933437cb7be1291c7eacca4b2418202b147fe664f66ed0c55a937530f9a8b206

Analysis

max time kernel
38s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18-11-2022 01:00

Target

VP98.iso
Size

970KB
MD5

88cffdddd39d666b0fca7713c3afc3ec
SHA1

35c8176c54c6687a948e82fa1092cb73c9e4dafc
SHA256

933437cb7be1291c7eacca4b2418202b147fe664f66ed0c55a937530f9a8b206
SHA512

84e6ee6ad72920cbb8ff581f5aea3c5674e9cfcf693bde632d51618eb3946adb29c0b3adb382a178cf063c6e35785c258992da12c0480a2a7e4b310e91112065
SSDEEP

12288:NouKwnON76F+DfZxL4+Dir8lkQ5z4hbbmKFX4GfOs5VBNYRbWAUWWvoYPiwBP2vo:NouKwW6F+DRt4Tr8lkBh3p2QOUZ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1476 wrote to memory of 1888	1476	cmd.exe	isoburn.exe
PID 1476 wrote to memory of 1888	1476	cmd.exe	isoburn.exe
PID 1476 wrote to memory of 1888	1476	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\VP98.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\VP98.iso"
  2⤵
  PID:1888

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1476-54-0x000007FEFBD71000-0x000007FEFBD73000-memory.dmp

Filesize
8KB

Download
memory/1888-76-0x0000000000000000-mapping.dmp

Download