fea87397b30e1977fd02b6ff0ed91f628ef72e8f39ba9a20dc8ba03b0af394e0

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f536fb6d887612101432de91e622c930exe_JC.exe
Size

409KB
MD5

f536fb6d887612101432de91e622c930
SHA1

34b54f0ccb00f295b3aca5f0efc18d8b0922b833
SHA256

fea87397b30e1977fd02b6ff0ed91f628ef72e8f39ba9a20dc8ba03b0af394e0
SHA512

572a848fb91947e2902e60933e917d094f1abddc9b47b6379a4016829598acfb49e1a3d01d9c4e95df488512825bd1b7314c9c8d7486d37a18ab179ace12ec4b
SSDEEP

12288:1KvcjmDBJztiDYSZnaSgAVoLFO9PKhH8TO8v:1KUaJzcESZ98hH8TO8v

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2728	amisid.exe

Loads dropped DLL 5 IoCs

pid	Process
2156	f536fb6d887612101432de91e622c930exe_JC.exe
2156	f536fb6d887612101432de91e622c930exe_JC.exe
2156	f536fb6d887612101432de91e622c930exe_JC.exe
2156	f536fb6d887612101432de91e622c930exe_JC.exe
2156	f536fb6d887612101432de91e622c930exe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2200	2156	WerFault.exe	27

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2728	2156	f536fb6d887612101432de91e622c930exe_JC.exe	28
PID 2156 wrote to memory of 2728	2156	f536fb6d887612101432de91e622c930exe_JC.exe	28
PID 2156 wrote to memory of 2728	2156	f536fb6d887612101432de91e622c930exe_JC.exe	28
PID 2156 wrote to memory of 2728	2156	f536fb6d887612101432de91e622c930exe_JC.exe	28
PID 2156 wrote to memory of 2200	2156	f536fb6d887612101432de91e622c930exe_JC.exe	30
PID 2156 wrote to memory of 2200	2156	f536fb6d887612101432de91e622c930exe_JC.exe	30
PID 2156 wrote to memory of 2200	2156	f536fb6d887612101432de91e622c930exe_JC.exe	30
PID 2156 wrote to memory of 2200	2156	f536fb6d887612101432de91e622c930exe_JC.exe	30

C:\Users\Admin\AppData\Local\Temp\f536fb6d887612101432de91e622c930exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\f536fb6d887612101432de91e622c930exe_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Local\Temp\nsi36EA.tmp\amisid.exe
  C:\Users\Admin\AppData\Local\Temp\nsi36EA.tmp\amisid.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 560
  2⤵
  - Program crash
  PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsi36EA.tmp\NSIS_AntiVmFraud.dll

Filesize
88KB

MD5
c0611351b38e6c292246ef16d5c996e2

SHA1
fd6b07503e21278a11e0812e586d24266a5b3dea

SHA256
1f25aaad57d697c252fd086236862501296d4a06b2d2f02a20d118db0c1ea5b3

SHA512
8338a3ee9c9915daa592cdcdb0bd6f4b7419d535df939cf2facebf947aeb0c3c5c1b4270c6592200ae502a6f438b5a1193ebea78b6a9f5dd9ee6a7692a609aec

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi36EA.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi36EA.tmp\amisid.exe

Filesize
63KB

MD5
e72a358d9ca068640b71999e3feb6489

SHA1
452de7b0de255467fc113aeab0244a28d9d6ddb4

SHA256
1fde3db9ef2e1e283bd4f8cc7e703f323b8f44dc04865d52939373db2e5ca46d

SHA512
7f622c50261ce98ebeaba06413b1660a08469fc692210927affb3efd014323aaf3d6cbb682ae79579f6fbd2a52121536a3b60b19674d76209f5445f381dc626e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi36EA.tmp\nsisos.dll

Filesize
5KB

MD5
69806691d649ef1c8703fd9e29231d44

SHA1
e2193fcf5b4863605eec2a5eb17bf84c7ac00166

SHA256
ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6

SHA512
5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi36EA.tmp\registry.dll

Filesize
24KB

MD5
2b7007ed0262ca02ef69d8990815cbeb

SHA1
2eabe4f755213666dbbbde024a5235ddde02b47f

SHA256
0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d

SHA512
aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca

Download Submit
\Users\Admin\AppData\Local\Temp\nsi36EA.tmp\NSIS_AntiVmFraud.dll

Filesize
88KB

MD5
c0611351b38e6c292246ef16d5c996e2

SHA1
fd6b07503e21278a11e0812e586d24266a5b3dea

SHA256
1f25aaad57d697c252fd086236862501296d4a06b2d2f02a20d118db0c1ea5b3

SHA512
8338a3ee9c9915daa592cdcdb0bd6f4b7419d535df939cf2facebf947aeb0c3c5c1b4270c6592200ae502a6f438b5a1193ebea78b6a9f5dd9ee6a7692a609aec

Download Submit
\Users\Admin\AppData\Local\Temp\nsi36EA.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsi36EA.tmp\amisid.exe

Filesize
63KB

MD5
e72a358d9ca068640b71999e3feb6489

SHA1
452de7b0de255467fc113aeab0244a28d9d6ddb4

SHA256
1fde3db9ef2e1e283bd4f8cc7e703f323b8f44dc04865d52939373db2e5ca46d

SHA512
7f622c50261ce98ebeaba06413b1660a08469fc692210927affb3efd014323aaf3d6cbb682ae79579f6fbd2a52121536a3b60b19674d76209f5445f381dc626e

Download Submit
\Users\Admin\AppData\Local\Temp\nsi36EA.tmp\nsisos.dll

Filesize
5KB

MD5
69806691d649ef1c8703fd9e29231d44

SHA1
e2193fcf5b4863605eec2a5eb17bf84c7ac00166

SHA256
ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6

SHA512
5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb

Download Submit
\Users\Admin\AppData\Local\Temp\nsi36EA.tmp\registry.dll

Filesize
24KB

MD5
2b7007ed0262ca02ef69d8990815cbeb

SHA1
2eabe4f755213666dbbbde024a5235ddde02b47f

SHA256
0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d

SHA512
aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca

Download Submit
memory/2156-15-0x0000000002980000-0x00000000029D9000-memory.dmp

Filesize
356KB

Download
memory/2156-0-0x0000000000390000-0x0000000000452000-memory.dmp

Filesize
776KB

Download
memory/2156-36-0x0000000000390000-0x0000000000452000-memory.dmp

Filesize
776KB

Download