Analysis
-
max time kernel
119s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27-01-2023 14:02
Static task
static1
Behavioral task
behavioral1
Sample
REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exe
Resource
win10v2004-20221111-en
General
-
Target
REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exe
-
Size
7KB
-
MD5
2191219c54b8ae4fd655146a479a2c8c
-
SHA1
54b26e2cc5328f53acf0ba5be5a8a94da1008190
-
SHA256
0ddf7226ac77878f78a73875b0633229368d8e8c28acdd4469d65648d99adfc6
-
SHA512
8b5369c976a31b9a60da34698bcced445f4d561b1908e8b7e883715aa0031e04bafd19ae24b18133bf3816802f1a4fdc90214506dcb258bcc4bdaaec9fffafbb
-
SSDEEP
96:U/Ef/c/7yFyZ/nOci8cN0mMiUAmBVQttEkXnLFO0bjzNt:QEfkDyFETONB1LmYtzbTR
Malware Config
Signatures
-
Detect PureCrypter injector 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1152-56-0x0000000006670000-0x00000000068FC000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Disables RegEdit via registry modification 1 IoCs
Processes:
REG.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" REG.exe -
Disables Task Manager via registry modification
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 14 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exedescription pid process target process PID 1152 set thread context of 928 1152 REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exe MSBuild.exe -
Drops file in Windows directory 1 IoCs
Processes:
MSBuild.exedescription ioc process File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exeREVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exeMSBuild.exepid process 1568 powershell.exe 1152 REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exe 928 MSBuild.exe 928 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exepowershell.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 1152 REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exe Token: SeDebugPrivilege 1568 powershell.exe Token: SeDebugPrivilege 928 MSBuild.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exeMSBuild.exedescription pid process target process PID 1152 wrote to memory of 1568 1152 REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exe powershell.exe PID 1152 wrote to memory of 1568 1152 REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exe powershell.exe PID 1152 wrote to memory of 1568 1152 REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exe powershell.exe PID 1152 wrote to memory of 1568 1152 REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exe powershell.exe PID 1152 wrote to memory of 1760 1152 REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exe MSBuild.exe PID 1152 wrote to memory of 1760 1152 REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exe MSBuild.exe PID 1152 wrote to memory of 1760 1152 REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exe MSBuild.exe PID 1152 wrote to memory of 1760 1152 REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exe MSBuild.exe PID 1152 wrote to memory of 928 1152 REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exe MSBuild.exe PID 1152 wrote to memory of 928 1152 REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exe MSBuild.exe PID 1152 wrote to memory of 928 1152 REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exe MSBuild.exe PID 1152 wrote to memory of 928 1152 REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exe MSBuild.exe PID 1152 wrote to memory of 928 1152 REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exe MSBuild.exe PID 1152 wrote to memory of 928 1152 REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exe MSBuild.exe PID 1152 wrote to memory of 928 1152 REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exe MSBuild.exe PID 1152 wrote to memory of 928 1152 REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exe MSBuild.exe PID 1152 wrote to memory of 928 1152 REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exe MSBuild.exe PID 928 wrote to memory of 1208 928 MSBuild.exe REG.exe PID 928 wrote to memory of 1208 928 MSBuild.exe REG.exe PID 928 wrote to memory of 1208 928 MSBuild.exe REG.exe PID 928 wrote to memory of 1208 928 MSBuild.exe REG.exe -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exe"C:\Users\Admin\AppData\Local\Temp\REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
- Accesses Microsoft Outlook profiles
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f3⤵
- Disables RegEdit via registry modification
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/928-69-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/928-70-0x000000000045299E-mapping.dmp
-
memory/928-63-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/928-64-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/928-74-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/928-66-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/928-72-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/928-68-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1152-55-0x0000000075881000-0x0000000075883000-memory.dmpFilesize
8KB
-
memory/1152-56-0x0000000006670000-0x00000000068FC000-memory.dmpFilesize
2.5MB
-
memory/1152-62-0x00000000056B0000-0x0000000005716000-memory.dmpFilesize
408KB
-
memory/1152-54-0x00000000012A0000-0x00000000012A8000-memory.dmpFilesize
32KB
-
memory/1208-76-0x0000000000000000-mapping.dmp
-
memory/1568-60-0x000000006F5A0000-0x000000006FB4B000-memory.dmpFilesize
5.7MB
-
memory/1568-59-0x000000006F5A0000-0x000000006FB4B000-memory.dmpFilesize
5.7MB
-
memory/1568-61-0x000000006F5A0000-0x000000006FB4B000-memory.dmpFilesize
5.7MB
-
memory/1568-57-0x0000000000000000-mapping.dmp