56d67f4d5cd54c278e433612b07df2f129615bb21f567503a1e05d2eeeb55614

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19/07/2023, 13:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e67a00938c1ee7exe_JC.exe
Size

46KB
MD5

e67a00938c1ee73f351cd3cb9ef24b1e
SHA1

0c7988d7f96bffd6ecf5eda13fb436b36793d92f
SHA256

56d67f4d5cd54c278e433612b07df2f129615bb21f567503a1e05d2eeeb55614
SHA512

0ff4a9c0ec1ce7f7b38163939d4eb5549756b12469c9123a4f06914c1ff4f7745c68b697bdd1832a627b97d246a9238b8fcfcf9841b8c0624905db05ac0f1a6a
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4/Uth8igNrnGsrb:vj+jsMQMOtEvwDpj5HczerGsrb

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
532	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2244	e67a00938c1ee7exe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 532	2244	e67a00938c1ee7exe_JC.exe	28
PID 2244 wrote to memory of 532	2244	e67a00938c1ee7exe_JC.exe	28
PID 2244 wrote to memory of 532	2244	e67a00938c1ee7exe_JC.exe	28
PID 2244 wrote to memory of 532	2244	e67a00938c1ee7exe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\e67a00938c1ee7exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\e67a00938c1ee7exe_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
46KB

MD5
98d847bf93bbd292bb415ef258288332

SHA1
600cfde1d31281624681171715aa975ce8879163

SHA256
32344317938191dfb75df369c44eaf995bc4cb2b1cd6a9efa38c06c8c463b178

SHA512
51b642278c2b35e390c853d22719799383c3f200dfb678c42a137ba0f55a67d613c8358fe2335abe50341decc52aee5d9b8a0f1250c3bffaf55f3270bbd5aea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
46KB

MD5
98d847bf93bbd292bb415ef258288332

SHA1
600cfde1d31281624681171715aa975ce8879163

SHA256
32344317938191dfb75df369c44eaf995bc4cb2b1cd6a9efa38c06c8c463b178

SHA512
51b642278c2b35e390c853d22719799383c3f200dfb678c42a137ba0f55a67d613c8358fe2335abe50341decc52aee5d9b8a0f1250c3bffaf55f3270bbd5aea9

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
46KB

MD5
98d847bf93bbd292bb415ef258288332

SHA1
600cfde1d31281624681171715aa975ce8879163

SHA256
32344317938191dfb75df369c44eaf995bc4cb2b1cd6a9efa38c06c8c463b178

SHA512
51b642278c2b35e390c853d22719799383c3f200dfb678c42a137ba0f55a67d613c8358fe2335abe50341decc52aee5d9b8a0f1250c3bffaf55f3270bbd5aea9

Download Submit
memory/532-69-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/532-70-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2244-55-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/2244-54-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2244-62-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download