f22d1ad6c3389e91374dc113c008381fd66e5b1303815a10860a750204e14b19

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14/09/2022, 07:09

Target

Ažuriranje_transakcije.iso
Size

1.2MB
MD5

2775cf71cabb89e2befce8e9553b5cd5
SHA1

6184e34d22794abcf70a8a2319a4abccfd8986e2
SHA256

f22d1ad6c3389e91374dc113c008381fd66e5b1303815a10860a750204e14b19
SHA512

682ca968874d8feeee272ee5e81932d040d2bcdf2c7e25b3ec64c990192919473afd5c69be371dda353cf2e3a7d402302c207093c122945f43835dad1eb85e65
SSDEEP

6144:ZUj/w6e6+p2897x6q+EYzYXMbKQ9vgdPED60JFtHYh2KOWZ5N:ZqVe6s9FP+aXMezEVTYh2KVZ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 1720	748	cmd.exe	28
PID 748 wrote to memory of 1720	748	cmd.exe	28
PID 748 wrote to memory of 1720	748	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Ažuriranje_transakcije.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\Ažuriranje_transakcije.iso"
  2⤵
  PID:1720

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/748-54-0x000007FEFBD71000-0x000007FEFBD73000-memory.dmp

Filesize
8KB

Download