Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11-12-2022 23:18
Static task
static1
Behavioral task
behavioral1
Sample
Outstanding SOA.exe
Resource
win7-20220812-en
General
-
Target
Outstanding SOA.exe
-
Size
339KB
-
MD5
301addb86ca3c942e69305684bf5c91f
-
SHA1
5ba7b078b5c4f83582f4b5fab738d2bc40b3caac
-
SHA256
2c57f3f9227d165321ad3ec29060b58358f3e95968cc1b4b6eff7eb978a993d1
-
SHA512
119d0d4a47a7dc8a2c6e823a706c5c93c6a3b746d6ac97f4fc1889133b42ac8bb191386bf71c3a299d92b63d87a24031c7a3aa339b7e18f67fe571d723e2dd4b
-
SSDEEP
6144:9kw5Ozbc0itHVpknYIuGGzQe+rnqLG529GmuVyvp0csCAFSuH:toyBMnYYHHb29BuVyvqh1
Malware Config
Extracted
formbook
scse
SKpYFyVNT2zunKf0uuM=
FlEHUseI7I5XbrO8fR/XBcS9ZA==
FPuxoUOxkLiATugw
VKdxsDSk0jdT5Kw=
FpqHf9iI/1tl97E=
YGI6sIl3UIxfZvlD+JiUuuLR
oBAEO0suBEAD5aK00A==
RKJqTzg4gQ/Q6DYSuTjDGkwuyl0ik5Kb8w==
VFg9s3W0/Ype8A3cZb+D7g==
hwD+VNd6014nrsaTWm4FBcS9ZA==
zkAdUq1soKYUfZaTqLmL
XVQ9WbRivUIQ477a/hKv+g==
QireF2geizAwmp674AGc5g==
PSTUQxs6j8OATugw
LHJhyy2VbX8NEqf0uuM=
MiY1vg6T3HqATugw
wqkUjaVXnGgBqA==
jUr/eUtSIT01Wegt
PjQidcqKzAbSZICUZb+D7g==
OkAmcv12sUEAIHwFHakzdIo2FPHw
zyDLsw+3I3H6gnaGZb+D7g==
ll0HRs5IJGxCZMJPahHgOt2RqjU=
YqaIEokHuw6V
jGJG11YCObJ+IQIXCW8KU+ZcbA==
jv4ITr8zITdT5Kw=
nXYro3yHe5YV5aK00A==
rJt1IPkxeQDUayhVCJyUuuLR
oFwz1DUU/RdD5aK00A==
FHlVTKEVIRFE5aK00A==
8GhjL2lJOWD+5aK00A==
k3BLouunGsagwhAi6oeUuuLR
p45GiQN5bZMjR9karDwDa442FPHw
Zdd7rVCKu/b3TIVU6t/lP92RqjU=
wyjxGjYHuw6V
nW5RrwV6yTdT5Kw=
itzGDGclWW4SqnLBSWH5Pt2RqjU=
8zwgceJYRWn+DKf0uuM=
EmojFmj027tsHrs=
ExQEPY5UyyS00HPvNNCH8w==
laiGCZRTkbg/XAl/Zb+D7g==
wYQysWBl+DdT5Kw=
MWo3rYV3XoAJ5aK00A==
hnht0SrcDR+XpjV6H6WUuuLR
rxqw6S7qG8A=
aEcfph/RAUAcfZYnXOw=
EXdVkuuzJ8eEjkTROs2D
MDYsc8l6w0wM7ZOiyQ==
Rw3XPwT+8UID5aK00A==
zDPp+Pskft/5iqS+0Q==
Z8h8hYCm/ULHXQ+YY2kJBcS9ZA==
vTDkm31vabx5EfoFMjLsVpBlz+fQfg==
+EcrRpZyp7tFba65dhvXBcS9ZA==
rHVJpwl6dLSATugw
gUoTghFSoTMpiXyQe9N3uOjQ
47Zwn/CkFQCty07ROs2D
NYkP+jcHuw6V
nfvdFnkHuw6V
L4piRRhAmfwGKITjemhRkmQ=
s6Jdx36Q+t5U7LE=
58iYH6dVmzYCnHZ/Zb+D7g==
IQ/WHZJWuVUD5aK00A==
Cf6t72PUxhnicjvBiFxqP0o2FPHw
DQr7l4R4rlEJ5aK00A==
62gezKeQv8mIIBbcZb+D7g==
kmuregister.com
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
ppazwvktk.exeppazwvktk.exepid process 2036 ppazwvktk.exe 1760 ppazwvktk.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ppazwvktk.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\Geo\Nation ppazwvktk.exe -
Loads dropped DLL 3 IoCs
Processes:
Outstanding SOA.exeppazwvktk.exewlanext.exepid process 1972 Outstanding SOA.exe 2036 ppazwvktk.exe 1552 wlanext.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ppazwvktk.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\cdrflgclwhpn = "C:\\Users\\Admin\\AppData\\Roaming\\fgxpgpv\\asoodm.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\ppazwvktk.exe\" C:\\Users\\Admin\\AppData\\Local\\T" ppazwvktk.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
ppazwvktk.exeppazwvktk.exewlanext.exedescription pid process target process PID 2036 set thread context of 1760 2036 ppazwvktk.exe ppazwvktk.exe PID 1760 set thread context of 1224 1760 ppazwvktk.exe Explorer.EXE PID 1552 set thread context of 1224 1552 wlanext.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
wlanext.exedescription ioc process Key created \Registry\User\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wlanext.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
ppazwvktk.exewlanext.exepid process 1760 ppazwvktk.exe 1760 ppazwvktk.exe 1760 ppazwvktk.exe 1760 ppazwvktk.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
ppazwvktk.exeppazwvktk.exewlanext.exepid process 2036 ppazwvktk.exe 1760 ppazwvktk.exe 1760 ppazwvktk.exe 1760 ppazwvktk.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ppazwvktk.exewlanext.exedescription pid process Token: SeDebugPrivilege 1760 ppazwvktk.exe Token: SeDebugPrivilege 1552 wlanext.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1224 Explorer.EXE 1224 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1224 Explorer.EXE 1224 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Outstanding SOA.exeppazwvktk.exeExplorer.EXEwlanext.exedescription pid process target process PID 1972 wrote to memory of 2036 1972 Outstanding SOA.exe ppazwvktk.exe PID 1972 wrote to memory of 2036 1972 Outstanding SOA.exe ppazwvktk.exe PID 1972 wrote to memory of 2036 1972 Outstanding SOA.exe ppazwvktk.exe PID 1972 wrote to memory of 2036 1972 Outstanding SOA.exe ppazwvktk.exe PID 2036 wrote to memory of 1760 2036 ppazwvktk.exe ppazwvktk.exe PID 2036 wrote to memory of 1760 2036 ppazwvktk.exe ppazwvktk.exe PID 2036 wrote to memory of 1760 2036 ppazwvktk.exe ppazwvktk.exe PID 2036 wrote to memory of 1760 2036 ppazwvktk.exe ppazwvktk.exe PID 2036 wrote to memory of 1760 2036 ppazwvktk.exe ppazwvktk.exe PID 1224 wrote to memory of 1552 1224 Explorer.EXE wlanext.exe PID 1224 wrote to memory of 1552 1224 Explorer.EXE wlanext.exe PID 1224 wrote to memory of 1552 1224 Explorer.EXE wlanext.exe PID 1224 wrote to memory of 1552 1224 Explorer.EXE wlanext.exe PID 1552 wrote to memory of 1916 1552 wlanext.exe Firefox.exe PID 1552 wrote to memory of 1916 1552 wlanext.exe Firefox.exe PID 1552 wrote to memory of 1916 1552 wlanext.exe Firefox.exe PID 1552 wrote to memory of 1916 1552 wlanext.exe Firefox.exe PID 1552 wrote to memory of 1916 1552 wlanext.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Outstanding SOA.exe"C:\Users\Admin\AppData\Local\Temp\Outstanding SOA.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ppazwvktk.exe"C:\Users\Admin\AppData\Local\Temp\ppazwvktk.exe" C:\Users\Admin\AppData\Local\Temp\obqdpfez.a3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ppazwvktk.exe"C:\Users\Admin\AppData\Local\Temp\ppazwvktk.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\kzgjp.xFilesize
184KB
MD58dbfce39af68b4c311134f002508996e
SHA1668460a8bb44136f7d24f570a9adc2bd0d27656b
SHA256fe74da9985715aea87254916677100f703e576b4847654e107944bf732139569
SHA5129f5c438ebaa568387a459c9c8ea59fe02ef5a00bf12bbf07b33cc135517fdfba10b665909787dac80ccfb414a56e2d090a6b6a57a6909d2cd70fa61fc6d06070
-
C:\Users\Admin\AppData\Local\Temp\obqdpfez.aFilesize
7KB
MD50590f04fc7873d7120ea57b0af0dab5a
SHA1be9ddf0c9f53ff2b88c37edab9ad3dc4634efd7b
SHA2561d7a6baeffe98f729a96e9083cb7791e8117e149562d1e27012b325ba9b925f1
SHA512a869683ca6e435e23571c0fee8a159be75ceeb4a7ccd5ed2af4ecc67e5f74de0ad2a1970d75d7cd0ed64fcb80a66ffc3f40b8dfdfd33d60c6a4055adb8ddf8be
-
C:\Users\Admin\AppData\Local\Temp\ppazwvktk.exeFilesize
287KB
MD54af2243388a71be98ce2a842a838824f
SHA169c6f37edad4cbf6fbdfb69065116df7eb6376f5
SHA2562e4ea3195fa6578337b9e2322e22c8066af4a32e18b8c11d69f6c53c084e5f64
SHA5129a9e99f3674f8aba1228f964ba5793e7149b0bf2914404a1f9f9c5e7813b43217b1f90e144596d6da386bfe73a6af2760ab7422392a558daba8f88ae973a8234
-
C:\Users\Admin\AppData\Local\Temp\ppazwvktk.exeFilesize
287KB
MD54af2243388a71be98ce2a842a838824f
SHA169c6f37edad4cbf6fbdfb69065116df7eb6376f5
SHA2562e4ea3195fa6578337b9e2322e22c8066af4a32e18b8c11d69f6c53c084e5f64
SHA5129a9e99f3674f8aba1228f964ba5793e7149b0bf2914404a1f9f9c5e7813b43217b1f90e144596d6da386bfe73a6af2760ab7422392a558daba8f88ae973a8234
-
C:\Users\Admin\AppData\Local\Temp\ppazwvktk.exeFilesize
287KB
MD54af2243388a71be98ce2a842a838824f
SHA169c6f37edad4cbf6fbdfb69065116df7eb6376f5
SHA2562e4ea3195fa6578337b9e2322e22c8066af4a32e18b8c11d69f6c53c084e5f64
SHA5129a9e99f3674f8aba1228f964ba5793e7149b0bf2914404a1f9f9c5e7813b43217b1f90e144596d6da386bfe73a6af2760ab7422392a558daba8f88ae973a8234
-
\Users\Admin\AppData\Local\Temp\ppazwvktk.exeFilesize
287KB
MD54af2243388a71be98ce2a842a838824f
SHA169c6f37edad4cbf6fbdfb69065116df7eb6376f5
SHA2562e4ea3195fa6578337b9e2322e22c8066af4a32e18b8c11d69f6c53c084e5f64
SHA5129a9e99f3674f8aba1228f964ba5793e7149b0bf2914404a1f9f9c5e7813b43217b1f90e144596d6da386bfe73a6af2760ab7422392a558daba8f88ae973a8234
-
\Users\Admin\AppData\Local\Temp\ppazwvktk.exeFilesize
287KB
MD54af2243388a71be98ce2a842a838824f
SHA169c6f37edad4cbf6fbdfb69065116df7eb6376f5
SHA2562e4ea3195fa6578337b9e2322e22c8066af4a32e18b8c11d69f6c53c084e5f64
SHA5129a9e99f3674f8aba1228f964ba5793e7149b0bf2914404a1f9f9c5e7813b43217b1f90e144596d6da386bfe73a6af2760ab7422392a558daba8f88ae973a8234
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
841KB
MD55fc6cd5d5ca1489d2a3c361717359a95
SHA15c630e232cd5761e7a611e41515be4afa3e7a141
SHA25685c8b8a648c56cf5f063912e0e26ecebb90e0caf2f442fd5cdd8287301fe7e81
SHA5125f9124a721f6b463d4f980920e87925098aa753b0fa2a59a3ff48b48d2b1a45d760fd46445414d84fb66321181cd2c82a4194361811114c15e35b42f838ab792
-
memory/1224-70-0x0000000003B70000-0x0000000003C3F000-memory.dmpFilesize
828KB
-
memory/1224-79-0x0000000006270000-0x00000000063CD000-memory.dmpFilesize
1.4MB
-
memory/1224-76-0x0000000006270000-0x00000000063CD000-memory.dmpFilesize
1.4MB
-
memory/1552-72-0x00000000004D0000-0x00000000004E6000-memory.dmpFilesize
88KB
-
memory/1552-73-0x00000000000E0000-0x000000000010D000-memory.dmpFilesize
180KB
-
memory/1552-77-0x00000000000E0000-0x000000000010D000-memory.dmpFilesize
180KB
-
memory/1552-75-0x0000000001CA0000-0x0000000001D2F000-memory.dmpFilesize
572KB
-
memory/1552-74-0x0000000001EE0000-0x00000000021E3000-memory.dmpFilesize
3.0MB
-
memory/1552-71-0x0000000000000000-mapping.dmp
-
memory/1760-65-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1760-66-0x0000000000401000-0x000000000042E000-memory.dmpFilesize
180KB
-
memory/1760-69-0x0000000000160000-0x0000000000170000-memory.dmpFilesize
64KB
-
memory/1760-67-0x0000000000A00000-0x0000000000D03000-memory.dmpFilesize
3.0MB
-
memory/1760-68-0x0000000000422000-0x0000000000424000-memory.dmpFilesize
8KB
-
memory/1760-63-0x00000000004012B0-mapping.dmp
-
memory/1972-54-0x0000000075501000-0x0000000075503000-memory.dmpFilesize
8KB
-
memory/2036-56-0x0000000000000000-mapping.dmp