bf3109a0922dcd5056882daef2280391c8d8f7a84bbc983e0eedde486c542906

Resubmissions

16/05/2023, 21:11

230516-z12jwscf46 10

16/05/2023, 21:11

230516-z1kw5scf45 3

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16/05/2023, 21:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e1fe72df804272ec2938d6a56a454ae5b6466a5c15131be5ded03b88563a7c9.iso
Size

320KB
MD5

b4e51be87029e822bf6e3b463da29d79
SHA1

081171482c1ecd673ab9918b301bf22ad6c0697d
SHA256

5e1fe72df804272ec2938d6a56a454ae5b6466a5c15131be5ded03b88563a7c9
SHA512

3ad86860f409281c3f647dd5aa5e2903d3d458a1451f13796cff826630d0e8f5b218fe36e6521ed498d21491f8c0c1be2fcf5e1ef78daf56e72e2c02a6f02b77
SSDEEP

6144:FelDePKKBOgB5lvI0gbiM/BkCV3xVN/qPJt9Bo15qtwNn4:EAPTOgAuMpV3dg04w

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 468	1376	cmd.exe	29
PID 1376 wrote to memory of 468	1376	cmd.exe	29
PID 1376 wrote to memory of 468	1376	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\5e1fe72df804272ec2938d6a56a454ae5b6466a5c15131be5ded03b88563a7c9.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\5e1fe72df804272ec2938d6a56a454ae5b6466a5c15131be5ded03b88563a7c9.iso"
  2⤵
  PID:468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/468-78-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download