"C:\Users\Admin\AppData\Local\Temp\c279089b9962cf_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
46KB

MD5
17a62206dfa543bb6cfbd46c952de466

SHA1
a4b0c668535fe78a60b9bd16f549e2483665adbb

SHA256
c87c7f0ed199b712bbd19e4de5179e3d86edfcee9cac4373792fce3684d4297b

SHA512
3609b85b9c0048659755ebf22d5e8cac7996c5611954ae10b863cc9cd2098271e16edea835f3ca54a7694596979ed98a11e6b21457394f932d9dc9d5e2a22a6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
46KB

MD5
17a62206dfa543bb6cfbd46c952de466

SHA1
a4b0c668535fe78a60b9bd16f549e2483665adbb

SHA256
c87c7f0ed199b712bbd19e4de5179e3d86edfcee9cac4373792fce3684d4297b

SHA512
3609b85b9c0048659755ebf22d5e8cac7996c5611954ae10b863cc9cd2098271e16edea835f3ca54a7694596979ed98a11e6b21457394f932d9dc9d5e2a22a6b

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
46KB

MD5
17a62206dfa543bb6cfbd46c952de466

SHA1
a4b0c668535fe78a60b9bd16f549e2483665adbb

SHA256
c87c7f0ed199b712bbd19e4de5179e3d86edfcee9cac4373792fce3684d4297b

SHA512
3609b85b9c0048659755ebf22d5e8cac7996c5611954ae10b863cc9cd2098271e16edea835f3ca54a7694596979ed98a11e6b21457394f932d9dc9d5e2a22a6b

Download Submit
memory/1788-53-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1788-54-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/1788-61-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2476-68-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2476-69-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download