695dadfae91f75b6e5644269c866b2574576c738e2a9e1f031a074cf122c1877

Analysis

max time kernel
127s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
16-11-2022 15:08

Target

CVRE68.iso
Size

722KB
MD5

4d378671ed40d1c8c8636a808ce16383
SHA1

32e0dbf2b932fd57c0707af03f9fe7ed33c51cc5
SHA256

695dadfae91f75b6e5644269c866b2574576c738e2a9e1f031a074cf122c1877
SHA512

db57c122374d29a08abf309fb585f291345eaf5890cdac7c92dc4d0c0cff02f71b4d3846c60a22c0a31faab7e3a18e112d985bc99bc4d8651d3a9675c506b530
SSDEEP

12288:DYn/TGcg+w9KCvJdcvXumiT3QOrT8Rk0zvInbiPCw18al1USuSZxHHTkG/8H8:DYn/TGckKCv30IAIQR3O7OjHHApc

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

isoburn.exe

pid process

940 isoburn.exe

pid	process
940	isoburn.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1544 wrote to memory of 940	1544	cmd.exe	isoburn.exe
PID 1544 wrote to memory of 940	1544	cmd.exe	isoburn.exe
PID 1544 wrote to memory of 940	1544	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\CVRE68.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\CVRE68.iso"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:940

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/940-76-0x0000000000000000-mapping.dmp

Download
memory/1544-54-0x000007FEFC311000-0x000007FEFC313000-memory.dmp

Filesize
8KB

Download