0800502185324ef69b6c9eadef31460151a0a7fea21f1115e41fff7ee3a911cd

Analysis

max time kernel
127s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
18-11-2022 05:35

Target

IC86.iso
Size

970KB
MD5

5a47bdc7adf63e6f5a7abe33a40183bb
SHA1

85b686a0fddc5382ae477a93ff31b9c54574614b
SHA256

0800502185324ef69b6c9eadef31460151a0a7fea21f1115e41fff7ee3a911cd
SHA512

ddcc0e67dac58c6481d5c7e2deb9b42855077af8dce4817263909a87f9fa80547ca225d7ae270bc73ddca4b568caf853a950afc8ef6281d646ad974d843e9649
SSDEEP

12288:Eo96F+DfZxL4+Dir8lkQ5z4hb2mKFX4GfOs5VBNYRbWAUWWvoYPiwBPhKwnONVvo:Eo96F+DRt4Tr8lkBhSp2QOUDKw9

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

isoburn.exe

pid process

564 isoburn.exe

pid	process
564	isoburn.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1792 wrote to memory of 564	1792	cmd.exe	isoburn.exe
PID 1792 wrote to memory of 564	1792	cmd.exe	isoburn.exe
PID 1792 wrote to memory of 564	1792	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IC86.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\IC86.iso"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:564

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/564-76-0x0000000000000000-mapping.dmp

Download
memory/1792-54-0x000007FEFB991000-0x000007FEFB993000-memory.dmp

Filesize
8KB

Download