f094e529916bf6100f52ccc13de28eee3ceddd90d92c6eb9c6c3ec527472de3c

Analysis

max time kernel
13s
max time network
39s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/02/2023, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hesaphareketi-01.pdf.exe
Size 623KB
Sample230206-vsqefaac5x
SHA256 d542654502d1d20bd12562b35902d69e78236e4fc1246617788bb8d0d695b86c
MD5 a7d950c2b949ec4d3270dfe1ba96efe6
SHA1 be4c132772d1e24c5316cd78467564d38e224202
SHA512 c98e6d5a27f36b959e59cea008296e436c063b425fc55f4d576219f05ec940a5a3c3afb2ab5cf5a159bcd73e76926a61c88f81f3273a9751c2a69d9dd6f9bd9e
SSDEEP 12288:+YPXhRRZmGG+QOa7KmkZ/2Slhkc/6jL1vCd1maggzVI0n6E:+YPRRrIKmk1rkc/QLomaggxnn6E
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3728	mdsozwlzpn.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\satmb = "C:\\Users\\Admin\\AppData\\Roaming\\mmsdtflcam\\lxqk.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\mdsozwlzpn.exe\" C:\\Users\\Admin\\AppData\\Local"	mdsozwlzpn.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3728 set thread context of 2828	3728	mdsozwlzpn.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3728	mdsozwlzpn.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 3728	1044	hesaphareketi-01.pdf.exe	81
PID 1044 wrote to memory of 3728	1044	hesaphareketi-01.pdf.exe	81
PID 1044 wrote to memory of 3728	1044	hesaphareketi-01.pdf.exe	81
PID 3728 wrote to memory of 2828	3728	mdsozwlzpn.exe	82
PID 3728 wrote to memory of 2828	3728	mdsozwlzpn.exe	82
PID 3728 wrote to memory of 2828	3728	mdsozwlzpn.exe	82
PID 3728 wrote to memory of 2828	3728	mdsozwlzpn.exe	82

C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Users\Admin\AppData\Local\Temp\mdsozwlzpn.exe
  "C:\Users\Admin\AppData\Local\Temp\mdsozwlzpn.exe" C:\Users\Admin\AppData\Local\Temp\tgyzwlkmjer.ywh
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Users\Admin\AppData\Local\Temp\mdsozwlzpn.exe
    "C:\Users\Admin\AppData\Local\Temp\mdsozwlzpn.exe"
    3⤵
    PID:2828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mdsozwlzpn.exe

Path C:\Users\Admin\AppData\Local\Temp\mdsozwlzpn.exe
Size 361KB
SHA256 5874e3f21e3e787ab9bd1eca05066861e2d4cd98d9b5c21cbaf727ac5c28cc67
MD5 64ef5d5eebc334b0afffee3638e35960
SHA1 5063edb65d751a4158a84ec4f65eed387a96bca8
SHA512 67a2da558d886ea2637d3f65e7f0af1bc07d2cfcb40703ed37c7f8524b376546350d962357d08a5d6708131d59e264cce71901342769bafd53511ac2831ad14f
SSDEEP 6144:mWYtu0D9bhoKSoj/QED03mc8+z1zQpb+g4feMF:mWYI0D9bhoK1j/HD03n1zvxF
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdsozwlzpn.exe

Path C:\Users\Admin\AppData\Local\Temp\mdsozwlzpn.exe
Size 361KB
SHA256 5874e3f21e3e787ab9bd1eca05066861e2d4cd98d9b5c21cbaf727ac5c28cc67
MD5 64ef5d5eebc334b0afffee3638e35960
SHA1 5063edb65d751a4158a84ec4f65eed387a96bca8
SHA512 67a2da558d886ea2637d3f65e7f0af1bc07d2cfcb40703ed37c7f8524b376546350d962357d08a5d6708131d59e264cce71901342769bafd53511ac2831ad14f
SSDEEP 6144:mWYtu0D9bhoKSoj/QED03mc8+z1zQpb+g4feMF:mWYI0D9bhoK1j/HD03n1zvxF
MD5 SHA1 SHA512 SSDEEP

Submit Download

tgyzwlkmjer.ywh

Path C:\Users\Admin\AppData\Local\Temp\tgyzwlkmjer.ywh
Size 7KB
SHA256 5d7f25edaab63bdb2ab87c3666854cc8a31fc635388fc7e47e70ab8b684fc42d
MD5 81098c0e3df3d213e316596cd21e3d32
SHA1 22e20813fab1fae452ff5828541ac9105f439bce
SHA512 dace55575a26a6b62753651737fff9b7893c41e057fb8295d10df91f707fe0ad0c1f09848dd33617baa6d9625ba5d6faed873c499b3f21d09034e9f249a79527
SSDEEP 192:darcitQvArWiPvJdb98EhMnRrsdc0mh8VCERoAdeSL:uCYrNPvJR+Rrsdco86d1
MD5 SHA1 SHA512 SSDEEP

Submit Download

xdpejzl.rz

Path C:\Users\Admin\AppData\Local\Temp\xdpejzl.rz
Size 495KB
SHA256 a83c2d72ee314f6f683176c0d908eadccb9a75a10a580461daf2e9bb62bc8b0a
MD5 f600244a2eb4a1810d2dc9d75c781e1e
SHA1 5ac6b7051e18d7a8b32680437839de39e7249b01
SHA512 4a4b0321069072bf002f5a4d023e8e3037c83ef4bb90d21f5bc5412f86992670f2f49cd49c12e7c9733586aab53531dae00fee62532c39bb8d04dacdb802a607
SSDEEP 12288:CbTEO2J6qzV2KdedH3NZ3H6W0Krkmt3yCksujJLC9:CbZ2J6AVrdiH3xkm4xsuo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads