26a30811833fd93ecb266b4e2287e9b30cb99aff38e5109398462946fced4ab0

Analysis

max time kernel
66s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
22-08-2022 17:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26a30811833fd93ecb266b4e2287e9b30cb99aff38e5109398462946fced4ab0.iso
Size

37.8MB
MD5

b2d0219ba59caed06c6e7466de3489f9
SHA1

4508e1ddd758ed6ce0465ddbf317671da429b11e
SHA256

26a30811833fd93ecb266b4e2287e9b30cb99aff38e5109398462946fced4ab0
SHA512

ad75f3a26a0152511808eecd46618dfc228002be2d9aa20e189e1228fbb441249ad1446d15c23ead13f9fd267491ebba3c5879b64548f8be0404b9d11fc42473

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1952 wrote to memory of 796	1952	cmd.exe	isoburn.exe
PID 1952 wrote to memory of 796	1952	cmd.exe	isoburn.exe
PID 1952 wrote to memory of 796	1952	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\26a30811833fd93ecb266b4e2287e9b30cb99aff38e5109398462946fced4ab0.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1952

C:\Windows\System32\isoburn.exe
"C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\26a30811833fd93ecb266b4e2287e9b30cb99aff38e5109398462946fced4ab0.iso"
2⤵
PID:796

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/796-76-0x0000000000000000-mapping.dmp

Download
memory/1952-54-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

Filesize
8KB

Download