Analysis
-
max time kernel
360s -
max time network
319s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
06-03-2023 14:08
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://download2261.mediafire.com/7j4xfh2u73jg9FqULilQLpe-cSMqWnr1NsqYUjHxXIGmJeoAp-u6yNLHs1mHr9JYe5PGfMFF1lYKifcO_xNz8M9wHKN6/hqhovdilryc5uuw/%C3%96denmi%C5%9F+Fatura.tgz
Resource
win10v2004-20230221-en
windows10-2004-x64
15 signatures
300 seconds
General
-
Target
https://download2261.mediafire.com/7j4xfh2u73jg9FqULilQLpe-cSMqWnr1NsqYUjHxXIGmJeoAp-u6yNLHs1mHr9JYe5PGfMFF1lYKifcO_xNz8M9wHKN6/hqhovdilryc5uuw/%C3%96denmi%C5%9F+Fatura.tgz
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3512 Ödenmiş Fatura.exe 2572 Ödenmiş Fatura.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Windows\CurrentVersion\Run chrome.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 2116 3512 WerFault.exe 110 4440 2572 WerFault.exe 122 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133225889427220460" chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings chrome.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1904 chrome.exe 1904 chrome.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 3512 Ödenmiş Fatura.exe 3512 Ödenmiş Fatura.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4440 7zFM.exe 1284 taskmgr.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeShutdownPrivilege 1904 chrome.exe Token: SeCreatePagefilePrivilege 1904 chrome.exe Token: SeShutdownPrivilege 1904 chrome.exe Token: SeCreatePagefilePrivilege 1904 chrome.exe Token: SeShutdownPrivilege 1904 chrome.exe Token: SeCreatePagefilePrivilege 1904 chrome.exe Token: SeShutdownPrivilege 1904 chrome.exe Token: SeCreatePagefilePrivilege 1904 chrome.exe Token: SeShutdownPrivilege 1904 chrome.exe Token: SeCreatePagefilePrivilege 1904 chrome.exe Token: SeShutdownPrivilege 1904 chrome.exe Token: SeCreatePagefilePrivilege 1904 chrome.exe Token: SeShutdownPrivilege 1904 chrome.exe Token: SeCreatePagefilePrivilege 1904 chrome.exe Token: SeShutdownPrivilege 1904 chrome.exe Token: SeCreatePagefilePrivilege 1904 chrome.exe Token: SeShutdownPrivilege 1904 chrome.exe Token: SeCreatePagefilePrivilege 1904 chrome.exe Token: SeShutdownPrivilege 1904 chrome.exe Token: SeCreatePagefilePrivilege 1904 chrome.exe Token: SeShutdownPrivilege 1904 chrome.exe Token: SeCreatePagefilePrivilege 1904 chrome.exe Token: SeShutdownPrivilege 1904 chrome.exe Token: SeCreatePagefilePrivilege 1904 chrome.exe Token: SeShutdownPrivilege 1904 chrome.exe Token: SeCreatePagefilePrivilege 1904 chrome.exe Token: SeShutdownPrivilege 1904 chrome.exe Token: SeCreatePagefilePrivilege 1904 chrome.exe Token: SeShutdownPrivilege 1904 chrome.exe Token: SeCreatePagefilePrivilege 1904 chrome.exe Token: SeShutdownPrivilege 1904 chrome.exe Token: SeCreatePagefilePrivilege 1904 chrome.exe Token: SeShutdownPrivilege 1904 chrome.exe Token: SeCreatePagefilePrivilege 1904 chrome.exe Token: SeShutdownPrivilege 1904 chrome.exe Token: SeCreatePagefilePrivilege 1904 chrome.exe Token: SeShutdownPrivilege 1904 chrome.exe Token: SeCreatePagefilePrivilege 1904 chrome.exe Token: SeRestorePrivilege 4440 7zFM.exe Token: 35 4440 7zFM.exe Token: SeSecurityPrivilege 4440 7zFM.exe Token: SeSecurityPrivilege 4440 7zFM.exe Token: SeDebugPrivilege 1284 taskmgr.exe Token: SeSystemProfilePrivilege 1284 taskmgr.exe Token: SeCreateGlobalPrivilege 1284 taskmgr.exe Token: SeDebugPrivilege 3512 Ödenmiş Fatura.exe Token: SeDebugPrivilege 2572 Ödenmiş Fatura.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 4440 7zFM.exe 4440 7zFM.exe 4440 7zFM.exe 4440 7zFM.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1904 chrome.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe 1284 taskmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1904 wrote to memory of 2072 1904 chrome.exe 85 PID 1904 wrote to memory of 2072 1904 chrome.exe 85 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 1944 1904 chrome.exe 86 PID 1904 wrote to memory of 4648 1904 chrome.exe 87 PID 1904 wrote to memory of 4648 1904 chrome.exe 87 PID 1904 wrote to memory of 228 1904 chrome.exe 88 PID 1904 wrote to memory of 228 1904 chrome.exe 88 PID 1904 wrote to memory of 228 1904 chrome.exe 88 PID 1904 wrote to memory of 228 1904 chrome.exe 88 PID 1904 wrote to memory of 228 1904 chrome.exe 88 PID 1904 wrote to memory of 228 1904 chrome.exe 88 PID 1904 wrote to memory of 228 1904 chrome.exe 88 PID 1904 wrote to memory of 228 1904 chrome.exe 88 PID 1904 wrote to memory of 228 1904 chrome.exe 88 PID 1904 wrote to memory of 228 1904 chrome.exe 88 PID 1904 wrote to memory of 228 1904 chrome.exe 88 PID 1904 wrote to memory of 228 1904 chrome.exe 88 PID 1904 wrote to memory of 228 1904 chrome.exe 88 PID 1904 wrote to memory of 228 1904 chrome.exe 88 PID 1904 wrote to memory of 228 1904 chrome.exe 88 PID 1904 wrote to memory of 228 1904 chrome.exe 88 PID 1904 wrote to memory of 228 1904 chrome.exe 88 PID 1904 wrote to memory of 228 1904 chrome.exe 88 PID 1904 wrote to memory of 228 1904 chrome.exe 88 PID 1904 wrote to memory of 228 1904 chrome.exe 88 PID 1904 wrote to memory of 228 1904 chrome.exe 88 PID 1904 wrote to memory of 228 1904 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://download2261.mediafire.com/7j4xfh2u73jg9FqULilQLpe-cSMqWnr1NsqYUjHxXIGmJeoAp-u6yNLHs1mHr9JYe5PGfMFF1lYKifcO_xNz8M9wHKN6/hqhovdilryc5uuw/%C3%96denmi%C5%9F+Fatura.tgz1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa4c089758,0x7ffa4c089768,0x7ffa4c0897782⤵PID:2072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1720,i,6027153286628726385,10735749004424762661,131072 /prefetch:22⤵PID:1944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1720,i,6027153286628726385,10735749004424762661,131072 /prefetch:82⤵PID:4648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1720,i,6027153286628726385,10735749004424762661,131072 /prefetch:82⤵PID:228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3080 --field-trial-handle=1720,i,6027153286628726385,10735749004424762661,131072 /prefetch:12⤵PID:4048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3184 --field-trial-handle=1720,i,6027153286628726385,10735749004424762661,131072 /prefetch:12⤵PID:3900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4808 --field-trial-handle=1720,i,6027153286628726385,10735749004424762661,131072 /prefetch:12⤵PID:4668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5272 --field-trial-handle=1720,i,6027153286628726385,10735749004424762661,131072 /prefetch:82⤵PID:928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 --field-trial-handle=1720,i,6027153286628726385,10735749004424762661,131072 /prefetch:82⤵PID:428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3940 --field-trial-handle=1720,i,6027153286628726385,10735749004424762661,131072 /prefetch:82⤵PID:3088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 --field-trial-handle=1720,i,6027153286628726385,10735749004424762661,131072 /prefetch:82⤵PID:4872
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4040
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4656
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Ödenmiş Fatura.tgz"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4440
-
C:\Users\Admin\Desktop\Ödenmiş Fatura.exe"C:\Users\Admin\Desktop\Ödenmiş Fatura.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3512 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3512 -s 11922⤵
- Program crash
PID:2116
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1284
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3512 -ip 35121⤵PID:3840
-
C:\Users\Admin\Desktop\Ödenmiş Fatura.exe"C:\Users\Admin\Desktop\Ödenmiş Fatura.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2572 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 11642⤵
- Program crash
PID:4440
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2572 -ip 25721⤵PID:4316
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
576B
MD577ca5e648f3ecbaa65c2c6fe7ca241e8
SHA1c7674faa26fb8ee38b5842d886c77dc11867cfd8
SHA256f6c38c3b66f1671722ac95cc425b723ab89d2beb52efb0d94cf638b012e880cb
SHA512e603f1911342213171f7a954eeb05338136cf46ac30006c3fd4ce6fb7ba5dc411c2be0ac4e642bc694c533875c8840b04675453f65b37ff124f7f829e9df584f
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
4KB
MD54d25685eadbfb66743d19c16915ce77a
SHA159039e03583c1badfef476ce891268c2f98f377e
SHA25614cb9be3de985cd2f821f41daccd36b5c6b9aaa89ffb1feecc2138c64c86deb8
SHA5123115171eb557ca992aec8969b7f2c57b1519951a03c638d98b4727d76b5e3dda3f6deec7c360e22c63ae4682091db71e9ab5ef9da2a467228e4f0710c6951555
-
Filesize
1KB
MD51edae5346e1175992afa5d67f41b8a1c
SHA1e864ff1e6f0b908615959cfbca47b3038c7abc27
SHA2561cc9e3d0eabfc25c5c87d1c95a98a1a2f6444f667dff22f97cee57795fd02fa3
SHA512bf66b8e997b08c67cdb228f22ff39eadd6a79b8a56326ec2206ce6d9e7bf6ed0749f081a79b8c23705206f99815419616d4595eb912ef6b0ceb3c32f5dd462e8
-
Filesize
6KB
MD5ad1c49cb76ad631cc752dafa63bbe4c5
SHA19094054dcf696a9f38974c95797ff589b1e1458f
SHA256bdca7b2ba0c10c7c5756e208b338a4d26e332a96221574a53976129c09038748
SHA5125c1433aa757c00c3cd7a53718a9620246299d7d89007712787191800ad83241c4997cc91e0c8a98705e0d1674a31c0b1880347bdf6531c6fdae49e1551fd670b
-
Filesize
6KB
MD5bee0ed822af2e5608ba540f80978491b
SHA179220ad9d10c4c8aabd559e682f948201857da08
SHA25631df9415e1b66ead4a63201993a65f9f7e46dda96d566a51b51132dbefc1a8f3
SHA512352f50196878cd9477e0963301e60fc34d2d2cc9fee5de338c4ecbd34c60170a4b5638fafc2ab9fe41e146537c693ca0eb35a55cb748ca79195811914f40a50f
-
Filesize
15KB
MD56c243893a548affc444a427a0d6ebe96
SHA1a4f55722df20c575d6fa6e74d25cbcd232d31d54
SHA2566afcc2f9377b3cb00a14f0e6034266eb37b4e844a670f06ad5e65edca0748eed
SHA51245ae9de0ad02223a25781b6917f0e3d47ba7f9eaa5fb6a06586707dcbbd4a4521c202ce3fdfc44e40384c18d04c46638c2363cee754a4ab9dd1502915a814480
-
Filesize
143KB
MD5b2f5f155c0325a039a1a972ee06a24ef
SHA12a62d28e27477c2c68e5195e961fe60ae2fd40b3
SHA2563e149dfb636ba59cc9317bb98493be50f8046792bde386f5ec2f9a381d44a053
SHA5125cbc0fb674783d5496e0af7df5376422701ed0853b624a2d7ae39db7386bccf11a60b4ee4f819ca634f1b8a225f1c865fe9cd7603a5623e8b65ba9bb9e7fbdd0
-
Filesize
143KB
MD502e202947876fb59046f25b486cf0d8f
SHA19523ef217de50418caa4a6e833bd094225836c87
SHA25654addede02042db2a74817b4c89f4774af2f0a0f0cf0828446e75a1c7d26645b
SHA512465fa73f6c58827fc836cff8063c00e330978017dbb1702396f01889e47626d6b98ca1f06f9b81634ec97123eff33d6dcfa070eaabbcabfaaef7e955b9506273
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
300.9MB
MD5510c670a2c6dc3289c4a8b6a528926a7
SHA1808ba64983a3338ea15791695e16b12ca3f6597b
SHA256313dc12daa962770177c6553a515078346655d832f37e1b4c1ab3ff97c0723a2
SHA512f8326c29b4d49a2a3a284677b930a021bb27946117a6710af1a9864f5984bb83988df43bd5a55a1a66e58bdc08b03e91403af5c1178119983a7efeaa7780441f
-
Filesize
300.9MB
MD5510c670a2c6dc3289c4a8b6a528926a7
SHA1808ba64983a3338ea15791695e16b12ca3f6597b
SHA256313dc12daa962770177c6553a515078346655d832f37e1b4c1ab3ff97c0723a2
SHA512f8326c29b4d49a2a3a284677b930a021bb27946117a6710af1a9864f5984bb83988df43bd5a55a1a66e58bdc08b03e91403af5c1178119983a7efeaa7780441f
-
Filesize
300.9MB
MD5510c670a2c6dc3289c4a8b6a528926a7
SHA1808ba64983a3338ea15791695e16b12ca3f6597b
SHA256313dc12daa962770177c6553a515078346655d832f37e1b4c1ab3ff97c0723a2
SHA512f8326c29b4d49a2a3a284677b930a021bb27946117a6710af1a9864f5984bb83988df43bd5a55a1a66e58bdc08b03e91403af5c1178119983a7efeaa7780441f
-
Filesize
1017KB
MD5680f36c113d32540add9d2fe93936791
SHA1b96d0d194902afd00e79bb46e99da23e2a15a71d
SHA25600e30f8674b21c61ee178f56d8d7baea8c109e382978c166bdde38beff83cd12
SHA5128293b148aae6e256c5ee35672aeae74d486e36083459d1a98835c316967b91fa9c2c62eec94b1bf26ab583ba798f7d5982a40930cc1e54edc9f715a1f19331a2