53470a7925f720edbc1233cd22aa87180eadb06a36c7c220f6454b4634ddfb64

Analysis

max time kernel
127s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
18-11-2022 11:40

Target

XK59.iso
Size

848KB
MD5

9095e01963927b3d9c8d458a5884eb89
SHA1

238efae11e32ebf03c597c491df1d77270e7037f
SHA256

53470a7925f720edbc1233cd22aa87180eadb06a36c7c220f6454b4634ddfb64
SHA512

95acff218657399a9c2e79d0cbbffd504fd272c43ce4347020c2044c9fa664c200617248a25dc573e0de33b5211cfd4af7992132786500994e94a873d31cf3ea
SSDEEP

12288:goTjGfBlKYUWlaVxbYUGOpGPq1Tu/VxdZlUP9Xq4F/9QVN9:goTjkCW8wWpD9u/VLM9Xq4nQVN9

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

isoburn.exe

pid process

860 isoburn.exe

pid	process
860	isoburn.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1232 wrote to memory of 860	1232	cmd.exe	isoburn.exe
PID 1232 wrote to memory of 860	1232	cmd.exe	isoburn.exe
PID 1232 wrote to memory of 860	1232	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\XK59.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\XK59.iso"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:860

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/860-76-0x0000000000000000-mapping.dmp

Download
memory/1232-54-0x000007FEFBE21000-0x000007FEFBE23000-memory.dmp

Filesize
8KB

Download