4164d3bec950ac04c1a2e8edc8b4bccc4526daa5400e011c2622e9b08c720901

Analysis

max time kernel
61s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24/04/2023, 09:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TEKLİF TALEP Doğan Şirketler Grubu Holding AŞ_PDF.exe
Size 706KB
Sample230424-k7wvnacf21
SHA256 4164d3bec950ac04c1a2e8edc8b4bccc4526daa5400e011c2622e9b08c720901
MD5 9c29cb6a299e45a2f5e688ca9d072b1c
SHA1 55d12d2c76fa559d920cd07f93767ed80eeb4cd4
SHA512 8097d0fe60c8904b1747debea2e87cd2110bbf8ba96c6a211fbc8ac0eadbbe35944417eb0c3fe23116db34fb9d3f11b24d183a7d0189d8da86b9b94abdae6674
SSDEEP 12288:j9aefjUPKHqHR1RHVpYmbO0LgyaLQ0uRZPgCDiAzILY:j97fjUIqHR1R1pYmRgyt0uLCD
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1016	1744	WerFault.exe	27

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1320	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1744	TEKLİF TALEP Doğan Şirketler Grubu Holding AŞ_PDF.exe
1744	TEKLİF TALEP Doğan Şirketler Grubu Holding AŞ_PDF.exe
1744	TEKLİF TALEP Doğan Şirketler Grubu Holding AŞ_PDF.exe
1744	TEKLİF TALEP Doğan Şirketler Grubu Holding AŞ_PDF.exe
1744	TEKLİF TALEP Doğan Şirketler Grubu Holding AŞ_PDF.exe
1744	TEKLİF TALEP Doğan Şirketler Grubu Holding AŞ_PDF.exe
1744	TEKLİF TALEP Doğan Şirketler Grubu Holding AŞ_PDF.exe
1924	powershell.exe
988	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1744	TEKLİF TALEP Doğan Şirketler Grubu Holding AŞ_PDF.exe
Token: SeDebugPrivilege	1924	powershell.exe
Token: SeDebugPrivilege	988	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 1924	1744	TEKLİF TALEP Doğan Şirketler Grubu Holding AŞ_PDF.exe	28
PID 1744 wrote to memory of 1924	1744	TEKLİF TALEP Doğan Şirketler Grubu Holding AŞ_PDF.exe	28
PID 1744 wrote to memory of 1924	1744	TEKLİF TALEP Doğan Şirketler Grubu Holding AŞ_PDF.exe	28
PID 1744 wrote to memory of 1924	1744	TEKLİF TALEP Doğan Şirketler Grubu Holding AŞ_PDF.exe	28
PID 1744 wrote to memory of 988	1744	TEKLİF TALEP Doğan Şirketler Grubu Holding AŞ_PDF.exe	30
PID 1744 wrote to memory of 988	1744	TEKLİF TALEP Doğan Şirketler Grubu Holding AŞ_PDF.exe	30
PID 1744 wrote to memory of 988	1744	TEKLİF TALEP Doğan Şirketler Grubu Holding AŞ_PDF.exe	30
PID 1744 wrote to memory of 988	1744	TEKLİF TALEP Doğan Şirketler Grubu Holding AŞ_PDF.exe	30
PID 1744 wrote to memory of 1320	1744	TEKLİF TALEP Doğan Şirketler Grubu Holding AŞ_PDF.exe	33
PID 1744 wrote to memory of 1320	1744	TEKLİF TALEP Doğan Şirketler Grubu Holding AŞ_PDF.exe	33
PID 1744 wrote to memory of 1320	1744	TEKLİF TALEP Doğan Şirketler Grubu Holding AŞ_PDF.exe	33
PID 1744 wrote to memory of 1320	1744	TEKLİF TALEP Doğan Şirketler Grubu Holding AŞ_PDF.exe	33
PID 1744 wrote to memory of 1016	1744	TEKLİF TALEP Doğan Şirketler Grubu Holding AŞ_PDF.exe	34
PID 1744 wrote to memory of 1016	1744	TEKLİF TALEP Doğan Şirketler Grubu Holding AŞ_PDF.exe	34
PID 1744 wrote to memory of 1016	1744	TEKLİF TALEP Doğan Şirketler Grubu Holding AŞ_PDF.exe	34
PID 1744 wrote to memory of 1016	1744	TEKLİF TALEP Doğan Şirketler Grubu Holding AŞ_PDF.exe	34

C:\Users\Admin\AppData\Local\Temp\TEKLİF TALEP Doğan Şirketler Grubu Holding AŞ_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\TEKLİF TALEP Doğan Şirketler Grubu Holding AŞ_PDF.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\TEKLİF TALEP Doğan Şirketler Grubu Holding AŞ_PDF.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1924
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SexaxXPBHLFxs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:988
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SexaxXPBHLFxs" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEAEC.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 1056
  2⤵
  - Program crash
  PID:1016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpEAEC.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpEAEC.tmp
Size 1KB
SHA256 9d1365766f5b1795fe2f52c5a2f60c1eaf60e9fc404cb5d89e710d1bd4200a04
MD5 2ccd27eea7355a1a534032573975a722
SHA1 626309597557fa7b5201e74f59a260e45b20733c
SHA512 e68fb2b03762529d2643365e6f15c59f906edf869516179d274bcad9ec375d5f37b1e7c5537e329592e3c7d13e1f25d1f47f7add4c6d0cd582de19bc901bd181
MD5 SHA1 SHA512

Submit Download

Z1XUIACK5TO6FVM5N74R.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Z1XUIACK5TO6FVM5N74R.temp
Size 7KB
SHA256 fd04d7c8329d1cb0bacff5fe7f90176f1845cebe9d2f47bb13335155943c4657
MD5 43930afb5ffbc1221068197efe2e7265
SHA1 d8d9c46047e144b62d1a3fc8b5a65bb2f9b4ece1
SHA512 5c457853657fe04e8d7453a4bd1a727974a8eef860b5b478be8d046232cbf7af73c8524c694b33317b300c4de21547bf91bb2b315a05ecd8aa096f4cb8b21f7a
SSDEEP 96:unVSCRM84nqvsqvJCwoZkunVSCRM84nqvsEHyqvJCworvkcRRBQH0+f+7iCXlUV4:uV7cUoZkuV7cAHnorvkcl1+f+7iCSJW
MD5 SHA1 SHA512 SSDEEP

Submit Download

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 fd04d7c8329d1cb0bacff5fe7f90176f1845cebe9d2f47bb13335155943c4657
MD5 43930afb5ffbc1221068197efe2e7265
SHA1 d8d9c46047e144b62d1a3fc8b5a65bb2f9b4ece1
SHA512 5c457853657fe04e8d7453a4bd1a727974a8eef860b5b478be8d046232cbf7af73c8524c694b33317b300c4de21547bf91bb2b315a05ecd8aa096f4cb8b21f7a
SSDEEP 96:unVSCRM84nqvsqvJCwoZkunVSCRM84nqvsEHyqvJCworvkcRRBQH0+f+7iCXlUV4:uV7cUoZkuV7cAHnorvkcl1+f+7iCSJW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/988-73-0x00000000026F0000-0x0000000002730000-memory.dmp

Download

memory/1744-57-0x0000000004AF0000-0x0000000004B30000-memory.dmp

Download

memory/1744-59-0x0000000004CA0000-0x0000000004D16000-memory.dmp

Download

memory/1744-58-0x0000000000560000-0x000000000056C000-memory.dmp

Download

memory/1744-54-0x0000000000370000-0x0000000000426000-memory.dmp

Download

memory/1744-56-0x0000000000440000-0x0000000000454000-memory.dmp

Download

memory/1744-72-0x00000000050C0000-0x00000000050FC000-memory.dmp

Download

memory/1744-55-0x0000000004AF0000-0x0000000004B30000-memory.dmp

Download

memory/1924-74-0x0000000002140000-0x0000000002180000-memory.dmp

Download

memory/1924-75-0x0000000002140000-0x0000000002180000-memory.dmp

Download

memory/1924-76-0x0000000002140000-0x0000000002180000-memory.dmp

Download