e7c46629cd0a055d4ff6006a7959dc471924cb932c11a59cd734cca38f22be8a | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-10-2022 02:13

Sharing

Report Analysis Logs

General

Target

Document_43_Oct24.iso
Size

1.6MB
MD5

275b3cdee145d2b1f169950c1bd0ae32
SHA1

080e08c0fa01ed122c712be10ad85b905b4d3cc1
SHA256

e7c46629cd0a055d4ff6006a7959dc471924cb932c11a59cd734cca38f22be8a
SHA512

63d02bb4845834edc3524e87167f97e2570259c642d3981932462c29d54bdee27e31fdfe3ed1bd87694621c527e7451dc30635fcfdba3b50bbc99f8742d32dde
SSDEEP

3072:DvjzFD+vHhMTUe0FQgJYAh9apwYUVeNj6OO9ID:/zFSvgT+aSe5oID

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 1700	980	cmd.exe	29
PID 980 wrote to memory of 1700	980	cmd.exe	29
PID 980 wrote to memory of 1700	980	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Document_43_Oct24.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:980
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\Document_43_Oct24.iso"
  2⤵
  PID:1700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/980-54-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Filesize
8KB

Download