Overview

overview

8

Static

static

1

Sophia_Scr...on.ps1

windows10-2004-x64

8

Sophia_Scr...on.ps1

windows11-ltsc_2024-x64

8

Sophia_Scr...PO.exe

windows10-2004-x64

3

Sophia_Scr...PO.exe

windows11-ltsc_2024-x64

3

Sophia_Scr...sh.ps1

windows10-2004-x64

3

Sophia_Scr...sh.ps1

windows11-ltsc_2024-x64

3

Sophia_Scr...ns.ps1

windows10-2004-x64

3

Sophia_Scr...ns.ps1

windows11-ltsc_2024-x64

3

Sophia_Scr...ns.ps1

windows10-2004-x64

3

Sophia_Scr...ns.ps1

windows11-ltsc_2024-x64

3

Sophia_Scr...th.ps1

windows10-2004-x64

6

Sophia_Scr...th.ps1

windows11-ltsc_2024-x64

6

Sophia_Scr...cy.ps1

windows10-2004-x64

6

Sophia_Scr...cy.ps1

windows11-ltsc_2024-x64

6

Sophia_Scr...er.ps1

windows10-2004-x64

6

Sophia_Scr...er.ps1

windows11-ltsc_2024-x64

6

Sophia_Scr...nu.ps1

windows10-2004-x64

3

Sophia_Scr...nu.ps1

windows11-ltsc_2024-x64

3

Sophia_Scr...ys.ps1

windows10-2004-x64

3

Sophia_Scr...ys.ps1

windows11-ltsc_2024-x64

3

Sophia_Scr...ys.ps1

windows10-2004-x64

3

Sophia_Scr...ys.ps1

windows11-ltsc_2024-x64

3

Sophia_Scr...ia.ps1

windows10-2004-x64

3

Sophia_Scr...ia.ps1

windows11-ltsc_2024-x64

3

Sophia_Scr...ia.ps1

windows10-2004-x64

8

Sophia_Scr...ia.ps1

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    Sophia.Script.for.Windows.11.LTSC.2024.v7.2.0.zip
  • Size 460KB
  • Sample261029-1pm3sstsb1
  • SHA256 848eff64b6738293adf2ffb864af6d232d34155ae2287791717ab3c5a19ec8b5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecution

Malware Config

Targets

    • Target
      Sophia_Script_for_Windows_11_LTSC_2024_v7.2.0/Import-TabCompletion.ps1
    • Size 5KB
    • SHA256 94bde3c3fa430738df8c9e1932e9d2a486b9a6287267efa3ef9b770eefb189df
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    execution

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    behavioral1behavioral2
    • Target
      Sophia_Script_for_Windows_11_LTSC_2024_v7.2.0/Module/Binaries/LGPO.exe
    • Size 469KB
    • SHA256 0c97f29543418b30340c4ff5d930d31e6196dd59c2cc74b6b890fa7b90c910c7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      Sophia_Script_for_Windows_11_LTSC_2024_v7.2.0/Module/Private/Get-Hash.ps1
    • Size 6KB
    • SHA256 ea1ad66891cd4e48b387735ec68b2b421cde52fbb56410b0f4602f37685b4ec8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral5behavioral6
    • Target
      Sophia_Script_for_Windows_11_LTSC_2024_v7.2.0/Module/Private/InitialActions.ps1
    • Size 35KB
    • SHA256 ab067b2ad2bbbcedee52639f9960cd61bf36faecddbd6b3d24057e1fce30d77a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral7behavioral8
    • Target
      Sophia_Script_for_Windows_11_LTSC_2024_v7.2.0/Module/Private/PostActions.ps1
    • Size 8KB
    • SHA256 b5f4d921fc98f617131e5ffe74b5aa5b3ed22dc9c2066bcf705fdf4b753c7243
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral10behavioral9
    • Target
      Sophia_Script_for_Windows_11_LTSC_2024_v7.2.0/Module/Private/Set-KnownFolderPath.ps1
    • Size 1KB
    • SHA256 eb06d1821815a9448a1e6bafc2f5b492e03d5cef38a5f5003ff083e180f3b74f
    • MD5 SHA1 SHA512 TLSH
    Score
    6/10
    execution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution
    behavioral11behavioral12
    • Target
      Sophia_Script_for_Windows_11_LTSC_2024_v7.2.0/Module/Private/Set-Policy.ps1
    • Size 1KB
    • SHA256 97c07d688e3df6d880f5a201b144b9ceb789fe65c61083123f013ce012562a94
    • MD5 SHA1 SHA512 TLSH
    Score
    6/10
    execution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution
    behavioral13behavioral14
    • Target
      Sophia_Script_for_Windows_11_LTSC_2024_v7.2.0/Module/Private/Set-UserShellFolder.ps1
    • Size 2KB
    • SHA256 664fc536b672e23ad4829a130fdcf9ebaa5ec43e0b9faeec8c981b891958f004
    • MD5 SHA1 SHA512 TLSH
    Score
    6/10
    execution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution
    behavioral15behavioral16
    • Target
      Sophia_Script_for_Windows_11_LTSC_2024_v7.2.0/Module/Private/Show-Menu.ps1
    • Size 2KB
    • SHA256 384ef5599038de5d6c9e53d498568b42e1dd51563312c2031f06ae31ce47a15c
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral17behavioral18
    • Target
      Sophia_Script_for_Windows_11_LTSC_2024_v7.2.0/Module/Private/Write-AdditionalKeys.ps1
    • Size 5KB
    • SHA256 628b28fb16bd58470f29fcc37c2ae2ac89ece5541f2057b66fe359e020c658db
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral19behavioral20
    • Target
      Sophia_Script_for_Windows_11_LTSC_2024_v7.2.0/Module/Private/Write-ExtensionKeys.ps1
    • Size 7KB
    • SHA256 57a05328f0797223a0fd4190f1a8a99f27a1f9168741312d81d80fecbe994a1c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral21behavioral22
    • Target
      Sophia_Script_for_Windows_11_LTSC_2024_v7.2.0/Module/Sophia.psm1
    • Size 308KB
    • SHA256 671dc74f8caa3cb66a1eb66438ca74b086f014f5010dcda5fd3ad5f3cbce4614
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral23behavioral24
    • Target
      Sophia_Script_for_Windows_11_LTSC_2024_v7.2.0/Sophia.ps1
    • Size 62KB
    • SHA256 593dca84621fab742c7149db7392689cd90296107fefadbfaa18996387db1637
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    execution

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    behavioral25behavioral26

MITRE ATT&CK Enterprise v16

Tasks

static1

Score
1/10

behavioral1

execution
Score
8/10

behavioral2

execution
Score
8/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

execution
Score
3/10

behavioral6

execution
Score
3/10

behavioral7

execution
Score
3/10

behavioral8

execution
Score
3/10

behavioral9

execution
Score
3/10

behavioral10

execution
Score
3/10

behavioral11

execution
Score
6/10

behavioral12

execution
Score
6/10

behavioral13

execution
Score
6/10

behavioral14

execution
Score
6/10

behavioral15

execution
Score
6/10

behavioral16

execution
Score
6/10

behavioral17

execution
Score
3/10

behavioral18

execution
Score
3/10

behavioral19

execution
Score
3/10

behavioral20

execution
Score
3/10

behavioral21

execution
Score
3/10

behavioral22

execution
Score
3/10

behavioral23

execution
Score
3/10

behavioral24

execution
Score
3/10

behavioral25

execution
Score
8/10

behavioral26

execution
Score
8/10