1afe857d1b5f2c0ff48ebbd2f32abf11f9b310416b1273e77adc7ee37f001ff8

Analysis

max time kernel
0s
max time network
155s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07-01-2024 18:26

Target

Samples 1/3bb40bab103c5f34e08a2c179ea379abd37d9861d7f6ac3d56d5c0d693b4260a.exe
Size

39KB
MD5

815996cd5d7442c707261c1b30dd1042
SHA1

fd331e80c76444662ec0947e591441ec97ca1dfa
SHA256

3bb40bab103c5f34e08a2c179ea379abd37d9861d7f6ac3d56d5c0d693b4260a
SHA512

aedd19e77f7750b46ad847debc483c46237d83f9f96be9a5b3793c8c63eecdc49699c568dc2d4217c6762d9ad0679771cea4e730bb24c673953dbaf4342b65e7
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjIm8lB4dCOBy/G7:ZzFbxmLPWQMOtEvwDpj38lD/q

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2912 misid.exe
Loads dropped DLL 1 IoCs

Processes:

3bb40bab103c5f34e08a2c179ea379abd37d9861d7f6ac3d56d5c0d693b4260a.exe

pid process

2168 3bb40bab103c5f34e08a2c179ea379abd37d9861d7f6ac3d56d5c0d693b4260a.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2912	misid.exe

pid	process
2168	3bb40bab103c5f34e08a2c179ea379abd37d9861d7f6ac3d56d5c0d693b4260a.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3bb40bab103c5f34e08a2c179ea379abd37d9861d7f6ac3d56d5c0d693b4260a.exe

description	pid	process	target process
PID 2168 wrote to memory of 2912	2168	3bb40bab103c5f34e08a2c179ea379abd37d9861d7f6ac3d56d5c0d693b4260a.exe	misid.exe
PID 2168 wrote to memory of 2912	2168	3bb40bab103c5f34e08a2c179ea379abd37d9861d7f6ac3d56d5c0d693b4260a.exe	misid.exe
PID 2168 wrote to memory of 2912	2168	3bb40bab103c5f34e08a2c179ea379abd37d9861d7f6ac3d56d5c0d693b4260a.exe	misid.exe
PID 2168 wrote to memory of 2912	2168	3bb40bab103c5f34e08a2c179ea379abd37d9861d7f6ac3d56d5c0d693b4260a.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2912

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

memory/2168-2-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2168-9-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2168-1-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2168-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2912-24-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/2912-17-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2912-16-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download