Resubmissions
05-12-2023 11:48
231205-nyerkabb78 105-12-2023 11:37
231205-nrgmksbb52 105-12-2023 11:30
231205-nmktfaag4t 101-12-2023 08:49
231201-kreansgc79 1001-12-2023 07:29
231201-ja8brafh46 1001-12-2023 07:25
231201-h9ggmsfh38 730-11-2023 13:08
231130-qc7xbscd2x 730-11-2023 08:58
231130-kw7g1saa3s 127-11-2023 07:20
231127-h6jslafb53 10Analysis
-
max time kernel
196s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
05-12-2023 11:48
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.mediafire.com/file/t9usn5skz63s9p9/Sipari%C5%9F+%C3%96zellikleri+pdf.tgz/file
Resource
win7-20231023-en
General
-
Target
https://www.mediafire.com/file/t9usn5skz63s9p9/Sipari%C5%9F+%C3%96zellikleri+pdf.tgz/file
Malware Config
Signatures
-
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 60032ced7027da01 iexplore.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "407938758" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{28FDEA71-9364-11EE-A475-CE6C5FBC16FC} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1744 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1744 iexplore.exe 1744 iexplore.exe 2676 IEXPLORE.EXE 2676 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
iexplore.execontrol.exedescription pid process target process PID 1744 wrote to memory of 2676 1744 iexplore.exe IEXPLORE.EXE PID 1744 wrote to memory of 2676 1744 iexplore.exe IEXPLORE.EXE PID 1744 wrote to memory of 2676 1744 iexplore.exe IEXPLORE.EXE PID 1744 wrote to memory of 2676 1744 iexplore.exe IEXPLORE.EXE PID 292 wrote to memory of 2452 292 control.exe rundll32.exe PID 292 wrote to memory of 2452 292 control.exe rundll32.exe PID 292 wrote to memory of 2452 292 control.exe rundll32.exe
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.mediafire.com/file/t9usn5skz63s9p9/Sipari%C5%9F+%C3%96zellikleri+pdf.tgz/file1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1744 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2676
-
C:\Windows\System32\control.exe"C:\Windows\System32\control.exe" "C:\Windows\system32\appwiz.cpl",1⤵
- Suspicious use of WriteProcessMemory
PID:292 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\system32\appwiz.cpl",2⤵PID:2452
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵PID:2220
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5e12af1c249d9ff7803d1a7e549ec58b8
SHA115cc9766f50ccf1630c9c632e9f62ba046d60d44
SHA2563f4431ff6aea727a3c11c919d8c3ae7bdb4058bb63027543669507da0d520098
SHA512ad4d1cd87a347a2bf614b2dc7b2a4c3854fd1df7ed7a57cf563da104266276d6ad7b33e8020c3a10b46589ca51c3a5c3c20df9bb92a820d26901fe33f216b4cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcc7d8c8aa9838147c64fbe354e900ca
SHA1f2db4e5711102958a77167c99ee445afd88cdbce
SHA256e693e68b2dd15a554c8d77fa8cacc53856df6950f37053e65109e93a5dbece10
SHA5127ce3721158f7eeb04efdd49dfaf71c609f1a1d7cbfbb1af70b3f5c1503602b549836e2e997129f0f5307f604a0a83c20d2c10909dccc643960e4b2fbf52dcc36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2bb1e041cbc3877c7111b90829a57a8
SHA19a20791629dd8792ca8e40880a97e32f984bbe33
SHA256229d8563999693fa85ef513a0164b58fa6aadfbf1306301d6d77cf3b22a81d70
SHA512a4e99b9fc0ea3f2a08c0fa6169ee6d106c92ace153e8a178a8f5ab39d9c88098925eea98887f128bb6d17641821f410ffb39a5150571e13385fad29984b9b613
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593725733e4d5e4533a980550c3b3b90f
SHA1c5f2866ca4bd8ca81ca82124f62068b6865c2cf2
SHA256165d99d6572dc04a3a5f3c1e650e07123515b031f0adbd61b154a7281fddab65
SHA512120eef0c55ed6c40f824f676b685083819d6a71619a8dca1c7ac942008aaf1fab4d2dbc351e73e55f1b304fcb2899f0a95c66826aa838d909b01a34a8b1cf285
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0638b12f46db24fd2aebc93f2522737
SHA14c5d9e6456f03228f850c24d084e849c9e245820
SHA256c37c87dc4fa20427c2782f76f312b40e9358cea66b8f742fe7a7149b1c9a0d28
SHA51256935ffa6d6e981e0f87fc3c39610cf9be8cb4e5a53a8e74ef8c9e7ef5997d47e249b1a4b5a476af854c1f9aa9824215b0a50782daca6122bf7cebb37bb02f96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50445936c32e971fc6cbae2a75c53e196
SHA11784511b1f011bfc7084d17bec04e21c12fcae63
SHA2569379ed88f1f0ddcebadaa19c3d10534c6333722de04db96744bed1e3c52ac28e
SHA5120301ad9c2692da1054615da1d48446aea38c31e7e0364daa87f52d191b0548eecaa98c3700d69357984bb59f3ed18436234de90d5ab448748b80448e6f9a2b9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500b599181dfe337b98f16b06ec66daba
SHA1951b26929242adeef50148dc55fbb23c9d5a81cf
SHA256e0d81c4a9fa7b3f250e372f52246f5b8330cd6befea65582caf43d5337c1b5aa
SHA512e74fd2ed9a2029d592c374e54c1ab1f03227a3488312d2f3fa239a075d4dac6f6a6587f99d9b21fd6b67074865743bfe5c6ffed54ce6a2e747d5d44b6a0bdcc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55126412a9b1ec3e6475e2a6ccebff6ba
SHA1fbb2e7208623985916cecbc590b82226c4147361
SHA25632f75817689c3004255698ed2747188c762f92bb52f1eb5eb9d0426276081a52
SHA512a65b9c2852131960036adb5231dd1de36d6ce1f1410ff15892692c9a1702a46f1bbb3a3eaac29e902f7b201d7009d6b1c9425e02745a648f7ce38efec6e593df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb3e8f922d1857c5fa460eda093fff17
SHA17d5a11f777616bf3dd68b1f47fe0ce643c4db0c4
SHA256757191fdef6c2a4c22760ed34e9c917adc13c2cdddb3527865e8ccca825b748c
SHA5120781f5f9e3e04884ab0ff041f2eb2a087087b94e4d14653d983006ee60df8184a1a936fa4fd2515aaccea6c37d1c4d6b02e4c2ecc5f26b1a5d846c95aea0abe5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508794b96d5a46ef40162208d07d100cd
SHA1319dec9ff7e2837e647b1b87dc2495e3e9e5a04d
SHA256ad0e4e55c2d22267a1449a9bf359fb7072add637f669f1e3f52a034c4cbb37f3
SHA512f9ec32e3a5362a0c2026b449fece7d87fae20603e3f40e07aab1ec436986f1aad82949dece7f230ef0595a784b3c64d027ddac6926d75fba1184b30a31c766ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5040b16f7576ed33f6995ae320a56b9f1
SHA1bf7abff78f9900c624ab4318c1efec56c990e3c8
SHA2564405857f37ab710ba29c90744e6e10e37144102ad95dcdbd56202afcd5c7daeb
SHA5126c666c7671ab4c6d1e4953dfbaeae8efe34abd4d0d3662ecc25542cc2be7b6eefeedd620d1122b58ce7a99273d23d03c02d6dea6b61852004544a88f992d935f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6e09bc02d2d0a06e3be19f52f5e4603
SHA1c3b20cdc62763c423bed525faecde9920b971cd9
SHA2560648fd6c910558358598243506a0aa65d8a5acb9185b0ba508bb9017f9df8596
SHA512ef825d34c77c024cf0d2ac5fa1e031c7f92e5d742ab56cb9d6709e73a2a634dbf90ebb3bd9812bf4f5177d7cdc1f84084466204c4b0fdd60352c03d17a13c881
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD51cd640d65eb58a52c3d229afef28121d
SHA19433107ab0d26871c1fef5d99d112df92b7ce7c7
SHA256f24c9c88eb225e1414a065207b88a40a919e225df75fa9b7ee28a0cd88b330be
SHA5123971fa3ed2b8f0b75c50245dc3f99b858b5ea80af1911566e5014321854a53dafd94f7e52ea42de5ef45ef602aa3eb3dc16c83305b3861a57b87bafeabe15e67
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06