Overview
overview
10Static
static
document_0...id.iso
windows7-x64
3document_0...id.iso
windows10-2004-x64
3document.lnk
windows7-x64
3document.lnk
windows10-2004-x64
3scabs/func...ive.js
windows7-x64
3scabs/func...ive.js
windows10-2004-x64
1scabs/roars.jpg
windows7-x64
3scabs/roars.jpg
windows10-2004-x64
3scabs/scaf...ty.cmd
windows7-x64
1scabs/scaf...ty.cmd
windows10-2004-x64
1scabs/unsecretive.dll
windows7-x64
10scabs/unsecretive.dll
windows10-2004-x64
10scabs/z.txt
windows7-x64
1scabs/z.txt
windows10-2004-x64
1Analysis
-
max time kernel
37s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-09-2022 23:04
Static task
static1
Behavioral task
behavioral1
Sample
document_09-22_invoice_2567_unpaid.iso
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
document_09-22_invoice_2567_unpaid.iso
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
document.lnk
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
document.lnk
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
scabs/functioningReceptive.js
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
scabs/functioningReceptive.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
scabs/roars.jpg
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
scabs/roars.jpg
Resource
win10v2004-20220901-en
Behavioral task
behavioral9
Sample
scabs/scaffoldFelicity.cmd
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
scabs/scaffoldFelicity.cmd
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
scabs/unsecretive.dll
Resource
win7-20220901-en
Behavioral task
behavioral12
Sample
scabs/unsecretive.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
scabs/z.txt
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
scabs/z.txt
Resource
win10v2004-20220812-en
General
-
Target
document_09-22_invoice_2567_unpaid.iso
-
Size
736KB
-
MD5
a706c6a089c4a00cb659bac30f585cf6
-
SHA1
a861e907ec2c7bd5b9c8633a723a78c6c30e5fca
-
SHA256
5b9bbb2e3bcbf2524e38b2c3b637b1485ee2205bdfd8bdfe896f7cfe9c6d041c
-
SHA512
765ebd35ddfd7ee9fb6c58f8986ac24414083ab221fd085a30cd23a5fd6e5c8509c1072f590bdcf487e32e1efde438bcf5c87defb120ddf0b3226fd3bd02db3a
-
SSDEEP
12288:HMp3j+zW2/kP7yj1kuvcU87wHOZOuAwAwFOjHgAO3qJOFHswfwYOmOhHm:spT+zW2/kPu3rQAwAwgHgtqAHswfw7Hm
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 932 wrote to memory of 1412 932 cmd.exe isoburn.exe PID 932 wrote to memory of 1412 932 cmd.exe isoburn.exe PID 932 wrote to memory of 1412 932 cmd.exe isoburn.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\document_09-22_invoice_2567_unpaid.iso1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\isoburn.exe"C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\document_09-22_invoice_2567_unpaid.iso"2⤵