Analysis
-
max time kernel
133s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
17-11-2022 21:26
Static task
static1
Behavioral task
behavioral1
Sample
ZF57.iso
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ZF57.iso
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
WW.js
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
WW.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
animators/surpluses.dll
Resource
win7-20221111-en
General
-
Target
ZF57.iso
-
Size
970KB
-
MD5
97c68838983f4c3281b64a90b556d4a8
-
SHA1
c53d68744aca857499be1d18e88d7264fe80f610
-
SHA256
03666aa634cab42b5f474d0bae5d5002f200caea398e2a5522fb495656be86e3
-
SHA512
45af7b30d8691a88cc42f7edeb106735dc17ffd32833f9fcf806fc7d740d80bdc3c5da0b61b7f45ba6b4e4b8ac2cdee83a44a1b475f6a5f14e2c5735fc78d562
-
SSDEEP
12288:Ko0KwnONVvoo6F+DfZxL4+Dir8lkQ5z4hb9mKFX4GfOs5VBNYRbWAUWWvoYPiwBP:Ko0Kw9o6F+DRt4Tr8lkBhRp2QOU
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
isoburn.exepid process 584 isoburn.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 1368 wrote to memory of 584 1368 cmd.exe isoburn.exe PID 1368 wrote to memory of 584 1368 cmd.exe isoburn.exe PID 1368 wrote to memory of 584 1368 cmd.exe isoburn.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ZF57.iso1⤵
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\System32\isoburn.exe"C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\ZF57.iso"2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:584