111b27216b69c27153a8725cc843e581289c4c61478bc5ab63018cbbcb0d1b30

Analysis

max time kernel
47s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
10-01-2023 21:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

request_01-10_INV-105.iso
Size

1.7MB
MD5

362c61979941457573296e9dbe135206
SHA1

c668534c9855e735a355bfaa7714ef31c43de972
SHA256

b1260438723e65111dc794b3df40460093eef935c18f3a2b3fc9c6f8f1ae61c2
SHA512

f4eac1710a9fe348ae9889f4b4f0e30b2c1c37d6554201ab116b1c605a8b4403ec0f061a4498ceb3966716c6996270115aeb5703b4ef51cc5c4a530efc1682e3
SSDEEP

12288:3ZF4/8HxyNNCt+sULxQx2SWqj4PWyfEWmxa+:3k/CoAfULIHtZb

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 1500 wrote to memory of 1920	1500	cmd.exe	isoburn.exe
PID 1500 wrote to memory of 1920	1500	cmd.exe	isoburn.exe
PID 1500 wrote to memory of 1920	1500	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\request_01-10_INV-105.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\System32\isoburn.exe
"C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\request_01-10_INV-105.iso"
2⤵
PID:1920

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1500-54-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

Filesize
8KB

Download
memory/1920-76-0x0000000000000000-mapping.dmp

Download