4f7409277fe2420ca3aa0c567c60bafdde4d97692a2755dab6b386f10e2874d4

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
17-11-2022 06:28

Target

MO96.iso
Size

996KB
MD5

3c225cd46ccf8dcae455651c4cec4f5f
SHA1

bdc9ec4221c7b49c3e86fc78fa59f923211afbb2
SHA256

4f7409277fe2420ca3aa0c567c60bafdde4d97692a2755dab6b386f10e2874d4
SHA512

6132e5723d5f87bc39511e96f4ea659ac78327777b7dde96e667296ef8601e710d2d9565f881103e88377a9af1526b2a847d0fee262edebd07dfa43568099d31
SSDEEP

24576:+YSwvwJwRwJZwSw5wqwfHH8H2HHLwRx4Yk7A4DUESxv9MuI4vhL3tXC2Hk:kwvwJwRwJZwSw5wqwfHH8H2HHLwRuY02

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1980 wrote to memory of 816	1980	cmd.exe	isoburn.exe
PID 1980 wrote to memory of 816	1980	cmd.exe	isoburn.exe
PID 1980 wrote to memory of 816	1980	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MO96.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\MO96.iso"
  2⤵
  PID:816

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/816-76-0x0000000000000000-mapping.dmp

Download
memory/1980-54-0x000007FEFB7B1000-0x000007FEFB7B3000-memory.dmp

Filesize
8KB

Download