1afe857d1b5f2c0ff48ebbd2f32abf11f9b310416b1273e77adc7ee37f001ff8

Analysis

max time kernel
163s
max time network
193s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07-01-2024 18:26

Target

Samples 1/3d52822949346df4385fc98bf246b67f2667b4959cf15e490072ba00bbff59c3.exe
Size

82KB
MD5

8f84d63772a6cf26c6347dcf84f8152e
SHA1

5fd02e0feca98db01fd4a08dec8706dbf5c48645
SHA256

3d52822949346df4385fc98bf246b67f2667b4959cf15e490072ba00bbff59c3
SHA512

bba2ba53df1b2cd85f1170dd6803bdd9b05f1c046b3df116e80bfa4cee7157821a1f28e6b8d6bb5fbb3003301a3d06a11d2e31e8a9e03556bb2f8eeb6b81263d
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/Rs580gizi:ZVxkGOtEvwDpjc3

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2844 misid.exe
Loads dropped DLL 1 IoCs

Processes:

3d52822949346df4385fc98bf246b67f2667b4959cf15e490072ba00bbff59c3.exe

pid process

2724 3d52822949346df4385fc98bf246b67f2667b4959cf15e490072ba00bbff59c3.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2844	misid.exe

pid	process
2724	3d52822949346df4385fc98bf246b67f2667b4959cf15e490072ba00bbff59c3.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3d52822949346df4385fc98bf246b67f2667b4959cf15e490072ba00bbff59c3.exe

description	pid	process	target process
PID 2724 wrote to memory of 2844	2724	3d52822949346df4385fc98bf246b67f2667b4959cf15e490072ba00bbff59c3.exe	misid.exe
PID 2724 wrote to memory of 2844	2724	3d52822949346df4385fc98bf246b67f2667b4959cf15e490072ba00bbff59c3.exe	misid.exe
PID 2724 wrote to memory of 2844	2724	3d52822949346df4385fc98bf246b67f2667b4959cf15e490072ba00bbff59c3.exe	misid.exe
PID 2724 wrote to memory of 2844	2724	3d52822949346df4385fc98bf246b67f2667b4959cf15e490072ba00bbff59c3.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2844

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

\Users\Admin\AppData\Local\Temp\misid.exe
Filesize
82KB

MD5
1dbde61d252024a5bd73fa5d50014e72

SHA1
fb21afe273ea2fded8160e2119461834c33ab6e9

SHA256
5a166262c8cc02aac31c6b54bb3745d5e316206676f5518b0dbc44ea7d2d47cc

SHA512
617000c6cd8f3e359ba5847170662502f3aca2d40d2668fd842e49aec3e1e96e25b0b1c706df4d543d3ce01ebd56386bdb369fd8404df80a16d896adf8117dd8

Download Submit
memory/2724-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2724-0-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2724-3-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2724-2-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2844-15-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2844-17-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2844-20-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2844-25-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download