420a9b53025c922bd4be1d93c2812c1d6b121575eba5d1215500c2d90aa9282d

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15/09/2022, 17:05

Target

invoice#488394.iso
Size

1.3MB
MD5

849846adc858b2dca012a11089329baa
SHA1

65d5ef6dec450a14bd24a5f6ee6d0d739d2f82a2
SHA256

aa03c1ee92830ad562bbb2c0c3d840367e19a1a4f3a7bc03c7e3cfa8a6951606
SHA512

eb6259369740c802f83fc00353914da3942c71d121a09ad1443679760f531011e49eeb30860a8521b145e7cc8b4808ed819691edf2db219ae3fd783d02e5e8c7
SSDEEP

12288:GP0hJ5HRw7GwUwjw1wJgHwYwfw69GwHwMwMcwp8wDftkAqfw45EZUw3xCwlNwcwr:GP0hJ5Hzdx7zs7oj7xH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1284	1048	cmd.exe	28
PID 1048 wrote to memory of 1284	1048	cmd.exe	28
PID 1048 wrote to memory of 1284	1048	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\invoice#488394.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\invoice#488394.iso"
  2⤵
  PID:1284

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1048-54-0x000007FEFC281000-0x000007FEFC283000-memory.dmp

Filesize
8KB

Download