Overview

overview

10

Static

static

SOA & UNPA...df.exe

windows7_x64

3

SOA & UNPA...df.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    61s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21-05-2022 06:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SOA & UNPAID INVOICES.pdf.exe

  • Size

    670KB

  • MD5

    b6e3ea3ca41fadf4b2d8e8c4547bbb3b

  • SHA1

    dbd634b213e1dba07b9d3cb4b880d2db158818f7

  • SHA256

    a9e823696e9c25dda75eae39878e430238e78b379bb51a0658d8fd93bd2c604d

  • SHA512

    ecc6d1b83eada0530986c3357a56b51253686bc3db150601daf8cca0dce4db0349a4ec75bb702c808aee2c5618bdb120d8ba249b20fa9426d6983f7d4516fa29

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SOA & UNPAID INVOICES.pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\SOA & UNPAID INVOICES.pdf.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:548
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TsWISurTqG.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1420
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TsWISurTqG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDC0E.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1684
    • C:\Users\Admin\AppData\Local\Temp\SOA & UNPAID INVOICES.pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\SOA & UNPAID INVOICES.pdf.exe"
      2⤵
        PID:304
      • C:\Users\Admin\AppData\Local\Temp\SOA & UNPAID INVOICES.pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\SOA & UNPAID INVOICES.pdf.exe"
        2⤵
          PID:1092
        • C:\Users\Admin\AppData\Local\Temp\SOA & UNPAID INVOICES.pdf.exe
          "C:\Users\Admin\AppData\Local\Temp\SOA & UNPAID INVOICES.pdf.exe"
          2⤵
            PID:1560
          • C:\Users\Admin\AppData\Local\Temp\SOA & UNPAID INVOICES.pdf.exe
            "C:\Users\Admin\AppData\Local\Temp\SOA & UNPAID INVOICES.pdf.exe"
            2⤵
              PID:588
            • C:\Users\Admin\AppData\Local\Temp\SOA & UNPAID INVOICES.pdf.exe
              "C:\Users\Admin\AppData\Local\Temp\SOA & UNPAID INVOICES.pdf.exe"
              2⤵
                PID:1592

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmpDC0E.tmp
              Filesize

              1KB

              MD5

              653ad5debc4a760dbd34f987ed9b9a86

              SHA1

              9bb67c9c6638d22e5c59b153f797d36465dd8cde

              SHA256

              9c0823e1efef9a600fe1fff08bf6802d9a52d8bc2130f35e4a2b67b11618fc86

              SHA512

              8613af6d67ecc859bc0cc3ad5fbba71c3b3cb5813b7aa77e921542e34ad062ba2883ecbf3caa46472146e7cb0246477b12cf8af7646513c7f2c128b3d8e0fcd3

              Download Submit
            • memory/548-54-0x00000000001C0000-0x000000000026E000-memory.dmp
              Filesize

              696KB

              Download
            • memory/548-55-0x0000000076181000-0x0000000076183000-memory.dmp
              Filesize

              8KB

              Download
            • memory/548-56-0x0000000000580000-0x000000000058A000-memory.dmp
              Filesize

              40KB

              Download
            • memory/548-57-0x0000000005F50000-0x0000000005FD4000-memory.dmp
              Filesize

              528KB

              Download
            • memory/548-62-0x0000000004D20000-0x0000000004D48000-memory.dmp
              Filesize

              160KB

              Download
            • memory/1420-58-0x0000000000000000-mapping.dmp
              Download
            • memory/1420-63-0x0000000074C30000-0x00000000751DB000-memory.dmp
              Filesize

              5.7MB

              Download
            • memory/1684-59-0x0000000000000000-mapping.dmp
              Download