Analysis

  • max time kernel
    45s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    02-06-2022 20:53

General

  • Target

    Invoice-06-0922.iso

  • Size

    442KB

  • MD5

    0a9cd4404ef6392b4946e759e2dfb4c7

  • SHA1

    024fdb8e0fe1ad9cf62fb4c4ea8fe7ee830bd5f5

  • SHA256

    c3a06c5448869d4f136f1c15926ec4b2df48993fb86f3bd5dd4a69afbe3d46e4

  • SHA512

    2a6033a56993b563adabe903f084d003ad759431aee62d100759705b9034aae6175629b5d7637f44311bf804b32b6922d09d0cc459cd814a15f02c794bfc494e

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Invoice-06-0922.iso
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1948
    • C:\Windows\System32\isoburn.exe
      "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\Invoice-06-0922.iso"
      2⤵
        PID:2004

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1948-54-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

      Filesize

      8KB

    • memory/2004-76-0x0000000000000000-mapping.dmp