a118170a40ac2a0fa566a1b03b941b51b73dda52e25d8a1dfe4deed9e3136338

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
16/08/2023, 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f677826509a15bb5ac6081faf6cdc054.exe
Size

101KB
MD5

f677826509a15bb5ac6081faf6cdc054
SHA1

4647f67798e5458eb9a2390b2f2f7e3d4948b035
SHA256

a118170a40ac2a0fa566a1b03b941b51b73dda52e25d8a1dfe4deed9e3136338
SHA512

2cbdd39bd72839b6c454136d73d5b821949b46d2ea08d3f28ccc12db40450ee11c427b30a59160f7dad6f75408e1582b0517c019071e781d8e4278b8855f0627
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRiWCCy9TaoRK3q:xj+VGMOtEvwDpjubwQEIiePoRX

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1748	misid.exe

Loads dropped DLL 1 IoCs

pid	Process
2492	f677826509a15bb5ac6081faf6cdc054.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 1748	2492	f677826509a15bb5ac6081faf6cdc054.exe	28
PID 2492 wrote to memory of 1748	2492	f677826509a15bb5ac6081faf6cdc054.exe	28
PID 2492 wrote to memory of 1748	2492	f677826509a15bb5ac6081faf6cdc054.exe	28
PID 2492 wrote to memory of 1748	2492	f677826509a15bb5ac6081faf6cdc054.exe	28

C:\Users\Admin\AppData\Local\Temp\f677826509a15bb5ac6081faf6cdc054.exe
"C:\Users\Admin\AppData\Local\Temp\f677826509a15bb5ac6081faf6cdc054.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
101KB

MD5
95627ae24f0b179e507863282febe148

SHA1
6c028bde84f2f3b7e2a6997a5adfcb3343dc3f84

SHA256
e62aa2fac08a3ec018adabde3f105169c2d3654cc45c39c4af05e9b5ca2b5832

SHA512
8e03eeb0ac7d03afd71983dfaac97051af01b8ec39963b022c6d23570b8f82452bc69ab9c2a93b6aa32670c20999d288948997961717a5119a5f8c1b05aa0125

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
101KB

MD5
95627ae24f0b179e507863282febe148

SHA1
6c028bde84f2f3b7e2a6997a5adfcb3343dc3f84

SHA256
e62aa2fac08a3ec018adabde3f105169c2d3654cc45c39c4af05e9b5ca2b5832

SHA512
8e03eeb0ac7d03afd71983dfaac97051af01b8ec39963b022c6d23570b8f82452bc69ab9c2a93b6aa32670c20999d288948997961717a5119a5f8c1b05aa0125

Download Submit
\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
101KB

MD5
95627ae24f0b179e507863282febe148

SHA1
6c028bde84f2f3b7e2a6997a5adfcb3343dc3f84

SHA256
e62aa2fac08a3ec018adabde3f105169c2d3654cc45c39c4af05e9b5ca2b5832

SHA512
8e03eeb0ac7d03afd71983dfaac97051af01b8ec39963b022c6d23570b8f82452bc69ab9c2a93b6aa32670c20999d288948997961717a5119a5f8c1b05aa0125

Download Submit
memory/1748-73-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/1748-71-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1748-74-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/1748-82-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2492-69-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2492-57-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2492-68-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download
memory/2492-56-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2492-54-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2492-55-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2492-81-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download