Analysis
- max time kernel
144s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
10/10/2022, 07:27
General
- Target Halkbank_Ekstre_20221009_080900_117636.pdf.exe
- Size 1.2MB
- Sample221010-h948psbab9
- SHA256 8f08318090a1dd5d08d0ebe5b2ef3d2a9aa2f54cb5b30db64773756b50bd21e9
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20221009_080900_117636.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20221009_080900_117636.pdf.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ygCpcKOh.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ygCpcKOh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8B77.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20221009_080900_117636.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20221009_080900_117636.pdf.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
tmp8B77.tmp
memory/988-163-0x0000000000400000-0x0000000000462000-memory.dmp
memory/988-151-0x0000000000400000-0x0000000000462000-memory.dmp
memory/988-146-0x0000000000400000-0x0000000000462000-memory.dmp
memory/988-144-0x0000000000400000-0x0000000000462000-memory.dmp
memory/1484-156-0x0000000007760000-0x0000000007DDA000-memory.dmp
memory/1484-157-0x0000000007110000-0x000000000712A000-memory.dmp
memory/1484-140-0x0000000002500000-0x0000000002536000-memory.dmp
memory/1484-142-0x00000000050B0000-0x00000000056D8000-memory.dmp
memory/1484-162-0x0000000007430000-0x0000000007438000-memory.dmp
memory/1484-161-0x0000000007450000-0x000000000746A000-memory.dmp
memory/1484-160-0x0000000007340000-0x000000000734E000-memory.dmp
memory/1484-149-0x0000000004F50000-0x0000000004F72000-memory.dmp
memory/1484-150-0x00000000056E0000-0x0000000005746000-memory.dmp
memory/1484-159-0x0000000007390000-0x0000000007426000-memory.dmp
memory/1484-152-0x0000000005E10000-0x0000000005E2E000-memory.dmp
memory/1484-153-0x0000000006DE0000-0x0000000006E12000-memory.dmp
memory/1484-154-0x0000000070310000-0x000000007035C000-memory.dmp
memory/1484-155-0x00000000063E0000-0x00000000063FE000-memory.dmp
memory/1484-158-0x0000000007180000-0x000000000718A000-memory.dmp
memory/4980-132-0x0000000000A70000-0x0000000000BA2000-memory.dmp
memory/4980-134-0x0000000005570000-0x0000000005602000-memory.dmp
memory/4980-135-0x0000000005550000-0x000000000555A000-memory.dmp
memory/4980-136-0x000000000A380000-0x000000000A41C000-memory.dmp
memory/4980-137-0x000000000A420000-0x000000000A486000-memory.dmp
memory/4980-133-0x0000000005BF0000-0x0000000006194000-memory.dmp