4c127558b558302c7d3ed931fc499bd8570a3939d63f4a78225c0795d9a4ba84

Analysis

max time kernel
127s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
17-11-2022 14:53

Target

BM60.iso
Size

996KB
MD5

cf9aeaf54a281bf0a2ab48e750479e80
SHA1

afa29cd00e7771f65374acd5a9fd5070cf2f7e31
SHA256

4c127558b558302c7d3ed931fc499bd8570a3939d63f4a78225c0795d9a4ba84
SHA512

decdb2beb72da78a65c62647270a683772b63e1350f3eccf68bccda01a3b1ff40943e8491711359c54278ed4998d011cf16997cd5e2a95d538b77eb26b26aaef
SSDEEP

24576:pYFx4Yk7A4DUESxC9MuI4vhL3tXwwvwJwRwJZwSw5wqwfHH8H2HHLwu2Hk:8uY0ArH7T4vJ3tXwwvwJwRwJZwSw5wqj

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

isoburn.exe

pid process

756 isoburn.exe

pid	process
756	isoburn.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1736 wrote to memory of 756	1736	cmd.exe	isoburn.exe
PID 1736 wrote to memory of 756	1736	cmd.exe	isoburn.exe
PID 1736 wrote to memory of 756	1736	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\BM60.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\BM60.iso"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:756

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/756-76-0x0000000000000000-mapping.dmp

Download
memory/1736-54-0x000007FEFB9C1000-0x000007FEFB9C3000-memory.dmp

Filesize
8KB

Download