d184c7fac35e68924cf520d33fabc0703198756e096592dd31eec6101b5551e5

Target

document.iso
Size

2.9MB
MD5

f85b9913ed3c1b37defe3a83c9107ae9
SHA1

bd8732ac09eb363102cf8e3060869e7799c6afb5
SHA256

6daa6a247d6989fe4723a1d0868ed4abb6dfaadf09d1177fa23856b841e00644
SHA512

eed53b0bfc761259edb05ebcbb53c8e603ccdba33888a550671d60a9c2747f543b0d5c0a9d8cbc30bea7d20b872b72be1c621a5f58a18dae9dfe4eb27a79522a

Score

3^/10

Malware Config

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3578829114-180201921-3281645608-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
3580	cmd.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3148

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact