2569392ca5aeb3de4dd45280021dc7be1b3aa7dbdd32006b28c9357f58a7cf75

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21-11-2022 15:39

Target

Agreement_ZXY61.iso
Size

662KB
MD5

f4fb2257acae4a9787809b4a6174be89
SHA1

9aa5b8c7782ae874fcc4dd9eca4ea219a5210276
SHA256

2569392ca5aeb3de4dd45280021dc7be1b3aa7dbdd32006b28c9357f58a7cf75
SHA512

2e902d3a36d6d5e88e72ddbc9cbb9d67ea13f396084619e4ae3e3ca09d8a973edfaccc5dd8b59508a2fd8b6377f2f4a3c33750cbc69739d14e27b4b44ff0eef7
SSDEEP

12288:SNWLxwOQHy6E1YF7P01JSdCLjqa/9mNdMxgligH8:SNWLxSHy6VP0/Ssfh9mUM

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1096 wrote to memory of 952	1096	cmd.exe	isoburn.exe
PID 1096 wrote to memory of 952	1096	cmd.exe	isoburn.exe
PID 1096 wrote to memory of 952	1096	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Agreement_ZXY61.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\Agreement_ZXY61.iso"
  2⤵
  PID:952

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/952-76-0x0000000000000000-mapping.dmp

Download
memory/1096-54-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmp

Filesize
8KB

Download