Analysis
-
max time kernel
127s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
18-11-2022 02:01
Static task
static1
Behavioral task
behavioral1
Sample
EU39.iso
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
EU39.iso
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
WW.js
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
WW.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
animators/toothsomeness.dll
Resource
win7-20221111-en
General
-
Target
EU39.iso
-
Size
970KB
-
MD5
61785c9b1a2451a094e3064d032f01cb
-
SHA1
39bbaf1ef1c7f9778257ff7c789dcbe5484459e1
-
SHA256
d8f43f9f8ee2a8ef0d826c65fb03a00618c447c1c25c1715ec5bde17544936d2
-
SHA512
f4ff56f4138ecf4101e0509d93529f2f33f595fd0f7a83ff1fd68932be33f24896057a1e2d8b0394041b7fe74e47cf5cc68b04b39e6481cca2031dcb6c11d5e7
-
SSDEEP
12288:KoEKwnONVvoo6F+DfZxL4+Dir8lkQ5z4hb0mKFX4GfOs5VBNYRbWAUWWvoYPiwBP:KoEKw9o6F+DRt4Tr8lkBhQp2QOU
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
isoburn.exepid process 268 isoburn.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 1236 wrote to memory of 268 1236 cmd.exe isoburn.exe PID 1236 wrote to memory of 268 1236 cmd.exe isoburn.exe PID 1236 wrote to memory of 268 1236 cmd.exe isoburn.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\EU39.iso1⤵
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\System32\isoburn.exe"C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\EU39.iso"2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:268