462f7320d44005bfde16e0fb9001a5bac82aedaadd110f8aed1f0e4cea7895e7

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18-11-2022 02:32

Target

SW09.iso
Size

970KB
MD5

61d9e78e960ffdb7997d556948bcebdd
SHA1

b2cdd854dc557e319f2d887cc97680c5609ada54
SHA256

462f7320d44005bfde16e0fb9001a5bac82aedaadd110f8aed1f0e4cea7895e7
SHA512

ddc329e92625147c21d2c6033b235fdd379e0f15d0b369246bdf775fc8f25a769b499ee5936b490fa33da69b81ae20aea23f08dfa970915b0a1fe19af26ccf0a
SSDEEP

12288:no0KwnON76F+DfZxL4+Dir8lkQ5z4hbzmKFX4GfOs5VBNYRbWAUWWvoYPiwBP2vo:no0KwW6F+DRt4Tr8lkBhHp2QOUZ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1492 wrote to memory of 1940	1492	cmd.exe	isoburn.exe
PID 1492 wrote to memory of 1940	1492	cmd.exe	isoburn.exe
PID 1492 wrote to memory of 1940	1492	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\SW09.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\SW09.iso"
  2⤵
  PID:1940

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1492-54-0x000007FEFBD81000-0x000007FEFBD83000-memory.dmp

Filesize
8KB

Download
memory/1940-76-0x0000000000000000-mapping.dmp

Download