b03d831a555a8366ac262fa9d13fde89b675803d41c57d36f07090a0cedab154

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-01-2023 10:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SOA.exe
Size

671KB
MD5

774dc51d4da8bbc4e682008bf4d61aa2
SHA1

0a12ab2bed3ce4e701e534df5c24bfef8dcc653b
SHA256

b03d831a555a8366ac262fa9d13fde89b675803d41c57d36f07090a0cedab154
SHA512

38bfce718ca25bba53e5ceb3de3c6b7c643bfdd358094ab8d0ec288415391146e029d778a43afe3edb86e4bf8d7fde2a65e3f553ee2467437f6b3de1eb3b2306
SSDEEP

12288:UF3gflcMVpRY6HxOVU9z+EHE1tKuSoNvXOTwYM0:z6MVpcUptU9A

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2040 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

SOA.exe

pid process

856 SOA.exe
856 SOA.exe
856 SOA.exe
856 SOA.exe
856 SOA.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SOA.exe

description pid process

Token: SeDebugPrivilege 856 SOA.exe

pid	process
2040	schtasks.exe

pid	process
856	SOA.exe
856	SOA.exe
856	SOA.exe
856	SOA.exe
856	SOA.exe

description	pid	process
Token: SeDebugPrivilege	856	SOA.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

SOA.exe

description	pid	process	target process
PID 856 wrote to memory of 2040	856	SOA.exe	schtasks.exe
PID 856 wrote to memory of 2040	856	SOA.exe	schtasks.exe
PID 856 wrote to memory of 2040	856	SOA.exe	schtasks.exe
PID 856 wrote to memory of 2040	856	SOA.exe	schtasks.exe
PID 856 wrote to memory of 1968	856	SOA.exe	SOA.exe
PID 856 wrote to memory of 1968	856	SOA.exe	SOA.exe
PID 856 wrote to memory of 1968	856	SOA.exe	SOA.exe
PID 856 wrote to memory of 1968	856	SOA.exe	SOA.exe
PID 856 wrote to memory of 1604	856	SOA.exe	SOA.exe
PID 856 wrote to memory of 1604	856	SOA.exe	SOA.exe
PID 856 wrote to memory of 1604	856	SOA.exe	SOA.exe
PID 856 wrote to memory of 1604	856	SOA.exe	SOA.exe
PID 856 wrote to memory of 952	856	SOA.exe	SOA.exe
PID 856 wrote to memory of 952	856	SOA.exe	SOA.exe
PID 856 wrote to memory of 952	856	SOA.exe	SOA.exe
PID 856 wrote to memory of 952	856	SOA.exe	SOA.exe
PID 856 wrote to memory of 1804	856	SOA.exe	SOA.exe
PID 856 wrote to memory of 1804	856	SOA.exe	SOA.exe
PID 856 wrote to memory of 1804	856	SOA.exe	SOA.exe
PID 856 wrote to memory of 1804	856	SOA.exe	SOA.exe
PID 856 wrote to memory of 964	856	SOA.exe	SOA.exe
PID 856 wrote to memory of 964	856	SOA.exe	SOA.exe
PID 856 wrote to memory of 964	856	SOA.exe	SOA.exe
PID 856 wrote to memory of 964	856	SOA.exe	SOA.exe

C:\Users\Admin\AppData\Local\Temp\SOA.exe
"C:\Users\Admin\AppData\Local\Temp\SOA.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:856

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BWhappphtUdy" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD450.tmp"
2⤵
- Creates scheduled task(s)
PID:2040

C:\Users\Admin\AppData\Local\Temp\SOA.exe
"{path}"
2⤵
PID:1968

C:\Users\Admin\AppData\Local\Temp\SOA.exe
"{path}"
2⤵
PID:1604

C:\Users\Admin\AppData\Local\Temp\SOA.exe
"{path}"
2⤵
PID:952

C:\Users\Admin\AppData\Local\Temp\SOA.exe
"{path}"
2⤵
PID:1804

C:\Users\Admin\AppData\Local\Temp\SOA.exe
"{path}"
2⤵
PID:964

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD450.tmp
Filesize
1KB

MD5
31e42dc5227f46037e2f3c1296de41c3

SHA1
8b82f7f7ba52ae55ef9e1dc6d48ea9b134cdc196

SHA256
ab4965fb7a67fa2f3e96a1860e5510fa7b263615e7a47e6fafd54e83a5d6df0f

SHA512
6f92f71f09e50d8e593581aaee7b2f033e87f1ca367f45b326305fecbfc78da002dbe06b6a591efa6f167659572d6367229d45463cf47a7ba5b4f70ad45eda63

Download Submit
memory/856-54-0x0000000000200000-0x00000000002AE000-memory.dmp

Filesize
696KB

Download
memory/856-55-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/856-56-0x00000000001E0000-0x00000000001EE000-memory.dmp

Filesize
56KB

Download
memory/856-57-0x0000000000830000-0x0000000000898000-memory.dmp

Filesize
416KB

Download
memory/856-58-0x00000000051B0000-0x000000000521A000-memory.dmp

Filesize
424KB

Download
memory/856-59-0x0000000000600000-0x0000000000614000-memory.dmp

Filesize
80KB

Download
memory/2040-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads