fca51c9131b9e6470825cabc9f0eb995c62a4ada1a902a9cc68d99948b461d1a

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23/07/2023, 18:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NA_NA_205104b1839d39exeexe_JC.exe
Size

93KB
MD5

205104b1839d392dad40adb081e3ca27
SHA1

d7ef4e57b784127e56a5127825a53cdd9b954fba
SHA256

fca51c9131b9e6470825cabc9f0eb995c62a4ada1a902a9cc68d99948b461d1a
SHA512

cebe76cad9618ef2733326ccf93475cd86a310d4218ab92dcbd3289fafd4fa0dbaa6fb769ca73307e935a012accf16da6083c5c54491f348e6d747d86d10c99a
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/Rs580giz6SJ0U/6Yt:ZVxkGOtEvwDpjc+

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2592	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
1964	NA_NA_205104b1839d39exeexe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2592	1964	NA_NA_205104b1839d39exeexe_JC.exe	28
PID 1964 wrote to memory of 2592	1964	NA_NA_205104b1839d39exeexe_JC.exe	28
PID 1964 wrote to memory of 2592	1964	NA_NA_205104b1839d39exeexe_JC.exe	28
PID 1964 wrote to memory of 2592	1964	NA_NA_205104b1839d39exeexe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NA_NA_205104b1839d39exeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NA_NA_205104b1839d39exeexe_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
93KB

MD5
2ee0e23bac3774cd4f55d990eee3dc4c

SHA1
85c9f7750f8dde6386da6421f696922a62984fdf

SHA256
b472ca33e7e1b17e6759c9447acb76ec9a55025346985466948286b81214527a

SHA512
bd0ad63020fc7f2c641b5afa1f69e55fb3beb37a0b0dd3eb1e6a5e79696ed9c6fa4002945b5db4ecedd089893f92ea42ea77b34c82f31c0fa21ad71a86decf2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
93KB

MD5
2ee0e23bac3774cd4f55d990eee3dc4c

SHA1
85c9f7750f8dde6386da6421f696922a62984fdf

SHA256
b472ca33e7e1b17e6759c9447acb76ec9a55025346985466948286b81214527a

SHA512
bd0ad63020fc7f2c641b5afa1f69e55fb3beb37a0b0dd3eb1e6a5e79696ed9c6fa4002945b5db4ecedd089893f92ea42ea77b34c82f31c0fa21ad71a86decf2a

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
93KB

MD5
2ee0e23bac3774cd4f55d990eee3dc4c

SHA1
85c9f7750f8dde6386da6421f696922a62984fdf

SHA256
b472ca33e7e1b17e6759c9447acb76ec9a55025346985466948286b81214527a

SHA512
bd0ad63020fc7f2c641b5afa1f69e55fb3beb37a0b0dd3eb1e6a5e79696ed9c6fa4002945b5db4ecedd089893f92ea42ea77b34c82f31c0fa21ad71a86decf2a

Download Submit
memory/1964-55-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/1964-54-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1964-56-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1964-57-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2592-69-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2592-72-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2592-71-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download