a2f0d211d4b37739801917b75e21733d390cc01192ce23c0d591b36cce76f541

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
17-11-2022 10:19

Target

GU64.iso
Size

996KB
MD5

5d72f4298b7e46863528d29bb9970ada
SHA1

bfd1c92d38c3fd526ebc7c6042646021c9cb53e5
SHA256

a2f0d211d4b37739801917b75e21733d390cc01192ce23c0d591b36cce76f541
SHA512

5d214640e7f516aa0563511564db20b8e2d0828609111ea933590985f17c38e9c3406270f9c54569f5c8736351d208955b7c1b6be2a3e3bd9ca9aba8a86e0a0a
SSDEEP

24576:bY9x4Yk7A4DUESxH9MuI4vhL3tXwwvwJwRwJZwSw5wqwfHH8H2HHLwu2Hk:6uY0ArH0T4vJ3tXwwvwJwRwJZwSw5wqj

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 812 wrote to memory of 1204	812	cmd.exe	isoburn.exe
PID 812 wrote to memory of 1204	812	cmd.exe	isoburn.exe
PID 812 wrote to memory of 1204	812	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\GU64.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:812
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\GU64.iso"
  2⤵
  PID:1204

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/812-54-0x000007FEFB6B1000-0x000007FEFB6B3000-memory.dmp

Filesize
8KB

Download
memory/1204-76-0x0000000000000000-mapping.dmp

Download