a0c7a5adb2b9e6c4761c0cf33ff1b399da9592da329ddbb50275c1eceff21100

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23-07-2023 19:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NA_NA_2ea98645192e95exeexe_JC.exe
Size

55KB
MD5

2ea98645192e957aab0b5fd838ce0751
SHA1

8509fd8e25883b5e6ce99b426cc6536076b4c3f1
SHA256

a0c7a5adb2b9e6c4761c0cf33ff1b399da9592da329ddbb50275c1eceff21100
SHA512

4c5a4d0a90d0df8acb5da3f67c5d815fee230524ad28278fab8a82a9d52267d6266b586ff1c049169040c6ae732453f68f0d6b5eb0320371d513544ea6f0155d
SSDEEP

768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I522mg27:6j+1NMOtEvwDpjr8ox8U7

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2572	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2448	NA_NA_2ea98645192e95exeexe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2572	2448	NA_NA_2ea98645192e95exeexe_JC.exe	28
PID 2448 wrote to memory of 2572	2448	NA_NA_2ea98645192e95exeexe_JC.exe	28
PID 2448 wrote to memory of 2572	2448	NA_NA_2ea98645192e95exeexe_JC.exe	28
PID 2448 wrote to memory of 2572	2448	NA_NA_2ea98645192e95exeexe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NA_NA_2ea98645192e95exeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NA_NA_2ea98645192e95exeexe_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
55KB

MD5
cf542ed7e150ddbe95ec9e494a8dd34d

SHA1
86cdcf899a5737c6380b0c36c19bc396c8aca266

SHA256
1859f94b5fc001b9bfb933d9c0a95616a3dd0b94919deccc60b51e1f71e2cf63

SHA512
fa6b1b2d04661a6f9c9b1f468a2151069922a9279aee4e5f136fdc1487c8a762a7e4152a038f21c22555842beb8ab8c9ebd075abe7bd08c2481797e20ce4186a

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
55KB

MD5
cf542ed7e150ddbe95ec9e494a8dd34d

SHA1
86cdcf899a5737c6380b0c36c19bc396c8aca266

SHA256
1859f94b5fc001b9bfb933d9c0a95616a3dd0b94919deccc60b51e1f71e2cf63

SHA512
fa6b1b2d04661a6f9c9b1f468a2151069922a9279aee4e5f136fdc1487c8a762a7e4152a038f21c22555842beb8ab8c9ebd075abe7bd08c2481797e20ce4186a

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
55KB

MD5
cf542ed7e150ddbe95ec9e494a8dd34d

SHA1
86cdcf899a5737c6380b0c36c19bc396c8aca266

SHA256
1859f94b5fc001b9bfb933d9c0a95616a3dd0b94919deccc60b51e1f71e2cf63

SHA512
fa6b1b2d04661a6f9c9b1f468a2151069922a9279aee4e5f136fdc1487c8a762a7e4152a038f21c22555842beb8ab8c9ebd075abe7bd08c2481797e20ce4186a

Download Submit
memory/2448-67-0x00000000026C0000-0x00000000026CF000-memory.dmp

Filesize
60KB

Download
memory/2448-56-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2448-68-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2448-53-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2448-55-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2448-54-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2448-80-0x00000000026C0000-0x00000000026CF000-memory.dmp

Filesize
60KB

Download
memory/2572-71-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2572-73-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/2572-72-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2572-81-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download