fb4d8eab720bfa491d4cd6dc732bb6d2f74c77a37c8056d7eafdb7a01bcba3bd

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15-09-2022 11:28

Target

ad1a90f2f253a9adf45be85682d7b44994ab4e8ceafc1a5805316c39c803ccc8.iso
Size

2.5MB
MD5

a91ca42fe60d0c2d1008e909c8b23cb5
SHA1

14f812a695879f33acc81ab32568ed974cdfbea1
SHA256

ad1a90f2f253a9adf45be85682d7b44994ab4e8ceafc1a5805316c39c803ccc8
SHA512

d409e627d458d753fff8e888f3e211ebf5ad6a11e21b30811e4e46f398f7fa93a033deb97c8acc6e0a5b98c852cc0b773c83cbbad4130db3d3f8a5ae06f8e232
SSDEEP

49152:/Y8+6OwVQpMQ08Fk1BGrXN3fLXZOMU9EeF2gYNpJsv9:/g6OXp0KC0rXptVeum

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1076	2020	cmd.exe	29
PID 2020 wrote to memory of 1076	2020	cmd.exe	29
PID 2020 wrote to memory of 1076	2020	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ad1a90f2f253a9adf45be85682d7b44994ab4e8ceafc1a5805316c39c803ccc8.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\ad1a90f2f253a9adf45be85682d7b44994ab4e8ceafc1a5805316c39c803ccc8.iso"
  2⤵
  PID:1076

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2020-54-0x000007FEFC2C1000-0x000007FEFC2C3000-memory.dmp

Filesize
8KB

Download