53eafeee2c494c3418d47a25664a414619885cc92447a735657b2ceedad71cde

Analysis

max time kernel
283s
max time network
418s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 18:56

Target

TS-795WP.iso
Size

101.2MB
MD5

411a9877eb067f1c56f82e4b7eb296c2
SHA1

9086fbe30ac950d90b8e51a7c2b307b29fc4677e
SHA256

53eafeee2c494c3418d47a25664a414619885cc92447a735657b2ceedad71cde
SHA512

b01e01a4bddd21a8dac6c10145f7be30a2d31e12c809d6d83f9a7becfa350e708b8f563388fb3354f63e84a776f95f4d87a99e1bf54e154d0137c35120cef623
SSDEEP

24576:SFolOZ7iw5WwfHH3vwLwh0RV9Z0OEdMdWz52kqAaBJP8fnLJ518VCqoI2ytHE:SFolOZ7iw5WwfHH3vwLwCuDHAHE

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 868 wrote to memory of 1704	868	cmd.exe	isoburn.exe
PID 868 wrote to memory of 1704	868	cmd.exe	isoburn.exe
PID 868 wrote to memory of 1704	868	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\TS-795WP.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:868

C:\Windows\System32\isoburn.exe
"C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\TS-795WP.iso"
2⤵
PID:1704

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/868-54-0x000007FEFC461000-0x000007FEFC463000-memory.dmp

Filesize
8KB

Download
memory/1704-76-0x0000000000000000-mapping.dmp

Download