bb3a3ec71f4c2d0d17627668463a190c86ae477e9916e32e5701b816defda829

Analysis

max time kernel
144s
max time network
150s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23/07/2023, 15:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NA_NA_112b5f4908c416exeexe_JC.exe
Size

33KB
MD5

112b5f4908c4169d5fb2f2249542ec45
SHA1

82ea58f6c8f4b127f5c9c98c5408620f2222e6ef
SHA256

bb3a3ec71f4c2d0d17627668463a190c86ae477e9916e32e5701b816defda829
SHA512

6e7394f2ea2202704817d41ae417665ad11db9af31698e7c76cac3e217ce56d1d347e95e6e5639e2b58d55361ab527a9dba48f5fb8ff5ac8e0aa56d749ac06c0
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4hdPsW:vj+jsMQMOtEvwDpj5HIW

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1080	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2208	NA_NA_112b5f4908c416exeexe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1080	2208	NA_NA_112b5f4908c416exeexe_JC.exe	28
PID 2208 wrote to memory of 1080	2208	NA_NA_112b5f4908c416exeexe_JC.exe	28
PID 2208 wrote to memory of 1080	2208	NA_NA_112b5f4908c416exeexe_JC.exe	28
PID 2208 wrote to memory of 1080	2208	NA_NA_112b5f4908c416exeexe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NA_NA_112b5f4908c416exeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NA_NA_112b5f4908c416exeexe_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
33KB

MD5
38854c6451bc816b28605262420bc20f

SHA1
7a1e3745e931ce07f0376f29219d2bf27f37ec24

SHA256
26f356fdfb609a871e3cbb3863f4b20bb4fa83a4f1c63f038d6a28c2dd9a6eb4

SHA512
30328cd953646c49a1ea68de7ef9d43806796f3e32f8938045ac2dddd62c91bb2c0530bd08d60e2a1650c2e68834641a6a119c51a520de771bc0375b63903390

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
33KB

MD5
38854c6451bc816b28605262420bc20f

SHA1
7a1e3745e931ce07f0376f29219d2bf27f37ec24

SHA256
26f356fdfb609a871e3cbb3863f4b20bb4fa83a4f1c63f038d6a28c2dd9a6eb4

SHA512
30328cd953646c49a1ea68de7ef9d43806796f3e32f8938045ac2dddd62c91bb2c0530bd08d60e2a1650c2e68834641a6a119c51a520de771bc0375b63903390

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
33KB

MD5
38854c6451bc816b28605262420bc20f

SHA1
7a1e3745e931ce07f0376f29219d2bf27f37ec24

SHA256
26f356fdfb609a871e3cbb3863f4b20bb4fa83a4f1c63f038d6a28c2dd9a6eb4

SHA512
30328cd953646c49a1ea68de7ef9d43806796f3e32f8938045ac2dddd62c91bb2c0530bd08d60e2a1650c2e68834641a6a119c51a520de771bc0375b63903390

Download Submit
memory/1080-70-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/1080-69-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2208-54-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2208-55-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2208-56-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download