e0b5e015370def4853a2fa5bc0bfe613a05d6509224295e598015e26d458bfbb

Analysis

max time kernel
37s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
17-11-2022 02:25

Target

TA67.iso
Size

996KB
MD5

da33d3c16d6dbd1b653c248fa62ca9bb
SHA1

e45011dc71e2af21f74e87fb7cf25568624d8f20
SHA256

e0b5e015370def4853a2fa5bc0bfe613a05d6509224295e598015e26d458bfbb
SHA512

e42b1b2f85f3971cb4fe9c819cce81ed972d72b2069eaa745173c396e48ec54476f8598b1bf4b3d934966e861818b865b041d6e19d913a54d69804b7f3a411a0
SSDEEP

24576:sYowvwJwRwJZwSw5wqwfHH8H2HHLwRx4Yk7A4DUESxV9MuI4vhL3tXC2Hk:4wvwJwRwJZwSw5wqwfHH8H2HHLwRuY0M

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1836 wrote to memory of 948	1836	cmd.exe	isoburn.exe
PID 1836 wrote to memory of 948	1836	cmd.exe	isoburn.exe
PID 1836 wrote to memory of 948	1836	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\TA67.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\TA67.iso"
  2⤵
  PID:948

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/948-76-0x0000000000000000-mapping.dmp

Download
memory/1836-54-0x000007FEFB901000-0x000007FEFB903000-memory.dmp

Filesize
8KB

Download