8ea25999fe93b84c817faa74af0ad94f0c0064d8e28fba5fea17665c38695430

Target

Invoice-06-1022.iso
Size

296KB
MD5

8e587660e5777ca12b72d46c88974db0
SHA1

a874bf87883d194ffee7629b5aff023dbfc53cc3
SHA256

867bdda02963b8226378c1d9c7fd01c951b6410a20a054e1fc470bfd2139b1a3
SHA512

65f30cee14049df3eb34af6654b2eee6984fb2a2e8a32a4441972934a797a16f5696fdc240e39d1a314ad0047abf9d7486301a5814692b5f15c90253944ed6f8

Score

3^/10

Malware Config

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings cmd.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

cmd.exe

pid process

3136 cmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings	cmd.exe

pid	process
3136	cmd.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact