4c6295a1e9244ceee969a40874a7081b7b5071e423f8439f0368fa7d5187b9d9

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18-11-2022 12:41

Target

NT67.iso
Size

842KB
MD5

7000e4b0a1e3f2ae7e5c67c22c44cb62
SHA1

223bb16d6a62bd34e4fe81d74c74a968b3c1a2d7
SHA256

4c6295a1e9244ceee969a40874a7081b7b5071e423f8439f0368fa7d5187b9d9
SHA512

9b9b4bd4cf90cb4ca7c0541f268defbccbcd55f2a283140685a25a47f12897590f21e096cd498500b927f78878eb09995f89bf1a28a1b21f30aef48f447a2168
SSDEEP

24576:EN5pWbYGQajBp6Pi1YWaw46K8zWcCTijQsC3:yUbzQaNpx1DaIK8ID3

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 768 wrote to memory of 1976	768	cmd.exe	isoburn.exe
PID 768 wrote to memory of 1976	768	cmd.exe	isoburn.exe
PID 768 wrote to memory of 1976	768	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\NT67.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\NT67.iso"
  2⤵
  PID:1976

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/768-54-0x000007FEFC521000-0x000007FEFC523000-memory.dmp

Filesize
8KB

Download
memory/1976-76-0x0000000000000000-mapping.dmp

Download