9d53fdbc3ba9a8512ab3aca60edeaaf891c90940894c0deb4840131b7197ecf6

Analysis

max time kernel
137s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22-11-2022 17:02

Target

B610.iso
Size

1.3MB
MD5

f059da2ece2b79ec9b8b7e7974bcc7ab
SHA1

32ee510ea1e38f965f69e7ed143102d2b10066e6
SHA256

1e2668d29e5e8df2398bed8d50ba459f5506abcda0d869e51d0fa089c68570d4
SHA512

aae109ce6457fc6df313e4742bc32c46ad0d5070cb44f8f836d21252541ca8f5cbbc1292fc71eb836c370cfb81b9499420bc984a680f6ae79500c23b4e417cc6
SSDEEP

24576:ftRspkSUYg05qQg7/w6NJTgqLlIAeRwgQAwgQAFKWQO/8jZhOtE0KMIK:lSUY/5qQvcgE+AeRwgQAwgQAF5QO/wZn

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

isoburn.exe

pid process

1752 isoburn.exe

pid	process
1752	isoburn.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1100 wrote to memory of 1752	1100	cmd.exe	isoburn.exe
PID 1100 wrote to memory of 1752	1100	cmd.exe	isoburn.exe
PID 1100 wrote to memory of 1752	1100	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\B610.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\B610.iso"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1752

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1100-54-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmp

Filesize
8KB

Download
memory/1752-76-0x0000000000000000-mapping.dmp

Download