Analysis
-
max time kernel
91s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
27-01-2023 14:02
General
-
Target
REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exe
-
Size
7KB
-
MD5
2191219c54b8ae4fd655146a479a2c8c
-
SHA1
54b26e2cc5328f53acf0ba5be5a8a94da1008190
-
SHA256
0ddf7226ac77878f78a73875b0633229368d8e8c28acdd4469d65648d99adfc6
-
SHA512
8b5369c976a31b9a60da34698bcced445f4d561b1908e8b7e883715aa0031e04bafd19ae24b18133bf3816802f1a4fdc90214506dcb258bcc4bdaaec9fffafbb
-
SSDEEP
96:U/Ef/c/7yFyZ/nOci8cN0mMiUAmBVQttEkXnLFO0bjzNt:QEfkDyFETONB1LmYtzbTR
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exe"C:\Users\Admin\AppData\Local\Temp\REVİZE EDİLMİŞ TEKLİF VE SATIN ALMA EMRİ.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 14443⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4732 -ip 47321⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2088-138-0x00000000054E0000-0x0000000005546000-memory.dmpFilesize
408KB
-
memory/2088-140-0x0000000007340000-0x00000000079BA000-memory.dmpFilesize
6.5MB
-
memory/2088-134-0x0000000000000000-mapping.dmp
-
memory/2088-135-0x0000000002520000-0x0000000002556000-memory.dmpFilesize
216KB
-
memory/2088-136-0x0000000004E40000-0x0000000005468000-memory.dmpFilesize
6.2MB
-
memory/2088-137-0x0000000004C10000-0x0000000004C76000-memory.dmpFilesize
408KB
-
memory/2088-141-0x0000000006020000-0x000000000603A000-memory.dmpFilesize
104KB
-
memory/2088-139-0x0000000005B10000-0x0000000005B2E000-memory.dmpFilesize
120KB
-
memory/2372-132-0x0000000000670000-0x0000000000678000-memory.dmpFilesize
32KB
-
memory/2372-133-0x0000000006870000-0x0000000006892000-memory.dmpFilesize
136KB
-
memory/2488-142-0x0000000000000000-mapping.dmp
-
memory/4732-143-0x0000000000000000-mapping.dmp
-
memory/4732-144-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/4732-145-0x0000000005B90000-0x0000000006134000-memory.dmpFilesize
5.6MB
-
memory/4732-146-0x00000000057E0000-0x000000000587C000-memory.dmpFilesize
624KB