e4851305e4e93808dd9a6d3cb24f9799327ce44245cd56ed415f9efde2efe239

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2023, 09:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HesaphareketI-01.exe
Size 372KB
Sample230106-lvgqmsff34
SHA256 e4851305e4e93808dd9a6d3cb24f9799327ce44245cd56ed415f9efde2efe239
MD5 b0249cbd8dbcd0f05d7f851bd210d3a2
SHA1 9cc933c3dc909a4980f04aeb4ad4d8c804e8b734
SHA512 bd11af5fb24525ed94434268ff7d74c6079355e81fa864598dd223967ca1c9e05fd1aab5aca20d31a000e117d012d1fa9017d366e714bff21ae9b282522e9f15
SSDEEP 6144:2Ya6BgSECqpOY0b3tHDU4DdBDMIo3vo+RJOGkTYurr4OrY6Kpl6y:2Y3gQqpOY0b3tDl7ofhJODTFrr48KP6y
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1920	dzhppqxyme.exe
4696	dzhppqxyme.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	dzhppqxyme.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1920 set thread context of 4696	1920	dzhppqxyme.exe	82
PID 4696 set thread context of 684	4696	dzhppqxyme.exe	24
PID 2840 set thread context of 684	2840	mstsc.exe	24

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1996	3816	WerFault.exe	90

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	mstsc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4696	dzhppqxyme.exe
4696	dzhppqxyme.exe
4696	dzhppqxyme.exe
4696	dzhppqxyme.exe
4696	dzhppqxyme.exe
4696	dzhppqxyme.exe
4696	dzhppqxyme.exe
4696	dzhppqxyme.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
684	Explorer.EXE

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
1920	dzhppqxyme.exe
4696	dzhppqxyme.exe
4696	dzhppqxyme.exe
4696	dzhppqxyme.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe
2840	mstsc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4696	dzhppqxyme.exe
Token: SeDebugPrivilege	2840	mstsc.exe
Token: SeShutdownPrivilege	684	Explorer.EXE
Token: SeCreatePagefilePrivilege	684	Explorer.EXE

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 1920	4664	HesaphareketI-01.exe	80
PID 4664 wrote to memory of 1920	4664	HesaphareketI-01.exe	80
PID 4664 wrote to memory of 1920	4664	HesaphareketI-01.exe	80
PID 1920 wrote to memory of 4696	1920	dzhppqxyme.exe	82
PID 1920 wrote to memory of 4696	1920	dzhppqxyme.exe	82
PID 1920 wrote to memory of 4696	1920	dzhppqxyme.exe	82
PID 1920 wrote to memory of 4696	1920	dzhppqxyme.exe	82
PID 684 wrote to memory of 2840	684	Explorer.EXE	83
PID 684 wrote to memory of 2840	684	Explorer.EXE	83
PID 684 wrote to memory of 2840	684	Explorer.EXE	83
PID 2840 wrote to memory of 3816	2840	mstsc.exe	90
PID 2840 wrote to memory of 3816	2840	mstsc.exe	90
PID 2840 wrote to memory of 3816	2840	mstsc.exe	90

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:684
- C:\Users\Admin\AppData\Local\Temp\HesaphareketI-01.exe
  "C:\Users\Admin\AppData\Local\Temp\HesaphareketI-01.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Users\Admin\AppData\Local\Temp\dzhppqxyme.exe
    "C:\Users\Admin\AppData\Local\Temp\dzhppqxyme.exe" C:\Users\Admin\AppData\Local\Temp\wjmlthn.svr
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\dzhppqxyme.exe
      "C:\Users\Admin\AppData\Local\Temp\dzhppqxyme.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:4696
- C:\Windows\SysWOW64\mstsc.exe
  "C:\Windows\SysWOW64\mstsc.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:3816
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3816 -s 184
      4⤵
      Program crash
      PID:1996

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 420 -p 3816 -ip 3816
1⤵
PID:3672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dzhppqxyme.exe

Path C:\Users\Admin\AppData\Local\Temp\dzhppqxyme.exe
Size 56KB
SHA256 76480c64e98c600262b9bb9aef8d3e8ebe4d27f78e35d1f4cf2e818ab272b3c8
MD5 7c2b48ca1ce0227b8f6b31df4653d952
SHA1 2f6900fa9139cd5d525d6f9cae15927a33bc4721
SHA512 3133d6f8049a60a82a8ba5f9380023bdfc149de519e9ead54f211139b39004cb360557be0c9509ee39cee1609680f45416776ea6f16024365a30d9c620be25a3
SSDEEP 768:ZD5fyaLHKV8P1UcshmB4qNJLsrYg0CUXVW1i5euc35NvIMt4h+WEX5:zfyeKU1Uv+NJLmYg0BlWHuC5r425
MD5 SHA1 SHA512 SSDEEP

Submit Download

dzhppqxyme.exe

Path C:\Users\Admin\AppData\Local\Temp\dzhppqxyme.exe
Size 56KB
SHA256 76480c64e98c600262b9bb9aef8d3e8ebe4d27f78e35d1f4cf2e818ab272b3c8
MD5 7c2b48ca1ce0227b8f6b31df4653d952
SHA1 2f6900fa9139cd5d525d6f9cae15927a33bc4721
SHA512 3133d6f8049a60a82a8ba5f9380023bdfc149de519e9ead54f211139b39004cb360557be0c9509ee39cee1609680f45416776ea6f16024365a30d9c620be25a3
SSDEEP 768:ZD5fyaLHKV8P1UcshmB4qNJLsrYg0CUXVW1i5euc35NvIMt4h+WEX5:zfyeKU1Uv+NJLmYg0BlWHuC5r425
MD5 SHA1 SHA512 SSDEEP

Submit Download

dzhppqxyme.exe

Path C:\Users\Admin\AppData\Local\Temp\dzhppqxyme.exe
Size 56KB
SHA256 76480c64e98c600262b9bb9aef8d3e8ebe4d27f78e35d1f4cf2e818ab272b3c8
MD5 7c2b48ca1ce0227b8f6b31df4653d952
SHA1 2f6900fa9139cd5d525d6f9cae15927a33bc4721
SHA512 3133d6f8049a60a82a8ba5f9380023bdfc149de519e9ead54f211139b39004cb360557be0c9509ee39cee1609680f45416776ea6f16024365a30d9c620be25a3
SSDEEP 768:ZD5fyaLHKV8P1UcshmB4qNJLsrYg0CUXVW1i5euc35NvIMt4h+WEX5:zfyeKU1Uv+NJLmYg0BlWHuC5r425
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbfbggldric.yn

Path C:\Users\Admin\AppData\Local\Temp\wbfbggldric.yn
Size 206KB
SHA256 3652fe77053d4e01284603396a7ed6d9743d2cb0abdaa04e82e9883fcdca3f4c
MD5 8bc2e4d2cf5acf4c980c7837025b3b57
SHA1 5262a8322049bfeda4f9bc7bc9b8f74304388376
SHA512 e22005f7cd523fd1b729afd8aadbebef6732afddd2d2e66ecf15348740a5634a1395e29f00fff8da167db9d676a7319cd01e89f9657f386e04a0dcf174e7b14e
SSDEEP 3072:P/jM89f3lcuHRjX8P4LVNpPza1b6DwmQO+A1C4nFfl/UkcIHmqEDLpXZxXR:H3jd8+f4wzQO5g4n1l/hHarh
MD5 SHA1 SHA512 SSDEEP

Submit Download

wjmlthn.svr

Path C:\Users\Admin\AppData\Local\Temp\wjmlthn.svr
Size 6KB
SHA256 3df0ac4adbc263af7f6bd6e8b73b91411547fdc0739ec209253c713f8219c38f
MD5 28d148189193ad3dcbe4b05407ed85c6
SHA1 834df3704e432685a31485adcb047dadabc54115
SHA512 2020791fb823d9ce3c3fd745905904894a97dc3a42f64834d3263539f835a45db16a6b23e35a30b88cf87c056fdbdeb459682f814b068348946b7a45273c7d1d
SSDEEP 192:FarcRjDPhX1S1uFG8eoE5pDerwvI/qU0/j2:xPK1uFN9Wdvuqlj2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/684-150-0x0000000008310000-0x0000000008415000-memory.dmp

Download

memory/684-149-0x0000000008310000-0x0000000008415000-memory.dmp

Download

memory/684-142-0x00000000081F0000-0x0000000008304000-memory.dmp

Download

memory/2840-147-0x00000000032B0000-0x00000000035FA000-memory.dmp

Download

memory/2840-148-0x0000000003010000-0x000000000309F000-memory.dmp

Download

memory/2840-146-0x0000000001260000-0x000000000128D000-memory.dmp

Download

memory/2840-145-0x0000000000330000-0x000000000046A000-memory.dmp

Download

memory/4696-140-0x0000000000AC0000-0x0000000000E0A000-memory.dmp

Download

memory/4696-144-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/4696-141-0x0000000000570000-0x0000000000580000-memory.dmp

Download

memory/4696-139-0x0000000000400000-0x000000000042F000-memory.dmp

Download