8ea25999fe93b84c817faa74af0ad94f0c0064d8e28fba5fea17665c38695430

Target

Invoice-06-1022.iso
Size

296KB
MD5

8e587660e5777ca12b72d46c88974db0
SHA1

a874bf87883d194ffee7629b5aff023dbfc53cc3
SHA256

867bdda02963b8226378c1d9c7fd01c951b6410a20a054e1fc470bfd2139b1a3
SHA512

65f30cee14049df3eb34af6654b2eee6984fb2a2e8a32a4441972934a797a16f5696fdc240e39d1a314ad0047abf9d7486301a5814692b5f15c90253944ed6f8

Score

3^/10

Malware Config

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 388 wrote to memory of 1248	388	cmd.exe	isoburn.exe
PID 388 wrote to memory of 1248	388	cmd.exe	isoburn.exe
PID 388 wrote to memory of 1248	388	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Invoice-06-1022.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:388
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\Invoice-06-1022.iso"
  2⤵
  PID:1248

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/388-54-0x000007FEFC451000-0x000007FEFC453000-memory.dmp

Filesize
8KB

Download
memory/1248-76-0x0000000000000000-mapping.dmp

Download