756e04d2edc039bd7fd30f3516bf49c84f852401b3db14449aefc6f6ce69ad14

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
17-11-2022 15:51

Target

HF18.iso
Size

848KB
MD5

2d70d9494414358360c8dd677188d9a3
SHA1

0da6ef96af7fc9d7c73cbb9e68a15dd51fb433b8
SHA256

756e04d2edc039bd7fd30f3516bf49c84f852401b3db14449aefc6f6ce69ad14
SHA512

e1e83bf75888868ba615370729ba64e36f99161be878fcc8a7acbcde0d8251909e69576e0c05f509d2296fe7ad352d3b9d19643ea7ff21b5e9ddb75010c3ef3e
SSDEEP

12288:sojVN9gjGfBlmYUWlaVxbYUGOpGPq1Tu/VxdZlUP9Xq4F/9:sojVN9gjkeW8wWpD9u/VLM9Xq4n

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1280 wrote to memory of 1136	1280	cmd.exe	isoburn.exe
PID 1280 wrote to memory of 1136	1280	cmd.exe	isoburn.exe
PID 1280 wrote to memory of 1136	1280	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\HF18.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\HF18.iso"
  2⤵
  PID:1136

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1136-76-0x0000000000000000-mapping.dmp

Download
memory/1280-54-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Filesize
8KB

Download