b547ee0dede71e0d7bea41fc113f840224aa018e157c18e61c6e9303b036714c

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/10/2022, 16:57

Target
list_of_documents-7e684a9a-3359-4c66-9785-873690ca67d6.iso
Size 2.0MB
Sample221007-vghkfschf5
SHA256 b547ee0dede71e0d7bea41fc113f840224aa018e157c18e61c6e9303b036714c
MD5 a4bae45da813275683a3eff99cdee8fd
SHA1 c3c42d6fcc800b126097a4c1ae6d94298e90a95d
SHA512 cd368bf4a8bdb828e17aa86be41ccd2ad133b55b95ee2cb1c56fccec82aae330dd10aa81a09429c2d336c82a65dc67cab063c2752608b3da5cf343bb18faddc6
SSDEEP 24576:t3OXFrfa8OTW3IWQGfuYSkUn5NyvJQ4zIQqo1a2DXV2vBdI+AWmAsLFn7jm:t3OXFrfa8OTW3IWtuPNUJ6PicZdB6
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 596	860	cmd.exe	28
PID 860 wrote to memory of 596	860	cmd.exe	28
PID 860 wrote to memory of 596	860	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\list_of_documents-7e684a9a-3359-4c66-9785-873690ca67d6.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:860
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\list_of_documents-7e684a9a-3359-4c66-9785-873690ca67d6.iso"
  2⤵
  PID:596

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/860-54-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

Download