a1c069db2335832c3baad828736a8dced58b3c9a1a747c341a0ab26b1acec36f

Analysis

max time kernel
127s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
17-11-2022 05:27

Target

YV36.iso
Size

996KB
MD5

33a5f9f6cf45020557013088ec4c7f73
SHA1

dd6fb9ff8d787b9d2ff1ccc1dd87d1a130193007
SHA256

a1c069db2335832c3baad828736a8dced58b3c9a1a747c341a0ab26b1acec36f
SHA512

918f282ab20dc2daa0c49a7803290542ddc891d8e979d2b355a0dde74013a6d7d52a6d3e1d30fc1ed830c6861f0e4b98b41969d0046fde00c1bc49f65ab27ebc
SSDEEP

24576:DYPx4Yk7A4DUESxJ9MuI4vhL3tXwwvwJwRwJZwSw5wqwfHH8H2HHLwu2Hk:quY0ArHWT4vJ3tXwwvwJwRwJZwSw5wqj

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

isoburn.exe

pid process

664 isoburn.exe

pid	process
664	isoburn.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2040 wrote to memory of 664	2040	cmd.exe	isoburn.exe
PID 2040 wrote to memory of 664	2040	cmd.exe	isoburn.exe
PID 2040 wrote to memory of 664	2040	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\YV36.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\YV36.iso"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:664

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/664-76-0x0000000000000000-mapping.dmp

Download
memory/2040-54-0x000007FEFB6F1000-0x000007FEFB6F3000-memory.dmp

Filesize
8KB

Download