07ca6bef6ca567c4fb982a5dfc5c3f7aa1ec86b406401b6b01a344cbeb7089e6

Analysis

max time kernel
124s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
17-11-2022 23:59

Target

EW61.iso
Size

970KB
MD5

56b0aa615092e5ebc9fde96d4e07350e
SHA1

27f9a601fd991c08351b19c148bc339bde51d145
SHA256

07ca6bef6ca567c4fb982a5dfc5c3f7aa1ec86b406401b6b01a344cbeb7089e6
SHA512

81dcc18bbdceb0ba8c45969706f8a00ca383f48c2abfc612e58035cdb2278daabf8971c1d32d1a32a5592fa79947a7ca562cde9d44970c648a7865f2fe56a3ac
SSDEEP

12288:yoeKwnON76F+DfZxL4+Dir8lkQ5z4hbrmKFX4GfOs5VBNYRbWAUWWvoYPiwBP2vo:yoeKwW6F+DRt4Tr8lkBh/p2QOUZ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

isoburn.exe

pid process

340 isoburn.exe

pid	process
340	isoburn.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1576 wrote to memory of 340	1576	cmd.exe	isoburn.exe
PID 1576 wrote to memory of 340	1576	cmd.exe	isoburn.exe
PID 1576 wrote to memory of 340	1576	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\EW61.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\EW61.iso"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:340

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/340-76-0x0000000000000000-mapping.dmp

Download
memory/1576-54-0x000007FEFC2C1000-0x000007FEFC2C3000-memory.dmp

Filesize
8KB

Download