Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
23-07-2023 16:20
Static task
static1
Behavioral task
behavioral1
Sample
NA_NA_157f9e4c102fe5exeexe_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
NA_NA_157f9e4c102fe5exeexe_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
NA_NA_157f9e4c102fe5exeexe_JC.exe
-
Size
81KB
-
MD5
157f9e4c102fe5e113fff591c1ee5057
-
SHA1
04e07cecaeccef99174bb4893b89a70537c9f541
-
SHA256
3b0b86c4d46001d98b50d2deeb89e20f8bfb469d801c18cbd4b543c51067f446
-
SHA512
26d919ae40cd0e62c36835e9b8eca2acfe612114d80c9a43e5e8b17fc8544e914bf5741b6b68de6767e60c6df871bc1f171d87c835ae1e7c58b5ea06e9e09502
-
SSDEEP
768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjIm8z2iaSIO/RvDQeduJHqqnzvNG1I:ZzFbxmLPWQMOtEvwDpj386Sj/RsxQzc
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2812 misid.exe -
Loads dropped DLL 1 IoCs
pid Process 1260 NA_NA_157f9e4c102fe5exeexe_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1260 wrote to memory of 2812 1260 NA_NA_157f9e4c102fe5exeexe_JC.exe 28 PID 1260 wrote to memory of 2812 1260 NA_NA_157f9e4c102fe5exeexe_JC.exe 28 PID 1260 wrote to memory of 2812 1260 NA_NA_157f9e4c102fe5exeexe_JC.exe 28 PID 1260 wrote to memory of 2812 1260 NA_NA_157f9e4c102fe5exeexe_JC.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\NA_NA_157f9e4c102fe5exeexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NA_NA_157f9e4c102fe5exeexe_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
PID:2812
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD5e3171174c9dbf90c3c69ac2a353e28ad
SHA1249a8ce5910ed35f465f4156a8b9e1cfa7df2695
SHA2568178d39f927e690166b268f2a94a5cf89377c0049e24fe08bb9e3aa07ee20c48
SHA512daaa641c2de1188e9950ddef1488ffaebda7165f0c2aad56e8a01ba2fa4e0ea74566d73863d1225f228239eed78fb90ec0de5e88d147a0ec66cd64068dd6917d
-
Filesize
81KB
MD5e3171174c9dbf90c3c69ac2a353e28ad
SHA1249a8ce5910ed35f465f4156a8b9e1cfa7df2695
SHA2568178d39f927e690166b268f2a94a5cf89377c0049e24fe08bb9e3aa07ee20c48
SHA512daaa641c2de1188e9950ddef1488ffaebda7165f0c2aad56e8a01ba2fa4e0ea74566d73863d1225f228239eed78fb90ec0de5e88d147a0ec66cd64068dd6917d
-
Filesize
81KB
MD5e3171174c9dbf90c3c69ac2a353e28ad
SHA1249a8ce5910ed35f465f4156a8b9e1cfa7df2695
SHA2568178d39f927e690166b268f2a94a5cf89377c0049e24fe08bb9e3aa07ee20c48
SHA512daaa641c2de1188e9950ddef1488ffaebda7165f0c2aad56e8a01ba2fa4e0ea74566d73863d1225f228239eed78fb90ec0de5e88d147a0ec66cd64068dd6917d