7d342378872f088f50565c60369335cbe43805defdbbf6afc3ae5ebafd5eac12

General

Target

7d342378872f088f50565c60369335cbe43805defdbbf6afc3ae5ebafd5eac12.exe
Size

292KB
MD5

215cf475f1f721de263118547de068f6
SHA1

c69ac70883ff424634f38b5b92c62c77a6556e5b
SHA256

7d342378872f088f50565c60369335cbe43805defdbbf6afc3ae5ebafd5eac12
SHA512

52ee8bd44a22db428417296fcd69e642a9abdf359eddc478561060b5dab09f8edefa17c9b2e77717fa77a99b3bf38ff5132b3209b3063e358ddbb24ef325c853
SSDEEP

6144:SkXF1FOIGOLzPgIyRKksImyzJpvBsXsgsO7m:BHEOLzPgVRKksImyzDp+Zr7m

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	soovoih.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	7d342378872f088f50565c60369335cbe43805defdbbf6afc3ae5ebafd5eac12.exe

Executes dropped EXE 1 IoCs

pid	Process
3492	soovoih.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	7d342378872f088f50565c60369335cbe43805defdbbf6afc3ae5ebafd5eac12.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\soovoih = "C:\\Users\\Admin\\soovoih.exe /d"	soovoih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\soovoih = "C:\\Users\\Admin\\soovoih.exe /v"	soovoih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\soovoih = "C:\\Users\\Admin\\soovoih.exe /j"	soovoih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\soovoih = "C:\\Users\\Admin\\soovoih.exe /z"	soovoih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\soovoih = "C:\\Users\\Admin\\soovoih.exe /l"	soovoih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\soovoih = "C:\\Users\\Admin\\soovoih.exe /c"	soovoih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\soovoih = "C:\\Users\\Admin\\soovoih.exe /a"	soovoih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\soovoih = "C:\\Users\\Admin\\soovoih.exe /f"	soovoih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\soovoih = "C:\\Users\\Admin\\soovoih.exe /s"	soovoih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\soovoih = "C:\\Users\\Admin\\soovoih.exe /y"	soovoih.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run\	7d342378872f088f50565c60369335cbe43805defdbbf6afc3ae5ebafd5eac12.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\soovoih = "C:\\Users\\Admin\\soovoih.exe /i"	7d342378872f088f50565c60369335cbe43805defdbbf6afc3ae5ebafd5eac12.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run\	soovoih.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	7d342378872f088f50565c60369335cbe43805defdbbf6afc3ae5ebafd5eac12.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	7d342378872f088f50565c60369335cbe43805defdbbf6afc3ae5ebafd5eac12.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	soovoih.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	soovoih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	7d342378872f088f50565c60369335cbe43805defdbbf6afc3ae5ebafd5eac12.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders	rundll32.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4668	7d342378872f088f50565c60369335cbe43805defdbbf6afc3ae5ebafd5eac12.exe
4668	7d342378872f088f50565c60369335cbe43805defdbbf6afc3ae5ebafd5eac12.exe
3492	soovoih.exe
3492	soovoih.exe
3492	soovoih.exe
3492	soovoih.exe
3492	soovoih.exe
3492	soovoih.exe
3492	soovoih.exe
3492	soovoih.exe
3492	soovoih.exe
3492	soovoih.exe
3492	soovoih.exe
3492	soovoih.exe
3492	soovoih.exe
3492	soovoih.exe
3492	soovoih.exe
3492	soovoih.exe
3492	soovoih.exe
3492	soovoih.exe
3492	soovoih.exe
3492	soovoih.exe
3492	soovoih.exe
3492	soovoih.exe
3492	soovoih.exe
3492	soovoih.exe
3492	soovoih.exe
3492	soovoih.exe
3492	soovoih.exe
3492	soovoih.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4772	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4772	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4668	7d342378872f088f50565c60369335cbe43805defdbbf6afc3ae5ebafd5eac12.exe
3492	soovoih.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 3492	4668	7d342378872f088f50565c60369335cbe43805defdbbf6afc3ae5ebafd5eac12.exe	79
PID 4668 wrote to memory of 3492	4668	7d342378872f088f50565c60369335cbe43805defdbbf6afc3ae5ebafd5eac12.exe	79
PID 4668 wrote to memory of 3492	4668	7d342378872f088f50565c60369335cbe43805defdbbf6afc3ae5ebafd5eac12.exe	79

C:\Users\Admin\AppData\Local\Temp\7d342378872f088f50565c60369335cbe43805defdbbf6afc3ae5ebafd5eac12.exe
"C:\Users\Admin\AppData\Local\Temp\7d342378872f088f50565c60369335cbe43805defdbbf6afc3ae5ebafd5eac12.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Maps connected drives based on registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Users\Admin\soovoih.exe
  "C:\Users\Admin\soovoih.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3492

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x150 0x300
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4772

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
- Modifies registry class
PID:2704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\soovoih.exe

Filesize
292KB

MD5
215cf475f1f721de263118547de068f6

SHA1
c69ac70883ff424634f38b5b92c62c77a6556e5b

SHA256
7d342378872f088f50565c60369335cbe43805defdbbf6afc3ae5ebafd5eac12

SHA512
52ee8bd44a22db428417296fcd69e642a9abdf359eddc478561060b5dab09f8edefa17c9b2e77717fa77a99b3bf38ff5132b3209b3063e358ddbb24ef325c853

Download Submit
C:\Users\Admin\soovoih.exe

Filesize
292KB

MD5
215cf475f1f721de263118547de068f6

SHA1
c69ac70883ff424634f38b5b92c62c77a6556e5b

SHA256
7d342378872f088f50565c60369335cbe43805defdbbf6afc3ae5ebafd5eac12

SHA512
52ee8bd44a22db428417296fcd69e642a9abdf359eddc478561060b5dab09f8edefa17c9b2e77717fa77a99b3bf38ff5132b3209b3063e358ddbb24ef325c853

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads