0fb7388c69ef9d2d892e6edc7eff8c86ce6f6659c88d347234acaa1a382e22ba

Resubmissions

14/02/2024, 19:05

240214-xrvzmsae3z 3

14/02/2024, 18:56

240214-xlmfbabb46 10

Analysis

max time kernel
39s
max time network
19s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 19:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db7cd6d0f75ddf78e0e6e09119d9071df07b50ef3f5289d474921adba4f35047.iso
Size

2.1MB
MD5

bdd4128c92d89cccfc0ac99c04a2a7bd
SHA1

8a10896b54bc29bebd08e791a9c9de294c01913a
SHA256

db7cd6d0f75ddf78e0e6e09119d9071df07b50ef3f5289d474921adba4f35047
SHA512

390c9810a6aa3f0c387ef4a20d463c69db0e689b6a2226846a5ca4d66a4759d7ad14551a844589d1df4a9b8e1f10eaf28953005b687b5c20911a36b4e4238073
SSDEEP

12288:UiHw0sbzwD4FwpH5qCwfwM+A5n5RwUwjwEQwJw+wXcdwnTwuwJwxewGw90wHwMwk:UV

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2728	2340	cmd.exe	29
PID 2340 wrote to memory of 2728	2340	cmd.exe	29
PID 2340 wrote to memory of 2728	2340	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\db7cd6d0f75ddf78e0e6e09119d9071df07b50ef3f5289d474921adba4f35047.iso
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\db7cd6d0f75ddf78e0e6e09119d9071df07b50ef3f5289d474921adba4f35047.iso"
  2⤵
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2728-24-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download