68f7bba728553d869045023be6b80b5ac87e32b761ec5e754844e220ebcafeb3

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

recovery.img
Size

8.6MB
MD5

aa9c573f2597c07216862a652718d320
SHA1

ffc33284badbdfb7eaf75206d9f3e1b1785ba328
SHA256

88efe1f7b540aead74555378ea1468d744a6f1db2671621008376b431519d55b
SHA512

5839a075e2dec45d001a67b519263db56a89a2b9af91af4806eb7673abb7fb5b4e1ae3e713ed504bdb0d0905e844b85477b9265be2567e5e3070d8b75d1425c7
SSDEEP

196608:iuDGk6OIWQvtQmg+coezOQreZzfinkRZbi6f5TbSGxo:iROIW8tQmJ7ZzfGa2K2+o

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2680	isoburn.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2680	2244	cmd.exe	29
PID 2244 wrote to memory of 2680	2244	cmd.exe	29
PID 2244 wrote to memory of 2680	2244	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\recovery.img
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\recovery.img"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2680-24-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download