d184c7fac35e68924cf520d33fabc0703198756e096592dd31eec6101b5551e5

Resubmissions

10-10-2022 17:13

221010-vrjkhacggj 10

03-06-2022 21:56

03-06-2022 21:55

03-06-2022 21:38

03-06-2022 21:28

Analysis

max time kernel
430s
max time network
433s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10-10-2022 17:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

document.iso
Size

2.9MB
MD5

f85b9913ed3c1b37defe3a83c9107ae9
SHA1

bd8732ac09eb363102cf8e3060869e7799c6afb5
SHA256

6daa6a247d6989fe4723a1d0868ed4abb6dfaadf09d1177fa23856b841e00644
SHA512

eed53b0bfc761259edb05ebcbb53c8e603ccdba33888a550671d60a9c2747f543b0d5c0a9d8cbc30bea7d20b872b72be1c621a5f58a18dae9dfe4eb27a79522a
SSDEEP

49152:2owwxiVJF/esysoUCNzUD0YLROMgd8JC:2opxiVJr

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1980	1756	cmd.exe	28
PID 1756 wrote to memory of 1980	1756	cmd.exe	28
PID 1756 wrote to memory of 1980	1756	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\document.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\document.iso"
  2⤵
  PID:1980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1756-54-0x000007FEFC521000-0x000007FEFC523000-memory.dmp

Filesize
8KB

Download