9e1abf9980ebc84d56b0c780b9fce0c401cfacc66e014f3be1d25564d4763477

Analysis

max time kernel
127s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
18-11-2022 13:42

Target

QL63.iso
Size

842KB
MD5

91e742988dfaf22dd473b2595a0fb1f2
SHA1

537c12d3dd983bddc03aa80e09d7384c575485fe
SHA256

9e1abf9980ebc84d56b0c780b9fce0c401cfacc66e014f3be1d25564d4763477
SHA512

58b63510eb651f7d82b78fd4f3e1eb87784859d73bdddf0ec74f8f6094e74832508306ed3657b93a4335358ca4ef8c1e2e610f6ed48f794051d5dfa9f170d763
SSDEEP

24576:INdpOK8zWcCTisQsC3BbYGQajBp6Pi1YWaw4:EQK8Ie3BbzQaNpx1Da

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

isoburn.exe

pid process

876 isoburn.exe

pid	process
876	isoburn.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1744 wrote to memory of 876	1744	cmd.exe	isoburn.exe
PID 1744 wrote to memory of 876	1744	cmd.exe	isoburn.exe
PID 1744 wrote to memory of 876	1744	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\QL63.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\QL63.iso"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:876

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/876-76-0x0000000000000000-mapping.dmp

Download
memory/1744-54-0x000007FEFBF61000-0x000007FEFBF63000-memory.dmp

Filesize
8KB

Download