Analysis

  • max time kernel
    115s
  • max time network
    115s
  • platform
    windows10-1703_x64
  • resource
    win10-20231220-en
  • resource tags

    arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    02-02-2024 16:02

General

  • Target

    soan_2_2.zip

  • Size

    17.7MB

  • MD5

    8e93520d569a6e2afed2da31224c7568

  • SHA1

    8b45cf1d65ffa2bf061222e2e35d0a3fb4739b87

  • SHA256

    94c0a9f4adcb87a5705f7ad0776b27ee6471131f21fadad162de21590669f649

  • SHA512

    a5e250e2ce0f121de7f5a89ced3a2fd0ddd69d47346c6020351bf9ee13d9522b81e86d08704392ea061fec879d92a785233218365b9db5a97f03a3daa67dccad

  • SSDEEP

    393216:+oecXb9QxDfm4ZXDqgQG/yMWIsbfq4702k6sncVsLGBAYOD6C:+oe0b9QxDfBdDqgFyrIeP70t6snPbDDZ

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 48 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\soan_2_2.zip
    1⤵
      PID:5056
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3900
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe1efe9758,0x7ffe1efe9768,0x7ffe1efe9778
        2⤵
          PID:196
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1828 --field-trial-handle=1860,i,4782389139528221198,9254372277647108022,131072 /prefetch:8
          2⤵
            PID:3224
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2908 --field-trial-handle=1860,i,4782389139528221198,9254372277647108022,131072 /prefetch:1
            2⤵
              PID:4876
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2900 --field-trial-handle=1860,i,4782389139528221198,9254372277647108022,131072 /prefetch:1
              2⤵
                PID:1616
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2116 --field-trial-handle=1860,i,4782389139528221198,9254372277647108022,131072 /prefetch:8
                2⤵
                  PID:1288
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1860,i,4782389139528221198,9254372277647108022,131072 /prefetch:2
                  2⤵
                    PID:3604
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4476 --field-trial-handle=1860,i,4782389139528221198,9254372277647108022,131072 /prefetch:1
                    2⤵
                      PID:2852
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4656 --field-trial-handle=1860,i,4782389139528221198,9254372277647108022,131072 /prefetch:8
                      2⤵
                        PID:4012
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4656 --field-trial-handle=1860,i,4782389139528221198,9254372277647108022,131072 /prefetch:8
                        2⤵
                          PID:4392
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 --field-trial-handle=1860,i,4782389139528221198,9254372277647108022,131072 /prefetch:8
                          2⤵
                            PID:5068
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 --field-trial-handle=1860,i,4782389139528221198,9254372277647108022,131072 /prefetch:8
                            2⤵
                              PID:352
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4836 --field-trial-handle=1860,i,4782389139528221198,9254372277647108022,131072 /prefetch:8
                              2⤵
                                PID:816
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2248 --field-trial-handle=1860,i,4782389139528221198,9254372277647108022,131072 /prefetch:1
                                2⤵
                                  PID:4316
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=972 --field-trial-handle=1860,i,4782389139528221198,9254372277647108022,131072 /prefetch:1
                                  2⤵
                                    PID:4276
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2284 --field-trial-handle=1860,i,4782389139528221198,9254372277647108022,131072 /prefetch:1
                                    2⤵
                                      PID:3888
                                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                    1⤵
                                      PID:2944
                                    • C:\Program Files\7-Zip\7zFM.exe
                                      "C:\Program Files\7-Zip\7zFM.exe"
                                      1⤵
                                      • Drops file in Windows directory
                                      • Suspicious behavior: GetForegroundWindowSpam
                                      PID:4332
                                    • C:\Windows\System32\rundll32.exe
                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                      1⤵
                                        PID:3980
                                      • C:\Windows\notepad.exe
                                        "C:\Windows\notepad.exe"
                                        1⤵
                                          PID:4772

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5734d329-b0da-4135-9ce7-f30b8bf8ba3d.tmp

                                          Filesize

                                          232KB

                                          MD5

                                          2a853b3f26b9ab6e7251dd5c3d2c4b83

                                          SHA1

                                          134e4883643d3af888efaf2dceb80d848bde6d3e

                                          SHA256

                                          93a151482bfa81dc7972ed3d865443acebc600a02b5274a49aea21bfa84e2f40

                                          SHA512

                                          752fb2058a288ea2aba1fc6625bb196421cdf379223c28642bad05b544a1d1cf13270ec7b61615177848c98155d3f9c48be829328681d283992996412c71c62f

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                          Filesize

                                          1KB

                                          MD5

                                          1017caeed5484ecb417420dde8853ffd

                                          SHA1

                                          077e697570e5802bb81f04671b7a5c9edc5939bb

                                          SHA256

                                          ca0e22161b563f6d104c9504c28873a49156a52abf73fd7660b016d447c5d800

                                          SHA512

                                          42cbf42047f1c806e82234790fc203c15767968041bff000a73246704844461d7a94e043d61c567ae087b204147ebbe1de5d4b4f94e0303f544a7c3e12f775bd

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                          Filesize

                                          371B

                                          MD5

                                          65bfed874391a34dc0e8988b2d4ee9e2

                                          SHA1

                                          47b9f60ae31a510e9093500bb714597686340828

                                          SHA256

                                          eedbe9d1799d65f1ec6f4129636d194ed0924fe6fa6fc2fb5c383ecb42b357a2

                                          SHA512

                                          71b42d18a25ce645f4ced03804e82f1ede3f861ad73cf1ff65f080d940ae422019d8a78efb55fe89eb5ad0d7ef77560ea1ea39c1b5a48f01a3c3f1b5729f568a

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          6KB

                                          MD5

                                          08943479bb2a38eab1c7cf85bb443444

                                          SHA1

                                          29790207fb8979823451d5aebbe3fad65aceacb7

                                          SHA256

                                          7bbfbb2f46167ec65a1c409e4576d07a5f6f2c5c628a5c247be8988f3f7e7ad4

                                          SHA512

                                          a1dda1bf260878d35cae0e60aadb58241a9fc6a903eabe8a5cf7cd9ab99990e1640147c85e8519a320add0b85b2c3c14f306ac50b8742e6e642f6a83b71f5fd6

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          6KB

                                          MD5

                                          d2a186e44b96ab29c7e81758c29b3ccf

                                          SHA1

                                          92219fedcb8da03fbcc6bf3024689b51d85309f3

                                          SHA256

                                          3727082dd18203b3c0d761896320d1ad853213c7cf020d0b0ab193ada3a02b2f

                                          SHA512

                                          3f66fbfc0a34307bfd724bb2be43fe246b855a4963771fb69123c7e3e64f5724b46492cf9b5653bcec47e1a3edb05bd057343472625f7714b6a83d5be2fcb9a8

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                          Filesize

                                          2B

                                          MD5

                                          99914b932bd37a50b983c5e7c90ae93b

                                          SHA1

                                          bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                          SHA256

                                          44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                          SHA512

                                          27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd