Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-10-2024 16:03
Static task
static1
Behavioral task
behavioral1
Sample
5d4a99440308479e4b97797fc6518240e1617df62bb938d3f735026931d7bed3.iso
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5d4a99440308479e4b97797fc6518240e1617df62bb938d3f735026931d7bed3.iso
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
out.iso
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
out.iso
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
9236-pagaconferma-jpg.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
9236-pagaconferma-jpg.exe
Resource
win10v2004-20241007-en
General
-
Target
5d4a99440308479e4b97797fc6518240e1617df62bb938d3f735026931d7bed3.iso
-
Size
1.6MB
-
MD5
213a8ce5aaa962f33a78f6053f6956ba
-
SHA1
339df70ab6152e4b20d81d4180943fc6fcb1f752
-
SHA256
5d4a99440308479e4b97797fc6518240e1617df62bb938d3f735026931d7bed3
-
SHA512
206b9ffea2e80b822f9d1f5cbc3963382416d8a0d681ac157eb2647e6f48c816e59469037c1c30ecec96beee14e366de367fcb6aa46a7a132a39ee06d6e89935
-
SSDEEP
24576:3fmMv6Ckr7Mny5QLMwDMZE4mqu6p0DWsRmic2V993wZC:33v+7/5QLMLE2hq93w
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
isoburn.exepid process 1692 isoburn.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 1292 wrote to memory of 1692 1292 cmd.exe isoburn.exe PID 1292 wrote to memory of 1692 1292 cmd.exe isoburn.exe PID 1292 wrote to memory of 1692 1292 cmd.exe isoburn.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\5d4a99440308479e4b97797fc6518240e1617df62bb938d3f735026931d7bed3.iso1⤵
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\System32\isoburn.exe"C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\5d4a99440308479e4b97797fc6518240e1617df62bb938d3f735026931d7bed3.iso"2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1692
-