37727b89ca91b90e8580075152703683f7c69c0e38198d74538b8f9631947f86

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19/07/2023, 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05e51d3973e78aab88cc51f3d565e2e5d0e9a4703e1161cc8b400ae05f5ab74d.exe
Size

56KB
MD5

9b09eaeba4920efdf524b612b4d94ea0
SHA1

50f7982db96fbb9b348fdc3a56cfcaa797f02a08
SHA256

05e51d3973e78aab88cc51f3d565e2e5d0e9a4703e1161cc8b400ae05f5ab74d
SHA512

050c9ff51f9751aa97ea818d96211be6f667b1fc24a30cbd25ce66273417576104b5d3c13ec7c2c6c5e838453b5d9edfdef041f3b48f689cc5d0e4c4ef96304a
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjIm8lB4dCOBy/cMFqeo9e1dWSg:ZzFbxmLPWQMOtEvwDpj38lD/cMAPOu

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2360	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1744	05e51d3973e78aab88cc51f3d565e2e5d0e9a4703e1161cc8b400ae05f5ab74d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2360	1744	05e51d3973e78aab88cc51f3d565e2e5d0e9a4703e1161cc8b400ae05f5ab74d.exe	28
PID 1744 wrote to memory of 2360	1744	05e51d3973e78aab88cc51f3d565e2e5d0e9a4703e1161cc8b400ae05f5ab74d.exe	28
PID 1744 wrote to memory of 2360	1744	05e51d3973e78aab88cc51f3d565e2e5d0e9a4703e1161cc8b400ae05f5ab74d.exe	28
PID 1744 wrote to memory of 2360	1744	05e51d3973e78aab88cc51f3d565e2e5d0e9a4703e1161cc8b400ae05f5ab74d.exe	28

C:\Users\Admin\AppData\Local\Temp\05e51d3973e78aab88cc51f3d565e2e5d0e9a4703e1161cc8b400ae05f5ab74d.exe
"C:\Users\Admin\AppData\Local\Temp\05e51d3973e78aab88cc51f3d565e2e5d0e9a4703e1161cc8b400ae05f5ab74d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
56KB

MD5
673adf0198b8b1685e404f4c285ea1cc

SHA1
aafc4dd8f637b78796a928d6903bb6de138c0ba7

SHA256
0647fdda2f908e987e8ca319b87d7f87c3805cd4e83ceb56c6f7721f53e2c1f8

SHA512
ed70e546956019187051b1bf702c3dba2966223dcec636bde4e0ec029cbd155c3438d4b2581f5b001e422c3c16b6c41fcaa12ddeab8ce5ef3c13e85de016961f

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
56KB

MD5
673adf0198b8b1685e404f4c285ea1cc

SHA1
aafc4dd8f637b78796a928d6903bb6de138c0ba7

SHA256
0647fdda2f908e987e8ca319b87d7f87c3805cd4e83ceb56c6f7721f53e2c1f8

SHA512
ed70e546956019187051b1bf702c3dba2966223dcec636bde4e0ec029cbd155c3438d4b2581f5b001e422c3c16b6c41fcaa12ddeab8ce5ef3c13e85de016961f

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
56KB

MD5
673adf0198b8b1685e404f4c285ea1cc

SHA1
aafc4dd8f637b78796a928d6903bb6de138c0ba7

SHA256
0647fdda2f908e987e8ca319b87d7f87c3805cd4e83ceb56c6f7721f53e2c1f8

SHA512
ed70e546956019187051b1bf702c3dba2966223dcec636bde4e0ec029cbd155c3438d4b2581f5b001e422c3c16b6c41fcaa12ddeab8ce5ef3c13e85de016961f

Download Submit
memory/1744-55-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1744-57-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/1744-56-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1744-54-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2360-69-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2360-71-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2360-72-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2360-79-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download