Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240704-en - resource tags
- submitted
07/07/2024, 04:14
General
- Target SOA JUNE 2024.exe
- Size 682KB
- Sample240707-etmryatcmp
- SHA256 e555da2ac86f48df592dcafefab28e1032e93b7a547553ccea0085d4e9292a08
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SOA JUNE 2024.exe"C:\Users\Admin\AppData\Local\Temp\SOA JUNE 2024.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SOA JUNE 2024.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ivAgXXNGGGU.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ivAgXXNGGGU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB21A.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\SOA JUNE 2024.exe"C:\Users\Admin\AppData\Local\Temp\SOA JUNE 2024.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_4kewtm4w.nrg.ps1
tmpB21A.tmp
memory/972-0-0x000000007524E000-0x000000007524F000-memory.dmp
memory/972-4-0x00000000051A0000-0x00000000051AA000-memory.dmp
memory/972-6-0x0000000006380000-0x00000000068AC000-memory.dmp
memory/972-7-0x0000000006D90000-0x0000000006E40000-memory.dmp
memory/972-8-0x0000000006FC0000-0x0000000006FDA000-memory.dmp
memory/972-9-0x0000000006370000-0x0000000006378000-memory.dmp
memory/972-10-0x0000000002B90000-0x0000000002B9C000-memory.dmp
memory/972-11-0x0000000006B90000-0x0000000006C1E000-memory.dmp
memory/972-12-0x0000000006950000-0x00000000069EC000-memory.dmp
memory/972-50-0x0000000075240000-0x00000000759F0000-memory.dmp
memory/972-1-0x00000000006F0000-0x000000000079E000-memory.dmp
memory/972-2-0x00000000058A0000-0x0000000005E44000-memory.dmp
memory/972-3-0x0000000005230000-0x00000000052C2000-memory.dmp
memory/972-5-0x0000000075240000-0x00000000759F0000-memory.dmp
memory/2088-64-0x0000000006E70000-0x0000000006E8E000-memory.dmp
memory/2088-52-0x0000000006F00000-0x0000000006F4C000-memory.dmp
memory/2088-87-0x0000000075240000-0x00000000759F0000-memory.dmp
memory/2088-80-0x0000000007E80000-0x0000000007E91000-memory.dmp
memory/2088-19-0x0000000005A80000-0x00000000060A8000-memory.dmp
memory/2088-78-0x0000000007CF0000-0x0000000007CFA000-memory.dmp
memory/2088-53-0x0000000007940000-0x0000000007972000-memory.dmp
memory/2088-20-0x0000000075240000-0x00000000759F0000-memory.dmp
memory/2088-22-0x0000000075240000-0x00000000759F0000-memory.dmp
memory/2088-54-0x0000000075AD0000-0x0000000075B1C000-memory.dmp
memory/2088-17-0x0000000003040000-0x0000000003076000-memory.dmp
memory/2088-51-0x0000000006960000-0x000000000697E000-memory.dmp
memory/2088-18-0x0000000075240000-0x00000000759F0000-memory.dmp
memory/2088-65-0x0000000007B80000-0x0000000007C23000-memory.dmp
memory/3120-36-0x0000000075240000-0x00000000759F0000-memory.dmp
memory/3120-81-0x0000000007CC0000-0x0000000007CCE000-memory.dmp
memory/3120-91-0x0000000075240000-0x00000000759F0000-memory.dmp
memory/3120-47-0x0000000075240000-0x00000000759F0000-memory.dmp
memory/3120-76-0x00000000080D0000-0x000000000874A000-memory.dmp
memory/3120-77-0x0000000007A90000-0x0000000007AAA000-memory.dmp
memory/3120-35-0x0000000006160000-0x00000000064B4000-memory.dmp
memory/3120-79-0x0000000007D10000-0x0000000007DA6000-memory.dmp
memory/3120-25-0x0000000075240000-0x00000000759F0000-memory.dmp
memory/3120-66-0x0000000075AD0000-0x0000000075B1C000-memory.dmp
memory/3120-82-0x0000000007CD0000-0x0000000007CE4000-memory.dmp
memory/3120-83-0x0000000007DD0000-0x0000000007DEA000-memory.dmp
memory/3120-84-0x0000000007DB0000-0x0000000007DB8000-memory.dmp
memory/3120-21-0x0000000005FE0000-0x0000000006002000-memory.dmp
memory/3120-23-0x0000000006080000-0x00000000060E6000-memory.dmp
memory/3120-24-0x00000000060F0000-0x0000000006156000-memory.dmp
memory/4524-48-0x0000000000400000-0x0000000000446000-memory.dmp