Overview

overview

8

Static

static

1

Sophia_Scr...PO.exe

windows10-2004-x64

3

Sophia_Scr...PO.exe

windows11-ltsc_2024-x64

3

Sophia_Scr...on.ps1

windows10-2004-x64

8

Sophia_Scr...on.ps1

windows11-ltsc_2024-x64

8

Sophia_Scr...sh.ps1

windows10-2004-x64

3

Sophia_Scr...sh.ps1

windows11-ltsc_2024-x64

3

Sophia_Scr...ns.ps1

windows10-2004-x64

3

Sophia_Scr...ns.ps1

windows11-ltsc_2024-x64

3

Sophia_Scr...ns.ps1

windows10-2004-x64

3

Sophia_Scr...ns.ps1

windows11-ltsc_2024-x64

3

Sophia_Scr...th.ps1

windows10-2004-x64

6

Sophia_Scr...th.ps1

windows11-ltsc_2024-x64

6

Sophia_Scr...cy.ps1

windows10-2004-x64

6

Sophia_Scr...cy.ps1

windows11-ltsc_2024-x64

6

Sophia_Scr...er.ps1

windows10-2004-x64

6

Sophia_Scr...er.ps1

windows11-ltsc_2024-x64

6

Sophia_Scr...nu.ps1

windows10-2004-x64

3

Sophia_Scr...nu.ps1

windows11-ltsc_2024-x64

3

Sophia_Scr...ys.ps1

windows10-2004-x64

3

Sophia_Scr...ys.ps1

windows11-ltsc_2024-x64

3

Sophia_Scr...ys.ps1

windows10-2004-x64

3

Sophia_Scr...ys.ps1

windows11-ltsc_2024-x64

3

Sophia_Scr...ia.ps1

windows10-2004-x64

3

Sophia_Scr...ia.ps1

windows11-ltsc_2024-x64

3

Sophia_Scr...ia.ps1

windows10-2004-x64

8

Sophia_Scr...ia.ps1

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    Sophia.Script.for.Windows.10.LTSC.2021.v6.1.6.zip
  • Size 385KB
  • Sample261029-2rn9batvft
  • SHA256 7e5b523aab73839dfbb6fd6fd456320643ee2b033620a639acea5a47d3b4cdc0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecution

Malware Config

Targets

    • Target
      Sophia_Script_for_Windows_10_LTSC_2021_v6.1.6/Binaries/LGPO.exe
    • Size 469KB
    • SHA256 0c97f29543418b30340c4ff5d930d31e6196dd59c2cc74b6b890fa7b90c910c7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral1behavioral2
    • Target
      Sophia_Script_for_Windows_10_LTSC_2021_v6.1.6/Import-TabCompletion.ps1
    • Size 6KB
    • SHA256 a97a840b0aea93d359a8db09aae21ad3bd9a4b6f2c7d8f31ab366521fdafeb4b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    execution

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    behavioral3behavioral4
    • Target
      Sophia_Script_for_Windows_10_LTSC_2021_v6.1.6/Module/Private/Get-Hash.ps1
    • Size 6KB
    • SHA256 927d49b6fe13f21852097d106169509dff1fcdd316f0d61ebbc40624391ce715
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral5behavioral6
    • Target
      Sophia_Script_for_Windows_10_LTSC_2021_v6.1.6/Module/Private/InitialActions.ps1
    • Size 34KB
    • SHA256 c20d949a5c1d693b20af31be2a01b21c42dde632289eab5e703800e4c152319d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral7behavioral8
    • Target
      Sophia_Script_for_Windows_10_LTSC_2021_v6.1.6/Module/Private/PostActions.ps1
    • Size 8KB
    • SHA256 78154e25fd8f9b08f595c43bbcd48579f144a4c5a024b39b490d50dc85b94b46
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral10behavioral9
    • Target
      Sophia_Script_for_Windows_10_LTSC_2021_v6.1.6/Module/Private/Set-KnownFolderPath.ps1
    • Size 1KB
    • SHA256 eb06d1821815a9448a1e6bafc2f5b492e03d5cef38a5f5003ff083e180f3b74f
    • MD5 SHA1 SHA512 TLSH
    Score
    6/10
    execution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution
    behavioral11behavioral12
    • Target
      Sophia_Script_for_Windows_10_LTSC_2021_v6.1.6/Module/Private/Set-Policy.ps1
    • Size 1KB
    • SHA256 1fdb59836824b79fd48886826d41047904856497878e5bfedf36ffe48f8b8fbd
    • MD5 SHA1 SHA512 TLSH
    Score
    6/10
    execution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution
    behavioral13behavioral14
    • Target
      Sophia_Script_for_Windows_10_LTSC_2021_v6.1.6/Module/Private/Set-UserShellFolder.ps1
    • Size 2KB
    • SHA256 664fc536b672e23ad4829a130fdcf9ebaa5ec43e0b9faeec8c981b891958f004
    • MD5 SHA1 SHA512 TLSH
    Score
    6/10
    execution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution
    behavioral15behavioral16
    • Target
      Sophia_Script_for_Windows_10_LTSC_2021_v6.1.6/Module/Private/Show-Menu.ps1
    • Size 2KB
    • SHA256 384ef5599038de5d6c9e53d498568b42e1dd51563312c2031f06ae31ce47a15c
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral17behavioral18
    • Target
      Sophia_Script_for_Windows_10_LTSC_2021_v6.1.6/Module/Private/Write-AdditionalKeys.ps1
    • Size 5KB
    • SHA256 1093fa352eef058b22bcf62538345e55fe9c517d67c5ef37c6a08ee62df473db
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral19behavioral20
    • Target
      Sophia_Script_for_Windows_10_LTSC_2021_v6.1.6/Module/Private/Write-ExtensionKeys.ps1
    • Size 7KB
    • SHA256 c19307ce0b2272ac0c4bb5b2f7f103bb7355ba017a98e623ccdd22b59d3aad58
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral21behavioral22
    • Target
      Sophia_Script_for_Windows_10_LTSC_2021_v6.1.6/Module/Sophia.psm1
    • Size 314KB
    • SHA256 9891759f136a65df15cc2d87860f5d52b4ffca6185fa7e1b26999e2495b92c0a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral23behavioral24
    • Target
      Sophia_Script_for_Windows_10_LTSC_2021_v6.1.6/Sophia.ps1
    • Size 63KB
    • SHA256 5321b71cfbf902cc0b1314e986abe7d55571407d3d6c68ec05ccd5c81af382c9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    execution

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    behavioral25behavioral26

MITRE ATT&CK Enterprise v16

Tasks

static1

Score
1/10

behavioral1

discovery
Score
3/10

behavioral2

discovery
Score
3/10

behavioral3

execution
Score
8/10

behavioral4

execution
Score
8/10

behavioral5

execution
Score
3/10

behavioral6

execution
Score
3/10

behavioral7

execution
Score
3/10

behavioral8

execution
Score
3/10

behavioral9

execution
Score
3/10

behavioral10

execution
Score
3/10

behavioral11

execution
Score
6/10

behavioral12

execution
Score
6/10

behavioral13

execution
Score
6/10

behavioral14

execution
Score
6/10

behavioral15

execution
Score
6/10

behavioral16

execution
Score
6/10

behavioral17

execution
Score
3/10

behavioral18

execution
Score
3/10

behavioral19

execution
Score
3/10

behavioral20

execution
Score
3/10

behavioral21

execution
Score
3/10

behavioral22

execution
Score
3/10

behavioral23

execution
Score
3/10

behavioral24

execution
Score
3/10

behavioral25

execution
Score
8/10

behavioral26

execution
Score
8/10