5304522c3f48984337f18133639815cab62f24ef25407c3a097fcecfc4b4ed9f | Triage

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28/10/2022, 08:28

Sharing

Report Analysis Logs

General

Target

Contract_8556.iso
Size

990KB
MD5

f1404d05a5143952499cd764babcb895
SHA1

673491da8fdbff9708fb077259515c0d788578ae
SHA256

5304522c3f48984337f18133639815cab62f24ef25407c3a097fcecfc4b4ed9f
SHA512

329d21193d45866ab0b3bcdade34245a10645e3c4a0d29c61cd45512ce60b1331294a0e96c44dc20444f8716bdbcba371db8c8453be6fbc73476ead56035ac20
SSDEEP

24576:u6y8bRZAYhI/LoO9bBoY/6wgHzwt6AwQwrwJwJY:u+AYhIjoO9d/6wgHzwt6AwQwrwJwJ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 792	1204	cmd.exe	28
PID 1204 wrote to memory of 792	1204	cmd.exe	28
PID 1204 wrote to memory of 792	1204	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Contract_8556.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\Contract_8556.iso"
  2⤵
  PID:792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1204-54-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

Filesize
8KB

Download