57c4bdf0a644df4fd39f3d73d4570e6c88d8b7239ab4a395dba441ab15a5024f

Analysis

max time kernel
134s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24/03/2023, 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57c4bdf0a644df4fd39f3d73d4570e6c88d8b7239ab4a395dba441ab15a5024f.img
Size

3.1MB
MD5

95ca84ee56bade777c6e867a1f6cd78a
SHA1

36bd693fa90b0438d6366414a202fcc9eb894c87
SHA256

57c4bdf0a644df4fd39f3d73d4570e6c88d8b7239ab4a395dba441ab15a5024f
SHA512

77b43ba26bb7fe5400e5d09b5cbead93c547eed677b5dc7968f49413c79335fefbe969ec942719b15ea273726618834456916b0742c4fe23c0961fae8483199f
SSDEEP

98304:G+Yu/ZTjLHS3bmdeQbzWIu78ph13l3bD+/RtAy1PFL:G+fZTny3bOXbzpUQVbyJb1NL

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1596	isoburn.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 1596	1236	cmd.exe	27
PID 1236 wrote to memory of 1596	1236	cmd.exe	27
PID 1236 wrote to memory of 1596	1236	cmd.exe	27

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\57c4bdf0a644df4fd39f3d73d4570e6c88d8b7239ab4a395dba441ab15a5024f.img
1⤵
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\57c4bdf0a644df4fd39f3d73d4570e6c88d8b7239ab4a395dba441ab15a5024f.img"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1596

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1596-78-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download