Analysis
-
max time kernel
133s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
03-02-2023 01:36
General
-
Target
Setup soothe2 v1.1.2.exe
-
Size
29.3MB
-
MD5
0158a14c23a8da850a6ee55097662354
-
SHA1
42a81c184384b1570e3fa38f47366ffe64e418a5
-
SHA256
d5b6c825e2febc952ac4cc7e9a5977398a545bcc067fa5e9f490b461efb23d37
-
SHA512
c7e7252ebf2071c5c6052600939319e88a304a81b3f5102d4aa120913f5252f46e86861287c563a515eb4c926a3a13b216fb758985639a77bc35f255917b600b
-
SSDEEP
786432:qBPNt1Vn5rkfUg2K39kqiCXg8aJmd2V+fJk4pNs:MPvb5L4CJmd2QfJ3pO
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 13 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup soothe2 v1.1.2.exe"C:\Users\Admin\AppData\Local\Temp\Setup soothe2 v1.1.2.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-CFUTC.tmp\Setup soothe2 v1.1.2.tmp"C:\Users\Admin\AppData\Local\Temp\is-CFUTC.tmp\Setup soothe2 v1.1.2.tmp" /SL5="$7011E,30179246,121344,C:\Users\Admin\AppData\Local\Temp\Setup soothe2 v1.1.2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x56c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD590fc739c83cd19766acb562c66a7d0e2
SHA1451f385a53d5fed15e7649e7891e05f231ef549a
SHA256821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431
SHA5124cb11ad48b7585ef1b70fac9e3c25610b2f64a16358cd51e32adcb0b17a6ab1c934aeb10adaa8e9ddf69b2e2f1d18fe2e87b49b39f89b05ea13aa3205e41296c
-
Filesize
1.1MB
MD590fc739c83cd19766acb562c66a7d0e2
SHA1451f385a53d5fed15e7649e7891e05f231ef549a
SHA256821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431
SHA5124cb11ad48b7585ef1b70fac9e3c25610b2f64a16358cd51e32adcb0b17a6ab1c934aeb10adaa8e9ddf69b2e2f1d18fe2e87b49b39f89b05ea13aa3205e41296c
-
Filesize
39.0MB
MD578ddc1c38ea683c68cb23c573a1fe823
SHA1299228782c54f9d371167f3e0f2c8b8a2a5bf4e8
SHA256b87d41a5f7fbfd1b46a8ae90127326ef155ad64e4281e92f852ca8aeef2c702e
SHA5129a513138f81fef2abac9e4a17136247425b97284519334699ab7e98fe36448e180a9767dd6528f9f2dde56b0cc65dae59ababaebbecce96b482a7fbec4b7cdb2
-
Filesize
39.0MB
MD578ddc1c38ea683c68cb23c573a1fe823
SHA1299228782c54f9d371167f3e0f2c8b8a2a5bf4e8
SHA256b87d41a5f7fbfd1b46a8ae90127326ef155ad64e4281e92f852ca8aeef2c702e
SHA5129a513138f81fef2abac9e4a17136247425b97284519334699ab7e98fe36448e180a9767dd6528f9f2dde56b0cc65dae59ababaebbecce96b482a7fbec4b7cdb2
-
Filesize
39.0MB
MD578ddc1c38ea683c68cb23c573a1fe823
SHA1299228782c54f9d371167f3e0f2c8b8a2a5bf4e8
SHA256b87d41a5f7fbfd1b46a8ae90127326ef155ad64e4281e92f852ca8aeef2c702e
SHA5129a513138f81fef2abac9e4a17136247425b97284519334699ab7e98fe36448e180a9767dd6528f9f2dde56b0cc65dae59ababaebbecce96b482a7fbec4b7cdb2
-
Filesize
39.0MB
MD578ddc1c38ea683c68cb23c573a1fe823
SHA1299228782c54f9d371167f3e0f2c8b8a2a5bf4e8
SHA256b87d41a5f7fbfd1b46a8ae90127326ef155ad64e4281e92f852ca8aeef2c702e
SHA5129a513138f81fef2abac9e4a17136247425b97284519334699ab7e98fe36448e180a9767dd6528f9f2dde56b0cc65dae59ababaebbecce96b482a7fbec4b7cdb2
-
Filesize
39.0MB
MD578ddc1c38ea683c68cb23c573a1fe823
SHA1299228782c54f9d371167f3e0f2c8b8a2a5bf4e8
SHA256b87d41a5f7fbfd1b46a8ae90127326ef155ad64e4281e92f852ca8aeef2c702e
SHA5129a513138f81fef2abac9e4a17136247425b97284519334699ab7e98fe36448e180a9767dd6528f9f2dde56b0cc65dae59ababaebbecce96b482a7fbec4b7cdb2
-
Filesize
39.0MB
MD578ddc1c38ea683c68cb23c573a1fe823
SHA1299228782c54f9d371167f3e0f2c8b8a2a5bf4e8
SHA256b87d41a5f7fbfd1b46a8ae90127326ef155ad64e4281e92f852ca8aeef2c702e
SHA5129a513138f81fef2abac9e4a17136247425b97284519334699ab7e98fe36448e180a9767dd6528f9f2dde56b0cc65dae59ababaebbecce96b482a7fbec4b7cdb2
-
Filesize
39.0MB
MD578ddc1c38ea683c68cb23c573a1fe823
SHA1299228782c54f9d371167f3e0f2c8b8a2a5bf4e8
SHA256b87d41a5f7fbfd1b46a8ae90127326ef155ad64e4281e92f852ca8aeef2c702e
SHA5129a513138f81fef2abac9e4a17136247425b97284519334699ab7e98fe36448e180a9767dd6528f9f2dde56b0cc65dae59ababaebbecce96b482a7fbec4b7cdb2
-
Filesize
39.0MB
MD578ddc1c38ea683c68cb23c573a1fe823
SHA1299228782c54f9d371167f3e0f2c8b8a2a5bf4e8
SHA256b87d41a5f7fbfd1b46a8ae90127326ef155ad64e4281e92f852ca8aeef2c702e
SHA5129a513138f81fef2abac9e4a17136247425b97284519334699ab7e98fe36448e180a9767dd6528f9f2dde56b0cc65dae59ababaebbecce96b482a7fbec4b7cdb2
-
Filesize
1.1MB
MD52a23577cc7d0775cd28d405e7f7d10db
SHA1f8af1497a5524e9a143b068374d209a9caf2f5c0
SHA256aa884077c3de3ca9219f42bc0fb99894f7be1a1170113ca354202828b7076510
SHA512f747b318c3c1b027eb9d7f9cf1698a531ab9842b1390574f9b691bd216ab4fa7a4d9cd7b9385120d8cc62ce448f0837427ad1f00312988e58ce0170fa5e3f72e
-
Filesize
1.1MB
MD590fc739c83cd19766acb562c66a7d0e2
SHA1451f385a53d5fed15e7649e7891e05f231ef549a
SHA256821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431
SHA5124cb11ad48b7585ef1b70fac9e3c25610b2f64a16358cd51e32adcb0b17a6ab1c934aeb10adaa8e9ddf69b2e2f1d18fe2e87b49b39f89b05ea13aa3205e41296c
-
Filesize
357KB
MD5f30afccd6fafc1cad4567ada824c9358
SHA160a65b72f208563f90fba0da6af013a36707caa9
SHA256e28d16fad16bca8198c47d7dd44acfd362dd6ba1654f700add8aaf2c0732622d
SHA51259b199085ed4b59ef2b385a09d0901ff2efde7b344db1e900684a425fc2df8e2010ca73d2f2bffa547040cb1dd4c8938b175c463ccc5e39a840a19f9aa301a6c
-
Filesize
4KB
MD50f8bbab51c5f70093b7ed7dd825d68e8
SHA1a96809560b3e9001124083937a339cf2453a94c8
SHA2567fc4fa7f5cea34df0a6733527081886cfb1c49b369df2db454de87cc4e70bdb5
SHA5127b824ad5d7ec786535106d98bc80c9350f35ac2b76d7ee20163e90becf076dfeaca4732c0ecbe2d3d84a2efef337c380d5548ca0123e69e66e30bb396f0b9b81
-
Filesize
813KB
MD55f87caf3f7cf63dde8e6af53bdf31289
SHA1a2c3cc3d9d831acd797155b667db59a32000d7a8
SHA2564731982b02b067d3f5a5a7518279a9265a49fb0f7b3f8dc3d61b82a5359d4940
SHA5124875298d82037ef1fff1ee3c58a9059d8480274326c862729fcc56664ecb49e2692c3838948c66dc8336e4050469d831cbf1fbd79b66565ab673d2a67765109d
-
Filesize
572KB
-
Filesize
524KB
-
Filesize
168KB
-
Filesize
200KB
-
Filesize
980KB
-
Filesize
1.6MB
-
Filesize
388KB
-
Filesize
572KB
-
Filesize
1.4MB
-
Filesize
36KB
-
Filesize
640KB
-
Filesize
1.6MB
-
Filesize
348KB
-
Filesize
12.3MB
-
Filesize
492KB
-
Filesize
524KB
-
Filesize
224KB
-
Filesize
92KB
-
Filesize
1.1MB
-
Filesize
200KB
-
Filesize
228KB
-
Filesize
980KB
-
Filesize
1.6MB
-
Filesize
216KB
-
Filesize
388KB
-
Filesize
1.1MB
-
Filesize
640KB
-
Filesize
72KB
-
Filesize
628KB
-
Filesize
1.6MB
-
Filesize
348KB
-
Filesize
492KB
-
Filesize
76KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
200KB
-
Filesize
980KB
-
Filesize
228KB
-
Filesize
1.6MB
-
Filesize
156KB
-
Filesize
388KB
-
Filesize
640KB
-
Filesize
36KB
-
Filesize
72KB
-
Filesize
1.6MB
-
Filesize
348KB
-
Filesize
524KB
-
Filesize
560KB
-
Filesize
228KB
-
Filesize
200KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
572KB
-
Filesize
224KB
-
Filesize
12.3MB
-
Filesize
1.4MB
-
Filesize
348KB
-
Filesize
628KB
-
Filesize
640KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
8KB