08694095beeaca20a7868cf9d157043ce171f69b0153eacf3a4effc9a6da24ad

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-10-2024 09:52

Target

Pirkuma pasūtījums_(PO980043)_CNC Baltic.iso
Size

700KB
MD5

0c70f564396d55d8c3da4276c80f724f
SHA1

ae3cb5864c5bea73564cad83aa35fc593641ac6d
SHA256

08694095beeaca20a7868cf9d157043ce171f69b0153eacf3a4effc9a6da24ad
SHA512

983fed1ff80313b9d5bb7fb2f0dc026899a4aa9c414a3545bb9b6880f95524d0791a644de4696955e39dfcf07179acafc25d253a6034f19a429b818f878ffa27
SSDEEP

12288:VKry2/qZXzmowxht2fxyIL1COZLv4wkZzE96Ghz1X0aiyIWA1X1:Ury2uXzmH92fxjJCOvxsA96+a4A51

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

isoburn.exe

pid process

3024 isoburn.exe

pid	process
3024	isoburn.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2096 wrote to memory of 3024	2096	cmd.exe	isoburn.exe
PID 2096 wrote to memory of 3024	2096	cmd.exe	isoburn.exe
PID 2096 wrote to memory of 3024	2096	cmd.exe	isoburn.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Pirkuma pasūtījums_(PO980043)_CNC Baltic.iso"
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\Pirkuma pasūtījums_(PO980043)_CNC Baltic.iso"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3024

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/3024-24-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download