eb90ca8274ee98ec886d234ea7e013556cf7be5222f79b68c387a9ff71e2b1e2

Analysis

max time kernel
133s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
18-11-2022 08:38

Target

IR69.iso
Size

970KB
MD5

1727964a4bdac5680103acd4d5e15476
SHA1

6f778c18f96c844d2223f37ec2a5dc796170808f
SHA256

eb90ca8274ee98ec886d234ea7e013556cf7be5222f79b68c387a9ff71e2b1e2
SHA512

a327fe26e014bfa43180141529952009eacb22f63b5e139a78a0ac658d1cc158c18ddf94fc834ee342ea66d98099a172ec50ea842e4abb98b6c75b32160fbd5d
SSDEEP

12288:ao0KwnON76F+DfZxL4+Dir8lkQ5z4hbxmKFX4GfOs5VBNYRbWAUWWvoYPiwBP2vo:ao0KwW6F+DRt4Tr8lkBhdp2QOUZ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

isoburn.exe

pid process

268 isoburn.exe

pid	process
268	isoburn.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1328 wrote to memory of 268	1328	cmd.exe	isoburn.exe
PID 1328 wrote to memory of 268	1328	cmd.exe	isoburn.exe
PID 1328 wrote to memory of 268	1328	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IR69.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\IR69.iso"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:268

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/268-76-0x0000000000000000-mapping.dmp

Download
memory/1328-54-0x000007FEFB541000-0x000007FEFB543000-memory.dmp

Filesize
8KB

Download