Analysis
- max time kernel
135s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
15/06/2023, 22:35
General
- Target 24.05.2023_tahsil_senedi_bilgileri.xls.exe
- Size 649KB
- Sample230615-2hnanabe21
- SHA256 70e6864d836f4750789712dcb97587a60c5317e40ec5bccdbebff3c0fbfd7967
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\24.05.2023_tahsil_senedi_bilgileri.xls.exe"C:\Users\Admin\AppData\Local\Temp\24.05.2023_tahsil_senedi_bilgileri.xls.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bRRgPzhf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bRRgPzhf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6DBE.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\24.05.2023_tahsil_senedi_bilgileri.xls.exe"C:\Users\Admin\AppData\Local\Temp\24.05.2023_tahsil_senedi_bilgileri.xls.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_1sv3w50n.mip.ps1
tmp6DBE.tmp
memory/2256-179-0x000000007F280000-0x000000007F290000-memory.dmp
memory/2256-177-0x0000000006980000-0x000000000699E000-memory.dmp
memory/2256-186-0x00000000079F0000-0x00000000079F8000-memory.dmp
memory/2256-185-0x0000000007A10000-0x0000000007A2A000-memory.dmp
memory/2256-184-0x0000000007900000-0x000000000790E000-memory.dmp
memory/2256-144-0x0000000004E20000-0x0000000004E56000-memory.dmp
memory/2256-183-0x0000000007950000-0x00000000079E6000-memory.dmp
memory/2256-146-0x0000000002AC0000-0x0000000002AD0000-memory.dmp
memory/2256-147-0x0000000002AC0000-0x0000000002AD0000-memory.dmp
memory/2256-148-0x0000000005490000-0x0000000005AB8000-memory.dmp
memory/2256-182-0x0000000007740000-0x000000000774A000-memory.dmp
memory/2256-151-0x00000000053F0000-0x0000000005412000-memory.dmp
memory/2256-152-0x0000000005CF0000-0x0000000005D56000-memory.dmp
memory/2256-181-0x00000000076D0000-0x00000000076EA000-memory.dmp
memory/2256-180-0x0000000007D20000-0x000000000839A000-memory.dmp
memory/2256-158-0x0000000005DD0000-0x0000000005E36000-memory.dmp
memory/2256-178-0x0000000002AC0000-0x0000000002AD0000-memory.dmp
memory/2256-165-0x00000000063D0000-0x00000000063EE000-memory.dmp
memory/2256-166-0x00000000069A0000-0x00000000069D2000-memory.dmp
memory/2256-167-0x0000000070CB0000-0x0000000070CFC000-memory.dmp
memory/2340-163-0x0000000001190000-0x00000000014DA000-memory.dmp
memory/2340-164-0x0000000000400000-0x000000000042F000-memory.dmp
memory/2340-149-0x0000000000400000-0x000000000042F000-memory.dmp
memory/4264-134-0x00000000054B0000-0x0000000005A54000-memory.dmp
memory/4264-136-0x0000000005160000-0x000000000516A000-memory.dmp
memory/4264-135-0x0000000004FB0000-0x0000000005042000-memory.dmp
memory/4264-133-0x0000000000550000-0x00000000005F6000-memory.dmp
memory/4264-139-0x0000000006C50000-0x0000000006CEC000-memory.dmp
memory/4264-138-0x0000000004F40000-0x0000000004F50000-memory.dmp
memory/4264-137-0x0000000004F40000-0x0000000004F50000-memory.dmp