1590ffeabb381c2ac3bb5d03e3f2079382031776317d78580b066bcde3f75cde

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
17-11-2022 00:54

Target

DI45.iso
Size

996KB
MD5

0f088acd4abfa3a4815b9e2353dad31f
SHA1

d2d75756bf05e750c7bb8fedef371b0226ca9e08
SHA256

1590ffeabb381c2ac3bb5d03e3f2079382031776317d78580b066bcde3f75cde
SHA512

c5a52c2ffa7832b600b251969b9a9056258bdbded6516fc5d6b35abc2a3abf1d01c8643071cef43f8d95b04098b1443bfe75aa17fa9e69f1a28ac01936504be1
SSDEEP

24576:cYKwvwJwRwJZwSw5wqwfHH8H2HHLwRx4Yk7A4DUESxv9MuI4vhL3tXC2Hk:KwvwJwRwJZwSw5wqwfHH8H2HHLwRuY0O

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 768 wrote to memory of 1976	768	cmd.exe	isoburn.exe
PID 768 wrote to memory of 1976	768	cmd.exe	isoburn.exe
PID 768 wrote to memory of 1976	768	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DI45.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\DI45.iso"
  2⤵
  PID:1976

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/768-54-0x000007FEFC521000-0x000007FEFC523000-memory.dmp

Filesize
8KB

Download
memory/1976-76-0x0000000000000000-mapping.dmp

Download