8151b9fc13ca6fc789d2878fee09b1bd8effc9f052e02c3efabf3c2f42def672

Analysis

max time kernel
127s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
21-11-2022 10:33

Target

GX51.iso
Size

842KB
MD5

507213006c8c7b3e6c3932917c1c803c
SHA1

084175e46d2d60a82de11c4c4dd6bc89b6452cf0
SHA256

8151b9fc13ca6fc789d2878fee09b1bd8effc9f052e02c3efabf3c2f42def672
SHA512

82023ffd44d9de31ba97863a98c44c20468a7000822eedb9475cdb7c2826666268252448eea4b904df54d6b94d8ae2fd20b5ec97ee0ba4b853aed69717868f1e
SSDEEP

24576:5NJpOK8zWcCTi4QsC3BbYGQajBp6Pi1YWaw4:NQK8Im3BbzQaNpx1Da

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

isoburn.exe

pid process

1440 isoburn.exe

pid	process
1440	isoburn.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1292 wrote to memory of 1440	1292	cmd.exe	isoburn.exe
PID 1292 wrote to memory of 1440	1292	cmd.exe	isoburn.exe
PID 1292 wrote to memory of 1440	1292	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\GX51.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\GX51.iso"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1440

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1292-54-0x000007FEFB8F1000-0x000007FEFB8F3000-memory.dmp

Filesize
8KB

Download
memory/1440-76-0x0000000000000000-mapping.dmp

Download