e17f108dbdae317833c6a8771493512e0a773b5357c2535e1eba22fca1975477

Analysis

Target

d0bbf57aae4d2807dce2ec9dff881b5ece9dcd236ab9753aefafdf67cc57e9b2.iso
Size

270KB
MD5

faa422c6ccfe96edff7000ebef7b5776
SHA1

d9d72c12edecd7218b15f1554515f79bde997f72
SHA256

d0bbf57aae4d2807dce2ec9dff881b5ece9dcd236ab9753aefafdf67cc57e9b2
SHA512

2f39df9b952074d1b10c880671896770681f1e736bf57271c5790d20afcf9cc41e7180cea3c07aa2dd60808eda85a389696f7529f50a38e374d34d5a0e782dce

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings cmd.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

cmd.exe

pid process

3140 cmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings	cmd.exe

pid	process
3140	cmd.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact