Analysis
-
max time kernel
137s -
max time network
139s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
15-09-2021 07:21
Static task
static1
Behavioral task
behavioral1
Sample
SOA.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
SOA.exe
Resource
win10-en
General
-
Target
SOA.exe
-
Size
698KB
-
MD5
60ce0b8fc55a6060f5e01c9f8e179e2b
-
SHA1
ba86a7924b9bb84bfd34308f24bb2df9e720ba28
-
SHA256
0224ddb170df9a27dda9f0ffc95269230d3b7512fa8765c76eb3f571d1647a3b
-
SHA512
88ef2f5b92f8c4b1e378bff84a5920191e3d1666faea9f9e1a13db8ef2cc4cd568276bc0b5e1ac60d5d03ca21eb8089d9f4fd72f0b9facb36113a7759f256af1
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
SOA.exepid process 1652 SOA.exe 1652 SOA.exe 1652 SOA.exe 1652 SOA.exe 1652 SOA.exe 1652 SOA.exe 1652 SOA.exe 1652 SOA.exe 1652 SOA.exe 1652 SOA.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SOA.exedescription pid process Token: SeDebugPrivilege 1652 SOA.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
SOA.exedescription pid process target process PID 1652 wrote to memory of 464 1652 SOA.exe schtasks.exe PID 1652 wrote to memory of 464 1652 SOA.exe schtasks.exe PID 1652 wrote to memory of 464 1652 SOA.exe schtasks.exe PID 1652 wrote to memory of 464 1652 SOA.exe schtasks.exe PID 1652 wrote to memory of 736 1652 SOA.exe SOA.exe PID 1652 wrote to memory of 736 1652 SOA.exe SOA.exe PID 1652 wrote to memory of 736 1652 SOA.exe SOA.exe PID 1652 wrote to memory of 736 1652 SOA.exe SOA.exe PID 1652 wrote to memory of 1700 1652 SOA.exe SOA.exe PID 1652 wrote to memory of 1700 1652 SOA.exe SOA.exe PID 1652 wrote to memory of 1700 1652 SOA.exe SOA.exe PID 1652 wrote to memory of 1700 1652 SOA.exe SOA.exe PID 1652 wrote to memory of 1476 1652 SOA.exe SOA.exe PID 1652 wrote to memory of 1476 1652 SOA.exe SOA.exe PID 1652 wrote to memory of 1476 1652 SOA.exe SOA.exe PID 1652 wrote to memory of 1476 1652 SOA.exe SOA.exe PID 1652 wrote to memory of 1104 1652 SOA.exe SOA.exe PID 1652 wrote to memory of 1104 1652 SOA.exe SOA.exe PID 1652 wrote to memory of 1104 1652 SOA.exe SOA.exe PID 1652 wrote to memory of 1104 1652 SOA.exe SOA.exe PID 1652 wrote to memory of 556 1652 SOA.exe SOA.exe PID 1652 wrote to memory of 556 1652 SOA.exe SOA.exe PID 1652 wrote to memory of 556 1652 SOA.exe SOA.exe PID 1652 wrote to memory of 556 1652 SOA.exe SOA.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"C:\Users\Admin\AppData\Local\Temp\SOA.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eRApFxQbJlLn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp14A9.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp14A9.tmpMD5
1196b598062c74023eaa7c247f6096b9
SHA1e54111452210c2432f51c93d055cb5dd9b5b7cf4
SHA2564a44ff19054356e34b201a198c8861660cba9d4f74ec508c5d851d823948a69a
SHA512f18729b022f3f3a89140300942e826f12cc76f6b67c0ea5c170fd76f9248364ce22ae4521b87d3169ec242a0bca6eee6f810c981797aa76e5f059e4070d6cb4b
-
memory/464-66-0x0000000000000000-mapping.dmp
-
memory/1652-60-0x0000000001140000-0x0000000001141000-memory.dmpFilesize
4KB
-
memory/1652-62-0x0000000004D90000-0x0000000004D91000-memory.dmpFilesize
4KB
-
memory/1652-63-0x0000000000220000-0x000000000022E000-memory.dmpFilesize
56KB
-
memory/1652-64-0x0000000004CC0000-0x0000000004D20000-memory.dmpFilesize
384KB
-
memory/1652-65-0x00000000004C0000-0x00000000004CC000-memory.dmpFilesize
48KB