Analysis
- max time kernel
151s - max time network
151s - platform
windows10_x64 - resource
win10v200722 - submitted
09/10/2020, 11:33
Static task
static1
Behavioral task
behavioral1
Sample
AYDIN Request Order Turkey OCT2020.scr
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
AYDIN Request Order Turkey OCT2020.scr
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target AYDIN Request Order Turkey OCT2020.scr
- Size 2.3MB
- Sample201009-m6xwp9s8ka
- SHA256 4a09bedcd448deaaaff205dabbc19a34f5b47a9714ac85a5a827c0aabeb2db7f
- MD5 81b9dab45b74806fb648cbc9de2f90be
- SHA1 b1a6176e2728ad6ae57c6087d6506ab2a7da5758
- SHA512 261c043a73d53821bab8c191ec1464d05cf4225d7a29cfb6f10ad50e8fe47a0e6541c4066b5fa9bb9032171c274876b09057042c1832437b4858e6b932da105c
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AYDIN Request Order Turkey OCT2020.scr\"" AYDIN Request Order Turkey OCT2020.scr -
resource yara_rule behavioral2/memory/1752-7-0x0000000000400000-0x0000000000812000-memory.dmp upx behavioral2/memory/1752-9-0x0000000000400000-0x0000000000812000-memory.dmp upx behavioral2/memory/1752-10-0x0000000000400000-0x0000000000812000-memory.dmp upx - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AYDIN Request Order Turkey OCT2020.scr AYDIN Request Order Turkey OCT2020.scr File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AYDIN Request Order Turkey OCT2020.scr AYDIN Request Order Turkey OCT2020.scr - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\AYDIN Request Order Turkey OCT2020.scr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AYDIN Request Order Turkey OCT2020.scr" AYDIN Request Order Turkey OCT2020.scr Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AYDIN Request Order Turkey OCT2020.scr" AYDIN Request Order Turkey OCT2020.scr - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 19 myexternalip.com 20 myexternalip.com - Suspicious use of NtSetInformationThreadHideFromDebugger 36 IoCs
pid Process 3488 AYDIN Request Order Turkey OCT2020.scr 3488 AYDIN Request Order Turkey OCT2020.scr 3488 AYDIN Request Order Turkey OCT2020.scr 3488 AYDIN Request Order Turkey OCT2020.scr 3488 AYDIN Request Order Turkey OCT2020.scr 3488 AYDIN Request Order Turkey OCT2020.scr 3488 AYDIN Request Order Turkey OCT2020.scr 1752 ilasm.exe 1752 ilasm.exe 1752 ilasm.exe 1752 ilasm.exe 1752 ilasm.exe 1752 ilasm.exe 1752 ilasm.exe 1752 ilasm.exe 1752 ilasm.exe 1752 ilasm.exe 1752 ilasm.exe 1752 ilasm.exe 1752 ilasm.exe 1752 ilasm.exe 1752 ilasm.exe 1752 ilasm.exe 1752 ilasm.exe 1752 ilasm.exe 1752 ilasm.exe 1752 ilasm.exe 1752 ilasm.exe 1752 ilasm.exe 1752 ilasm.exe 1752 ilasm.exe 1752 ilasm.exe 1752 ilasm.exe 1752 ilasm.exe 1752 ilasm.exe 1752 ilasm.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3488 set thread context of 1752 3488 AYDIN Request Order Turkey OCT2020.scr 80 - Program crash 1 IoCs
pid pid_target Process procid_target 3132 3488 WerFault.exe 65 - Delays execution with timeout.exe 1 IoCs
pid Process 3020 timeout.exe - Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 3488 AYDIN Request Order Turkey OCT2020.scr 3488 AYDIN Request Order Turkey OCT2020.scr 3488 AYDIN Request Order Turkey OCT2020.scr 3488 AYDIN Request Order Turkey OCT2020.scr 3488 AYDIN Request Order Turkey OCT2020.scr 3488 AYDIN Request Order Turkey OCT2020.scr 3488 AYDIN Request Order Turkey OCT2020.scr 3488 AYDIN Request Order Turkey OCT2020.scr 3488 AYDIN Request Order Turkey OCT2020.scr 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe 3132 WerFault.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3488 AYDIN Request Order Turkey OCT2020.scr Token: SeRestorePrivilege 3132 WerFault.exe Token: SeBackupPrivilege 3132 WerFault.exe Token: SeDebugPrivilege 3132 WerFault.exe Token: SeShutdownPrivilege 1752 ilasm.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1752 ilasm.exe 1752 ilasm.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3488 wrote to memory of 3020 3488 AYDIN Request Order Turkey OCT2020.scr 72 PID 3488 wrote to memory of 3020 3488 AYDIN Request Order Turkey OCT2020.scr 72 PID 3488 wrote to memory of 3020 3488 AYDIN Request Order Turkey OCT2020.scr 72 PID 3488 wrote to memory of 3564 3488 AYDIN Request Order Turkey OCT2020.scr 77 PID 3488 wrote to memory of 3564 3488 AYDIN Request Order Turkey OCT2020.scr 77 PID 3488 wrote to memory of 3564 3488 AYDIN Request Order Turkey OCT2020.scr 77 PID 3488 wrote to memory of 3388 3488 AYDIN Request Order Turkey OCT2020.scr 78 PID 3488 wrote to memory of 3388 3488 AYDIN Request Order Turkey OCT2020.scr 78 PID 3488 wrote to memory of 3388 3488 AYDIN Request Order Turkey OCT2020.scr 78 PID 3488 wrote to memory of 488 3488 AYDIN Request Order Turkey OCT2020.scr 79 PID 3488 wrote to memory of 488 3488 AYDIN Request Order Turkey OCT2020.scr 79 PID 3488 wrote to memory of 488 3488 AYDIN Request Order Turkey OCT2020.scr 79 PID 3488 wrote to memory of 1752 3488 AYDIN Request Order Turkey OCT2020.scr 80 PID 3488 wrote to memory of 1752 3488 AYDIN Request Order Turkey OCT2020.scr 80 PID 3488 wrote to memory of 1752 3488 AYDIN Request Order Turkey OCT2020.scr 80 PID 3488 wrote to memory of 1752 3488 AYDIN Request Order Turkey OCT2020.scr 80 PID 3488 wrote to memory of 1752 3488 AYDIN Request Order Turkey OCT2020.scr 80 PID 3488 wrote to memory of 1752 3488 AYDIN Request Order Turkey OCT2020.scr 80 PID 3488 wrote to memory of 1752 3488 AYDIN Request Order Turkey OCT2020.scr 80 PID 3488 wrote to memory of 1752 3488 AYDIN Request Order Turkey OCT2020.scr 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\AYDIN Request Order Turkey OCT2020.scr"C:\Users\Admin\AppData\Local\Temp\AYDIN Request Order Turkey OCT2020.scr" /S1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SysWOW64\timeout.exetimeout 42⤵
- Delays execution with timeout.exe
PID:3020
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"2⤵PID:3564
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"2⤵PID:3388
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"2⤵PID:488
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1752
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 11402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3132
-