cb0d0468a068236d55f7b432be7ca848656936a942cd25dca9e92dae20a37ae6

Analysis

max time kernel
127s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
17-11-2022 18:23

Target

KX56.iso
Size

970KB
MD5

2db3d4e055cf8523d3575e3f97effee9
SHA1

4ba2aa41aa7bb7b196c79300a13cd69a20fb4176
SHA256

cb0d0468a068236d55f7b432be7ca848656936a942cd25dca9e92dae20a37ae6
SHA512

5095cec99f7e9830b2fa7a7fa04dca50c9f0bf6cba5fe74998a53a0a7e98a71e025e1a6c9cb946defb4d2a6aa41ef521cd972c72ad72a321a7ad5516d18f1386
SSDEEP

12288:3o2KwnON76F+DfZxL4+Dir8lkQ5z4hb/mKFX4GfOs5VBNYRbWAUWWvoYPiwBP2vo:3o2KwW6F+DRt4Tr8lkBh7p2QOUZ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

isoburn.exe

pid process

1396 isoburn.exe

pid	process
1396	isoburn.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1260 wrote to memory of 1396	1260	cmd.exe	isoburn.exe
PID 1260 wrote to memory of 1396	1260	cmd.exe	isoburn.exe
PID 1260 wrote to memory of 1396	1260	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\KX56.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\KX56.iso"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1396

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1260-54-0x000007FEFB8E1000-0x000007FEFB8E3000-memory.dmp

Filesize
8KB

Download
memory/1396-76-0x0000000000000000-mapping.dmp

Download