5c92a316e670ccde068afac02f9900cd61b218f9d8d5afff2d56ee8ebd407bc7

Analysis

max time kernel
49s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
18/10/2022, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
swift Zirat Bankasi Swift Mesaji,pdf.exe
Size 1.4MB
Sample221018-ndpq2afee8
SHA256 5c92a316e670ccde068afac02f9900cd61b218f9d8d5afff2d56ee8ebd407bc7
MD5 9aa273c83cf2f2f29424c3dd7ae565ad
SHA1 b803cbaba28a73b4936cfe8bfa486dc5ddb43edd
SHA512 8ad642f946c4a6f11c1959ce71e7bc86b089fd400e8ab5e8398c0c3e436da408be46449473240174170136cd386bf977de8cbffbf0976aa499f5cdebc3d07131
SSDEEP 24576:6xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxNusshQU+tEL3:vTXLnLN+Z+7ASFdj
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
860	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1368	swift Zirat Bankasi Swift Mesaji,pdf.exe
1368	swift Zirat Bankasi Swift Mesaji,pdf.exe
1368	swift Zirat Bankasi Swift Mesaji,pdf.exe
1368	swift Zirat Bankasi Swift Mesaji,pdf.exe
1368	swift Zirat Bankasi Swift Mesaji,pdf.exe
1368	swift Zirat Bankasi Swift Mesaji,pdf.exe
624	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1368	swift Zirat Bankasi Swift Mesaji,pdf.exe
Token: SeDebugPrivilege	624	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 624	1368	swift Zirat Bankasi Swift Mesaji,pdf.exe	27
PID 1368 wrote to memory of 624	1368	swift Zirat Bankasi Swift Mesaji,pdf.exe	27
PID 1368 wrote to memory of 624	1368	swift Zirat Bankasi Swift Mesaji,pdf.exe	27
PID 1368 wrote to memory of 624	1368	swift Zirat Bankasi Swift Mesaji,pdf.exe	27
PID 1368 wrote to memory of 860	1368	swift Zirat Bankasi Swift Mesaji,pdf.exe	29
PID 1368 wrote to memory of 860	1368	swift Zirat Bankasi Swift Mesaji,pdf.exe	29
PID 1368 wrote to memory of 860	1368	swift Zirat Bankasi Swift Mesaji,pdf.exe	29
PID 1368 wrote to memory of 860	1368	swift Zirat Bankasi Swift Mesaji,pdf.exe	29
PID 1368 wrote to memory of 1272	1368	swift Zirat Bankasi Swift Mesaji,pdf.exe	31
PID 1368 wrote to memory of 1272	1368	swift Zirat Bankasi Swift Mesaji,pdf.exe	31
PID 1368 wrote to memory of 1272	1368	swift Zirat Bankasi Swift Mesaji,pdf.exe	31
PID 1368 wrote to memory of 1272	1368	swift Zirat Bankasi Swift Mesaji,pdf.exe	31
PID 1368 wrote to memory of 676	1368	swift Zirat Bankasi Swift Mesaji,pdf.exe	32
PID 1368 wrote to memory of 676	1368	swift Zirat Bankasi Swift Mesaji,pdf.exe	32
PID 1368 wrote to memory of 676	1368	swift Zirat Bankasi Swift Mesaji,pdf.exe	32
PID 1368 wrote to memory of 676	1368	swift Zirat Bankasi Swift Mesaji,pdf.exe	32
PID 1368 wrote to memory of 1072	1368	swift Zirat Bankasi Swift Mesaji,pdf.exe	33
PID 1368 wrote to memory of 1072	1368	swift Zirat Bankasi Swift Mesaji,pdf.exe	33
PID 1368 wrote to memory of 1072	1368	swift Zirat Bankasi Swift Mesaji,pdf.exe	33
PID 1368 wrote to memory of 1072	1368	swift Zirat Bankasi Swift Mesaji,pdf.exe	33
PID 1368 wrote to memory of 1536	1368	swift Zirat Bankasi Swift Mesaji,pdf.exe	34
PID 1368 wrote to memory of 1536	1368	swift Zirat Bankasi Swift Mesaji,pdf.exe	34
PID 1368 wrote to memory of 1536	1368	swift Zirat Bankasi Swift Mesaji,pdf.exe	34
PID 1368 wrote to memory of 1536	1368	swift Zirat Bankasi Swift Mesaji,pdf.exe	34
PID 1368 wrote to memory of 1732	1368	swift Zirat Bankasi Swift Mesaji,pdf.exe	35
PID 1368 wrote to memory of 1732	1368	swift Zirat Bankasi Swift Mesaji,pdf.exe	35
PID 1368 wrote to memory of 1732	1368	swift Zirat Bankasi Swift Mesaji,pdf.exe	35
PID 1368 wrote to memory of 1732	1368	swift Zirat Bankasi Swift Mesaji,pdf.exe	35

C:\Users\Admin\AppData\Local\Temp\swift Zirat Bankasi Swift Mesaji,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\swift Zirat Bankasi Swift Mesaji,pdf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\JXUfajyyph.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:624
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JXUfajyyph" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD9EC.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:860
- C:\Users\Admin\AppData\Local\Temp\swift Zirat Bankasi Swift Mesaji,pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\swift Zirat Bankasi Swift Mesaji,pdf.exe"
  2⤵
  PID:1272
- C:\Users\Admin\AppData\Local\Temp\swift Zirat Bankasi Swift Mesaji,pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\swift Zirat Bankasi Swift Mesaji,pdf.exe"
  2⤵
  PID:676
- C:\Users\Admin\AppData\Local\Temp\swift Zirat Bankasi Swift Mesaji,pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\swift Zirat Bankasi Swift Mesaji,pdf.exe"
  2⤵
  PID:1072
- C:\Users\Admin\AppData\Local\Temp\swift Zirat Bankasi Swift Mesaji,pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\swift Zirat Bankasi Swift Mesaji,pdf.exe"
  2⤵
  PID:1536
- C:\Users\Admin\AppData\Local\Temp\swift Zirat Bankasi Swift Mesaji,pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\swift Zirat Bankasi Swift Mesaji,pdf.exe"
  2⤵
  PID:1732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpD9EC.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpD9EC.tmp
Size 1KB
SHA256 6b1dc3e595a7739395f1645719965a1c4cfe90f17cb8bbffe5810a4ab864bac7
MD5 78df0fb271321c22668f21379ae31546
SHA1 910e9f3045c7d1f284cbc8b63a7990abc459af44
SHA512 b724243d68d9075adfa0ec33c3698c2a3a14e616d375b22e546fc0bb5a6819b86031ac508dca7666674be5ab104618208e02d1eea1fcbc58b7dedb3b50e57824
MD5 SHA1 SHA512

Submit Download

memory/624-64-0x000000006E200000-0x000000006E7AB000-memory.dmp

Download

memory/624-65-0x000000006E200000-0x000000006E7AB000-memory.dmp

Download

memory/1368-54-0x0000000000350000-0x00000000004B0000-memory.dmp

Download

memory/1368-55-0x0000000074E41000-0x0000000074E43000-memory.dmp

Download

memory/1368-56-0x0000000000570000-0x0000000000588000-memory.dmp

Download

memory/1368-57-0x0000000000520000-0x000000000052C000-memory.dmp

Download

memory/1368-58-0x000000000A600000-0x000000000A6D0000-memory.dmp

Download

memory/1368-63-0x000000000A950000-0x000000000A9CC000-memory.dmp

Download