9c1917a164145e98bf7b1f3b137ca6feff647796d32f016f7ebb324b1cd132e0

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:32

Target

9c1917a164145e98bf7b1f3b137ca6feff647796d32f016f7ebb324b1cd132e0.exe
Size

40KB
MD5

402e4d938f6497f2a307ea750037e8e7
SHA1

1640b0a8d4e9bc783f2043e199b5ed6b3b4b3c78
SHA256

9c1917a164145e98bf7b1f3b137ca6feff647796d32f016f7ebb324b1cd132e0
SHA512

3c2d590f03a92d051f787f37d837f237b68d3cb72d32feabf678790c7cd109d9d37176944ead782afa8c43e1c901ceb689417239b07a0e038b41a050d58ecd25
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjLeJAsKuDkB:ZzFbxmLPWQMOtEvwDpjLeJAsKce

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

2980 misid.exe
Loads dropped DLL 1 IoCs

Processes:

9c1917a164145e98bf7b1f3b137ca6feff647796d32f016f7ebb324b1cd132e0.exe

pid process

1964 9c1917a164145e98bf7b1f3b137ca6feff647796d32f016f7ebb324b1cd132e0.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2980	misid.exe

pid	process
1964	9c1917a164145e98bf7b1f3b137ca6feff647796d32f016f7ebb324b1cd132e0.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

9c1917a164145e98bf7b1f3b137ca6feff647796d32f016f7ebb324b1cd132e0.exe

description	pid	process	target process
PID 1964 wrote to memory of 2980	1964	9c1917a164145e98bf7b1f3b137ca6feff647796d32f016f7ebb324b1cd132e0.exe	misid.exe
PID 1964 wrote to memory of 2980	1964	9c1917a164145e98bf7b1f3b137ca6feff647796d32f016f7ebb324b1cd132e0.exe	misid.exe
PID 1964 wrote to memory of 2980	1964	9c1917a164145e98bf7b1f3b137ca6feff647796d32f016f7ebb324b1cd132e0.exe	misid.exe
PID 1964 wrote to memory of 2980	1964	9c1917a164145e98bf7b1f3b137ca6feff647796d32f016f7ebb324b1cd132e0.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Executes dropped EXE
PID:2980

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

\Users\Admin\AppData\Local\Temp\misid.exe
Filesize
41KB

MD5
89d6fa60626bb084db0c56b441c5e86d

SHA1
93b72f729a57486ce3400ccdea4910ee5f57f359

SHA256
99272376d2a39f0a5ea209cf8a43f76693089904e90f1c9f0f9aab748e7bf48f

SHA512
7ff937b8d3b157da257a65147a0ad148e210a2b5e0c00de4b27cb517fd0c9fcb07a1b26f006388b605361f9f60a52cbc394bd7ae57fb064c9410a3237f21523d

Download Submit
memory/1964-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1964-1-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/1964-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1964-8-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2980-16-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2980-24-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2980-23-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2980-25-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download