b6bdfef3e79e823946f0e9b6437d46e23144307565ce91e2a437ca1cdf468b4e

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18/07/2023, 20:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

B6BDFEF3E79E823946F0E9B6437D46E23144307565CE91E2A437CA1CDF468B4E.iso
Size

68KB
MD5

d7def9c25a02693c5890f51dd2f2e2ec
SHA1

12d2ec37991d425e21d315a3c2fa9b2f9002fbcf
SHA256

b6bdfef3e79e823946f0e9b6437d46e23144307565ce91e2a437ca1cdf468b4e
SHA512

5bde3365d14441866530e24cb7d89e14dbb14072be0974446230f6dd3ae19c5acd726ae4ed8ac387f17831277d2cac5d5da698fb2eee2078e93c918e0744063e
SSDEEP

192:kHr4D7ZVh1VsO292ZM6DLKElsAVUh8As:wuVOQGNtaV

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2844	isoburn.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2844	2232	cmd.exe	29
PID 2232 wrote to memory of 2844	2232	cmd.exe	29
PID 2232 wrote to memory of 2844	2232	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\B6BDFEF3E79E823946F0E9B6437D46E23144307565CE91E2A437CA1CDF468B4E.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\B6BDFEF3E79E823946F0E9B6437D46E23144307565CE91E2A437CA1CDF468B4E.iso"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2844-78-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download