7acf2db79282c41129c35391e09d5bfa8f0c27ee94dfad03f12a388abfdd5d1e

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
18-11-2022 07:06

Target

CI01.iso
Size

970KB
MD5

7f41b5cbe263abca088f2bed0f16ed9f
SHA1

4df5047b09d5d24789595abfac25c93ccd8a569c
SHA256

7acf2db79282c41129c35391e09d5bfa8f0c27ee94dfad03f12a388abfdd5d1e
SHA512

79b42ff581751399966e0e336b533ffc995a261a61d1c9e0eabc5b1b38dcc66c68f8a6168f2b74d0f5f5edd6fd0125559adc2be3ddcabe18dae2d828cf10e6ce
SSDEEP

12288:uocKwnONVvoo6F+DfZxL4+Dir8lkQ5z4hbymKFX4GfOs5VBNYRbWAUWWvoYPiwBP:uocKw9o6F+DRt4Tr8lkBhmp2QOU

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1708 wrote to memory of 1108	1708	cmd.exe	isoburn.exe
PID 1708 wrote to memory of 1108	1708	cmd.exe	isoburn.exe
PID 1708 wrote to memory of 1108	1708	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\CI01.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\CI01.iso"
  2⤵
  PID:1108

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1108-76-0x0000000000000000-mapping.dmp

Download
memory/1708-54-0x000007FEFB7F1000-0x000007FEFB7F3000-memory.dmp

Filesize
8KB

Download