49cae57a7ece00af7ea93c38b031d90d45c103d5ff1de1d205f23437e2a04e27

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
16-11-2022 23:23

Target

MI41.iso
Size

996KB
MD5

2bd47a3018960d9438e41a85221c304f
SHA1

9e21727a38a93e72ea808f2effbc1f91916ecd8c
SHA256

49cae57a7ece00af7ea93c38b031d90d45c103d5ff1de1d205f23437e2a04e27
SHA512

03a1bc728b488a1ec6ef227ba0ecedc90f7b4411f96772654ec96f45bf528cc2fe21a3b845cb793e91844030d6a539a4a2e6e4f9a442000f5df15aba198d6776
SSDEEP

24576:RYFx4Yk7A4DUESxc9MuI4vhL3tXwwvwJwRwJZwSw5wqwfHH8H2HHLwu2Hk:0uY0ArHRT4vJ3tXwwvwJwRwJZwSw5wqj

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1044 wrote to memory of 948	1044	cmd.exe	isoburn.exe
PID 1044 wrote to memory of 948	1044	cmd.exe	isoburn.exe
PID 1044 wrote to memory of 948	1044	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MI41.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\MI41.iso"
  2⤵
  PID:948

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/948-76-0x0000000000000000-mapping.dmp

Download
memory/1044-54-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp

Filesize
8KB

Download