2ccadf97d8ed69f4aeadda65e580d68467e3b181ab3ba85915e32ed426b2dc6d

Resubmissions

12/03/2025, 21:39

250312-1h3vnstydt 10

12/03/2025, 21:38

250312-1hdksavry9 3

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/03/2025, 21:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lossless scaling.iso
Size

14.4MB
MD5

9528ada20da44cf763e8d2e850988011
SHA1

2fcaaaeec83c3cbc12e9f12c28627ad11a692b27
SHA256

62e1a2439b9ff7e2b18a7b8e6d38e202b8fc1dfdeb4b305b4fc1a92b2a806462
SHA512

06490af2b9b388bd0e90a9d9f0b4b9854ddccc425256d6610ba3752eb092b9fe5b40a21ab57f6e73d916596f0c083c09ec39ab47b64d0d956e686202238f4682
SSDEEP

98304:E3owyIxQNfbs8jsGBVdR5vZjUV+XXoYUZdIxQN3bs8jsGBVdR5vZjUV+XXoYUZ:E9QNjs8j9B3v1FXXPQNLs8j9B3v1FXX

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2744	isoburn.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2744	2220	cmd.exe	31
PID 2220 wrote to memory of 2744	2220	cmd.exe	31
PID 2220 wrote to memory of 2744	2220	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\lossless scaling.iso"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\System32\isoburn.exe
  "C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\lossless scaling.iso"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2744-24-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download