1d9ccaade14075591b76fa1779ea19ed9a378fd1bcb5f0e0030761755d81192d

Analysis

max time kernel
93s
max time network
82s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
15-12-2022 09:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

REPORT_FK8967.iso
Size

1008KB
MD5

f20b7ee8a281ca05bc69ee3e09406fad
SHA1

6b0f95285b4fcadb79070a1284d556eaaa8b18fa
SHA256

1d9ccaade14075591b76fa1779ea19ed9a378fd1bcb5f0e0030761755d81192d
SHA512

c09c17374ac10214cd3c7845e03ecf82cdf93c0a893c05397743757055702d2553b02f0055f3c698a0a77059cc49c4606c00018f9d82b827d6091c5163cc0dd5
SSDEEP

12288:/zQBoi6HYjAe3buwdRBS8yvi2K9MVou1z:/coi6HJe3bu8Bby6rqoqz

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1424	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1424	AUDIODG.EXE
Token: 33	1424	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1424	AUDIODG.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2008 wrote to memory of 368	2008	cmd.exe	isoburn.exe
PID 2008 wrote to memory of 368	2008	cmd.exe	isoburn.exe
PID 2008 wrote to memory of 368	2008	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\REPORT_FK8967.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\System32\isoburn.exe
"C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\REPORT_FK8967.iso"
2⤵
PID:368

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1780

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x140
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1424

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/368-76-0x0000000000000000-mapping.dmp

Download
memory/2008-54-0x000007FEFB7B1000-0x000007FEFB7B3000-memory.dmp

Filesize
8KB

Download