81623f0482b30b1a3bd4c6089681bd4f2cf52d421f4ed68022629009326c0ca9

Analysis

max time kernel
127s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
16-11-2022 03:08

Target

CVQD68.iso
Size

722KB
MD5

207cf18903882586280962ff3ccbf28d
SHA1

915b97f7e6b279a099b9393466b37de1c9410eb5
SHA256

81623f0482b30b1a3bd4c6089681bd4f2cf52d421f4ed68022629009326c0ca9
SHA512

91f69fadc1da71738d264f24ffd4e3db56a38495c2261ff76768e8f9b3d2a63a2baacda0abd933c9307a73b50d4f8133fad727c56df7661a19d4da583aa6ce85
SSDEEP

12288:bYX/TGcg+w9KCSJdcvXumiT3QOrT8Rk0zvInbiPCw18al1USuSZxHHTkG/8H8:bYX/TGckKCS30IAIQR3O7OjHHApc

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

isoburn.exe

pid process

828 isoburn.exe

pid	process
828	isoburn.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1184 wrote to memory of 828	1184	cmd.exe	isoburn.exe
PID 1184 wrote to memory of 828	1184	cmd.exe	isoburn.exe
PID 1184 wrote to memory of 828	1184	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\CVQD68.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\CVQD68.iso"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:828

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/828-76-0x0000000000000000-mapping.dmp

Download
memory/1184-54-0x000007FEFC2B1000-0x000007FEFC2B3000-memory.dmp

Filesize
8KB

Download