0683830c1e77a33ee4d92109770cbaca0a7af5ff46aabc2e840d55a1e90c5b2d

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
16-11-2022 22:36

Target

FE95.iso
Size

996KB
MD5

1008647a6a70e1df84bf8925a3029994
SHA1

93baf5dfdaeb8d877faff27b7307c448e23b6986
SHA256

0683830c1e77a33ee4d92109770cbaca0a7af5ff46aabc2e840d55a1e90c5b2d
SHA512

4af9e1368bc402ef42c46a324677fecadb875b56694f24f355b44a71d7fd59d4e1fbe74865650d6466e0b8ee1078597f200fa27564ee39450b0a380ca4644ee3
SSDEEP

24576:MY6wvwJwRwJZwSw5wqwfHH8H2HHLwRx4Yk7A4DUESxl9MuI4vhL3tXC2Hk:KwvwJwRwJZwSw5wqwfHH8H2HHLwRuY0E

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1892	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1892	AUDIODG.EXE
Token: 33	1892	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1892	AUDIODG.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1844 wrote to memory of 1576	1844	cmd.exe	isoburn.exe
PID 1844 wrote to memory of 1576	1844	cmd.exe	isoburn.exe
PID 1844 wrote to memory of 1576	1844	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\FE95.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\FE95.iso"
  2⤵
  PID:1576

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x570
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1892

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1576-76-0x0000000000000000-mapping.dmp

Download
memory/1844-54-0x000007FEFC011000-0x000007FEFC013000-memory.dmp

Filesize
8KB

Download