26f7e04c866b93d54f94ceb8dae437a6a2fa39c271574cfb9c6a2578fa263fa6

Analysis

max time kernel
97s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2022, 10:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Hesabınıza para geldi...pdf...exe
Size 769KB
Sample220930-mpymmsecan
SHA256 26f7e04c866b93d54f94ceb8dae437a6a2fa39c271574cfb9c6a2578fa263fa6
MD5 8fbba42e36615309fc2f61e5b710bc4e
SHA1 60fa616c1ff8ecbe854e880ee35276b0d16deca5
SHA512 48bd3b378c0e8a1ad29acd788db82182ed706ba2f12a4548f7152bad1f741f723d333e36680a2ac4c5fffb2fc735b0fd31157af76659e765f0483b46ab22d9b7
SSDEEP 12288:fToPWBv/cpGrU3yVJW0qGf0SQ/+Fhu9/KR57eRGQOeVo+W1:fTbBv5rUcqGf0x/+QiR4G7b1
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3932	wjvyyiyx.exe
4316	wjvyyiyx.exe
2876	wjvyyiyx.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Hesabınıza para geldi...pdf...exe

Loads dropped DLL 2 IoCs

pid	Process
1420	wjvyyiyx.exe
3068	wjvyyiyx.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3932 set thread context of 1420	3932	wjvyyiyx.exe	85
PID 3932 set thread context of 3068	3932	wjvyyiyx.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4384	3932	WerFault.exe	81

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1420	wjvyyiyx.exe
3068	wjvyyiyx.exe
3068	wjvyyiyx.exe
1420	wjvyyiyx.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 3932	4076	Hesabınıza para geldi...pdf...exe	81
PID 4076 wrote to memory of 3932	4076	Hesabınıza para geldi...pdf...exe	81
PID 4076 wrote to memory of 3932	4076	Hesabınıza para geldi...pdf...exe	81
PID 3932 wrote to memory of 4316	3932	wjvyyiyx.exe	83
PID 3932 wrote to memory of 4316	3932	wjvyyiyx.exe	83
PID 3932 wrote to memory of 4316	3932	wjvyyiyx.exe	83
PID 3932 wrote to memory of 2876	3932	wjvyyiyx.exe	84
PID 3932 wrote to memory of 2876	3932	wjvyyiyx.exe	84
PID 3932 wrote to memory of 2876	3932	wjvyyiyx.exe	84
PID 3932 wrote to memory of 1420	3932	wjvyyiyx.exe	85
PID 3932 wrote to memory of 1420	3932	wjvyyiyx.exe	85
PID 3932 wrote to memory of 1420	3932	wjvyyiyx.exe	85
PID 3932 wrote to memory of 1420	3932	wjvyyiyx.exe	85
PID 3932 wrote to memory of 3068	3932	wjvyyiyx.exe	86
PID 3932 wrote to memory of 3068	3932	wjvyyiyx.exe	86
PID 3932 wrote to memory of 3068	3932	wjvyyiyx.exe	86
PID 3932 wrote to memory of 3068	3932	wjvyyiyx.exe	86

C:\Users\Admin\AppData\Local\Temp\Hesabınıza para geldi...pdf...exe
"C:\Users\Admin\AppData\Local\Temp\Hesabınıza para geldi...pdf...exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Users\Admin\AppData\Local\Temp\wjvyyiyx.exe
  "C:\Users\Admin\AppData\Local\Temp\wjvyyiyx.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3932
- - C:\Users\Admin\AppData\Local\Temp\wjvyyiyx.exe
    "C:\Users\Admin\AppData\Local\Temp\wjvyyiyx.exe"
    3⤵
    - Executes dropped EXE
    PID:4316
- - C:\Users\Admin\AppData\Local\Temp\wjvyyiyx.exe
    "C:\Users\Admin\AppData\Local\Temp\wjvyyiyx.exe"
    3⤵
    - Executes dropped EXE
    PID:2876
- - C:\Users\Admin\AppData\Local\Temp\wjvyyiyx.exe
    "C:\Users\Admin\AppData\Local\Temp\wjvyyiyx.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1420
- - C:\Users\Admin\AppData\Local\Temp\wjvyyiyx.exe
    "C:\Users\Admin\AppData\Local\Temp\wjvyyiyx.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:3068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 492
    3⤵
    - Program crash
    PID:4384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3932 -ip 3932
1⤵
PID:4632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eiegmprhw.ekj

Path C:\Users\Admin\AppData\Local\Temp\eiegmprhw.ekj
Size 4KB
SHA256 0e4a6a2a771e965d5ce054e30ee4a51befdb62e03a70a4909f672faced8a8a2a
MD5 45b566e77cc6d8e5f6488d0feb165d0f
SHA1 ee6b191ee000e58cfc404508d5228b0439cb1537
SHA512 638c5fe1593883e76f1dd4c6b112284e57eb44963672d069f5b53b1e70093793d019309a3190d410113359ad618069a8894e58189004c5abd20994074d6df315
SSDEEP 96:8nUKU9OYpWyVSLj0EiM1LZ2gJf+O44kfjBkgpdiFNNjhXUFi92bnT1zU3xBouAca:NFxWcE+tRbWmsFNNtXUwobO3bR4V
MD5 SHA1 SHA512 SSDEEP

Submit Download

qspmhein.jol

Path C:\Users\Admin\AppData\Local\Temp\qspmhein.jol
Size 400KB
SHA256 f08dd8f00a588033949166f85b3cb0fc2a4ef5c4237483cccc1e6c9a1e5a5519
MD5 44980df345de3119f70e5606bafefb8c
SHA1 bd143e6451d44144ac4019602662dfeef0ca0a74
SHA512 abf7d03af086879b3c77efb36180928bbc534931da7944739eb758e4734ec007fa72a1e304b355ca0230f13752d7b2e81fd2263eee4eb32054eb0d9c57da0d3a
SSDEEP 6144:1j6NJrBiUoo4+pekg5nk67AbdAUIv78knI0GdVQIo:gZFowpekx67QAUIHnDUVto
MD5 SHA1 SHA512 SSDEEP

Submit Download

wjvyyiyx.exe

Path C:\Users\Admin\AppData\Local\Temp\wjvyyiyx.exe
Size 56KB
SHA256 fbaae9b29532f0bae499a965e9bb88c7ed3efddc0c0ee570ad5cbd5419ccf5bd
MD5 df624b1cfd53ac04e43c128ae6e9908e
SHA1 027048d1649c320e28cbc1493d94a984cdade7e3
SHA512 fdea59b7ad36ca91972930525b4d531cbe6135331ad3c2270723708b735ec0fabdedeed6b0ac844de1837b8d7c14d10aa1a2bc37065ac9eaa69c59c3cc9d513f
SSDEEP 1536:Psi7nkgOfVKPyOrjK3rXMArAMXQ10Xesu:PXgZPOrW3jdAV0XU
MD5 SHA1 SHA512 SSDEEP

Submit Download

wjvyyiyx.exe

Path C:\Users\Admin\AppData\Local\Temp\wjvyyiyx.exe
Size 56KB
SHA256 fbaae9b29532f0bae499a965e9bb88c7ed3efddc0c0ee570ad5cbd5419ccf5bd
MD5 df624b1cfd53ac04e43c128ae6e9908e
SHA1 027048d1649c320e28cbc1493d94a984cdade7e3
SHA512 fdea59b7ad36ca91972930525b4d531cbe6135331ad3c2270723708b735ec0fabdedeed6b0ac844de1837b8d7c14d10aa1a2bc37065ac9eaa69c59c3cc9d513f
SSDEEP 1536:Psi7nkgOfVKPyOrjK3rXMArAMXQ10Xesu:PXgZPOrW3jdAV0XU
MD5 SHA1 SHA512 SSDEEP

Submit Download

wjvyyiyx.exe

Path C:\Users\Admin\AppData\Local\Temp\wjvyyiyx.exe
Size 56KB
SHA256 fbaae9b29532f0bae499a965e9bb88c7ed3efddc0c0ee570ad5cbd5419ccf5bd
MD5 df624b1cfd53ac04e43c128ae6e9908e
SHA1 027048d1649c320e28cbc1493d94a984cdade7e3
SHA512 fdea59b7ad36ca91972930525b4d531cbe6135331ad3c2270723708b735ec0fabdedeed6b0ac844de1837b8d7c14d10aa1a2bc37065ac9eaa69c59c3cc9d513f
SSDEEP 1536:Psi7nkgOfVKPyOrjK3rXMArAMXQ10Xesu:PXgZPOrW3jdAV0XU
MD5 SHA1 SHA512 SSDEEP

Submit Download

wjvyyiyx.exe

Path C:\Users\Admin\AppData\Local\Temp\wjvyyiyx.exe
Size 56KB
SHA256 fbaae9b29532f0bae499a965e9bb88c7ed3efddc0c0ee570ad5cbd5419ccf5bd
MD5 df624b1cfd53ac04e43c128ae6e9908e
SHA1 027048d1649c320e28cbc1493d94a984cdade7e3
SHA512 fdea59b7ad36ca91972930525b4d531cbe6135331ad3c2270723708b735ec0fabdedeed6b0ac844de1837b8d7c14d10aa1a2bc37065ac9eaa69c59c3cc9d513f
SSDEEP 1536:Psi7nkgOfVKPyOrjK3rXMArAMXQ10Xesu:PXgZPOrW3jdAV0XU
MD5 SHA1 SHA512 SSDEEP

Submit Download

wjvyyiyx.exe

Path C:\Users\Admin\AppData\Local\Temp\wjvyyiyx.exe
Size 56KB
SHA256 fbaae9b29532f0bae499a965e9bb88c7ed3efddc0c0ee570ad5cbd5419ccf5bd
MD5 df624b1cfd53ac04e43c128ae6e9908e
SHA1 027048d1649c320e28cbc1493d94a984cdade7e3
SHA512 fdea59b7ad36ca91972930525b4d531cbe6135331ad3c2270723708b735ec0fabdedeed6b0ac844de1837b8d7c14d10aa1a2bc37065ac9eaa69c59c3cc9d513f
SSDEEP 1536:Psi7nkgOfVKPyOrjK3rXMArAMXQ10Xesu:PXgZPOrW3jdAV0XU
MD5 SHA1 SHA512 SSDEEP

Submit Download

wjvyyiyx.exe

Path C:\Users\Admin\AppData\Local\Temp\wjvyyiyx.exe
Size 56KB
SHA256 fbaae9b29532f0bae499a965e9bb88c7ed3efddc0c0ee570ad5cbd5419ccf5bd
MD5 df624b1cfd53ac04e43c128ae6e9908e
SHA1 027048d1649c320e28cbc1493d94a984cdade7e3
SHA512 fdea59b7ad36ca91972930525b4d531cbe6135331ad3c2270723708b735ec0fabdedeed6b0ac844de1837b8d7c14d10aa1a2bc37065ac9eaa69c59c3cc9d513f
SSDEEP 1536:Psi7nkgOfVKPyOrjK3rXMArAMXQ10Xesu:PXgZPOrW3jdAV0XU
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1420-141-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1420-151-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3068-150-0x0000000000400000-0x000000000043E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads