b40b9ff456355008e3446a807f8bd9beea79817fa3287a113a23be13e97ed031

Analysis

max time kernel
133s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
17-11-2022 00:24

Target

QI05.iso
Size

996KB
MD5

2cb2b9c4784290e38a7c1fb368d6f9f5
SHA1

0ae2b10c1818a4b55e6f4554b5544d988d0750ca
SHA256

b40b9ff456355008e3446a807f8bd9beea79817fa3287a113a23be13e97ed031
SHA512

31bb131fd04fc2368fb27d0288cae38a47b4d940e39c59374bc4384d98722f06230253162c2c92159b5bf10ebaf55dd585e5e4929dcc42a3436dc3982b50fa68
SSDEEP

24576:tYgwvwJwRwJZwSw5wqwfHH8H2HHLwRx4Yk7A4DUESxF9MuI4vhL3tXC2Hk:3wvwJwRwJZwSw5wqwfHH8H2HHLwRuY0k

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

isoburn.exe

pid process

268 isoburn.exe

pid	process
268	isoburn.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1328 wrote to memory of 268	1328	cmd.exe	isoburn.exe
PID 1328 wrote to memory of 268	1328	cmd.exe	isoburn.exe
PID 1328 wrote to memory of 268	1328	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\QI05.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\QI05.iso"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:268

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/268-76-0x0000000000000000-mapping.dmp

Download
memory/1328-54-0x000007FEFB541000-0x000007FEFB543000-memory.dmp

Filesize
8KB

Download