772f87511e89cdf3d1f80a79eeef6ad15b0c03b9d5b06f961ac73b3b3cfe311f

Analysis

max time kernel
127s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
17-11-2022 20:56

Target

LW18.iso
Size

970KB
MD5

4b7e51ded159f5554aea40bc701fbc59
SHA1

3a82b56219b4cdf36125313c3d89a6c9497525a1
SHA256

772f87511e89cdf3d1f80a79eeef6ad15b0c03b9d5b06f961ac73b3b3cfe311f
SHA512

13f13d2c45920cc3549820cbc1c2f8eab9884a947f6e03e7facb569d638a0ce40b10d98d1f591c7997c0e67fb6f25878234242391b0116a95f8f2ae8cf640a8a
SSDEEP

12288:woEKwnONVvoo6F+DfZxL4+Dir8lkQ5z4hbzmKFX4GfOs5VBNYRbWAUWWvoYPiwBP:woEKw9o6F+DRt4Tr8lkBhfp2QOU

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

isoburn.exe

pid process

1904 isoburn.exe

pid	process
1904	isoburn.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1096 wrote to memory of 1904	1096	cmd.exe	isoburn.exe
PID 1096 wrote to memory of 1904	1096	cmd.exe	isoburn.exe
PID 1096 wrote to memory of 1904	1096	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\LW18.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\LW18.iso"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1904

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1096-54-0x000007FEFC421000-0x000007FEFC423000-memory.dmp

Filesize
8KB

Download
memory/1904-76-0x0000000000000000-mapping.dmp

Download