c3a06c5448869d4f136f1c15926ec4b2df48993fb86f3bd5dd4a69afbe3d46e4

Analysis

Target

Invoice-06-0922.iso
Size

442KB
MD5

0a9cd4404ef6392b4946e759e2dfb4c7
SHA1

024fdb8e0fe1ad9cf62fb4c4ea8fe7ee830bd5f5
SHA256

c3a06c5448869d4f136f1c15926ec4b2df48993fb86f3bd5dd4a69afbe3d46e4
SHA512

2a6033a56993b563adabe903f084d003ad759431aee62d100759705b9034aae6175629b5d7637f44311bf804b32b6922d09d0cc459cd814a15f02c794bfc494e

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings cmd.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

cmd.exe

pid process

3124 cmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings	cmd.exe

pid	process
3124	cmd.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact