645734102dbed0dc15bc201a6862736578b8a62283cb77ed21cd09a3ee63d80e

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18-11-2022 09:38

Target

EJ71.iso
Size

970KB
MD5

ccda9db28014a6de99eab5a8c0de8084
SHA1

6d598febb051a0c456bcd88318d0aea7b9833915
SHA256

645734102dbed0dc15bc201a6862736578b8a62283cb77ed21cd09a3ee63d80e
SHA512

c235336fb9bc5d29d0bf6c9503e8ce5316cc8df553e670b510d8a6a752828edf02e9d7550391e9dda86ee6736d7cb68f579129c0826dc3ad9568b083d3a3fc47
SSDEEP

12288:NoF6F+DfZxL4+Dir8lkQ5z4hbMmKFX4GfOs5VBNYRbWAUWWvoYPiwBPhKwnONVvo:NoF6F+DRt4Tr8lkBhYp2QOUDKw9

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2024 wrote to memory of 1392	2024	cmd.exe	isoburn.exe
PID 2024 wrote to memory of 1392	2024	cmd.exe	isoburn.exe
PID 2024 wrote to memory of 1392	2024	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\EJ71.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\EJ71.iso"
  2⤵
  PID:1392

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1392-76-0x0000000000000000-mapping.dmp

Download
memory/2024-54-0x000007FEFC251000-0x000007FEFC253000-memory.dmp

Filesize
8KB

Download