5c9c32aa420fae051a0ba9ab1bda24f4e5ede0ed36347bf842c537aa11cf269e

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21-11-2022 21:19

Target

BF53.iso
Size

842KB
MD5

b3ba9cb529778d0799a4ccf474b38a1b
SHA1

cacd71f4c5bb9625eb458fd5c259f8c29c585294
SHA256

5c9c32aa420fae051a0ba9ab1bda24f4e5ede0ed36347bf842c537aa11cf269e
SHA512

bba6b728d3604c13b9b1f59378408422a425376489164439b76d781b744bcf0d4984f2afdda68f017bb7406ce58c491eee2ceba9faeadf8d34d6e208619631a6
SSDEEP

24576:VN5pWbYGQajBp6Pi1YWaw46K8zWcCTikQsC3:JUbzQaNpx1DaIK8I23

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1812 wrote to memory of 1140	1812	cmd.exe	isoburn.exe
PID 1812 wrote to memory of 1140	1812	cmd.exe	isoburn.exe
PID 1812 wrote to memory of 1140	1812	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\BF53.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\BF53.iso"
  2⤵
  PID:1140

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1140-76-0x0000000000000000-mapping.dmp

Download
memory/1812-54-0x000007FEFBCA1000-0x000007FEFBCA3000-memory.dmp

Filesize
8KB

Download