Overview
overview
10Static
static
AFL27.iso
windows7-x64
3AFL27.iso
windows10-2004-x64
3AS.js
windows7-x64
10AS.js
windows10-2004-x64
10peseta/data.txt
windows7-x64
1peseta/data.txt
windows10-2004-x64
1peseta/flours.js
windows7-x64
3peseta/flours.js
windows10-2004-x64
7peseta/gratiae.ps1
windows7-x64
1peseta/gratiae.ps1
windows10-2004-x64
1peseta/opalescent.jpg
windows7-x64
3peseta/opalescent.jpg
windows10-2004-x64
3Analysis
-
max time kernel
45s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
20-01-2023 21:04
Static task
static1
Behavioral task
behavioral1
Sample
AFL27.iso
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
AFL27.iso
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
AS.js
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
AS.js
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
peseta/data.txt
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
peseta/data.txt
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
peseta/flours.js
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
peseta/flours.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
peseta/gratiae.ps1
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
peseta/gratiae.ps1
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
peseta/opalescent.jpg
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
peseta/opalescent.jpg
Resource
win10v2004-20221111-en
General
-
Target
AFL27.iso
-
Size
742KB
-
MD5
638f6bca78675365d31e3903b1f2756a
-
SHA1
d9dd05f79fe4a844f37e64e05b7cc4dbc091c120
-
SHA256
3da1cb0608f3709bf1331c4088fb258daf0200740b9b67afc6eec68a7f4b111a
-
SHA512
ee5e3359e745caed4bd6316dc73ccec87b7c6c2fa87721f4201af0c94879957232d0d9c5936452005f09c15f216deb2f85ba1f91a33ba7628dd42c04b3147fd4
-
SSDEEP
12288:DNym1Mcw5EO6dHvDe0P3lx5EBto8BkfzNbuTyGrC6N2c2mcsAMznGBRA4cZDgNIg:DNJMFEO6dHvDe0P335EXpUNSleQ2cYcn
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 956 wrote to memory of 1888 956 cmd.exe isoburn.exe PID 956 wrote to memory of 1888 956 cmd.exe isoburn.exe PID 956 wrote to memory of 1888 956 cmd.exe isoburn.exe