8ea25999fe93b84c817faa74af0ad94f0c0064d8e28fba5fea17665c38695430 | Triage

Resubmissions

02-06-2022 22:15

220602-16kn1abhf3 10

02-06-2022 21:45

220602-1mh13abha3 7

02-06-2022 21:44

220602-1ln6pabgh8 8

02-06-2022 21:40

220602-1jcpwabgh5 10

02-06-2022 21:27

220602-1ay7hsffap 10

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220414-en
submitted
02-06-2022 21:40

Sharing

Report Analysis Logs

General

Target

Invoice-06-1022.iso
Size

296KB
MD5

8e587660e5777ca12b72d46c88974db0
SHA1

a874bf87883d194ffee7629b5aff023dbfc53cc3
SHA256

867bdda02963b8226378c1d9c7fd01c951b6410a20a054e1fc470bfd2139b1a3
SHA512

65f30cee14049df3eb34af6654b2eee6984fb2a2e8a32a4441972934a797a16f5696fdc240e39d1a314ad0047abf9d7486301a5814692b5f15c90253944ed6f8

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 940	1236	cmd.exe	28
PID 1236 wrote to memory of 940	1236	cmd.exe	28
PID 1236 wrote to memory of 940	1236	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Invoice-06-1022.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\Invoice-06-1022.iso"
  2⤵
  PID:940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1236-54-0x000007FEFB671000-0x000007FEFB673000-memory.dmp

Filesize
8KB

Download