Analysis
-
max time kernel
58s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
18-08-2022 17:03
Static task
static1
Behavioral task
behavioral1
Sample
Policy_Document.iso
Resource
win7-20220812-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Policy_Document.iso
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
Policy-Document.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
General
-
Target
Policy_Document.iso
-
Size
300.6MB
-
MD5
19e831afa686bf2cacba9335279e316d
-
SHA1
03fefba6592583c218f00b4bb2b4c0df230402ff
-
SHA256
edf8a1adc604e52d333db94fa73e293c251a2cc02568237a46632081b3c98df8
-
SHA512
4a636f98b9c517df7bce363f398e03e413be9174d1990aba0b1dfbf55ac961eb248ed22c7e6adba5697888fcd380bb0425f449599e5d9a52e10849b3b61ab1d1
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 1976 wrote to memory of 1772 1976 cmd.exe isoburn.exe PID 1976 wrote to memory of 1772 1976 cmd.exe isoburn.exe PID 1976 wrote to memory of 1772 1976 cmd.exe isoburn.exe