hxxps://www[.]mediafire[.]com/file/t9usn5skz63s9p9/Sipari%C5%9F+%C3%96zellikleri+pdf[.]tgz/file

max time kernel
196s
max time network
154s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
05-12-2023 11:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/t9usn5skz63s9p9/Sipari%C5%9F+%C3%96zellikleri+pdf.tgz/file

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 60032ced7027da01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "407938758"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{28FDEA71-9364-11EE-A475-CE6C5FBC16FC} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1744 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1744 iexplore.exe
1744 iexplore.exe
2676 IEXPLORE.EXE
2676 IEXPLORE.EXE

pid	process
1744	iexplore.exe

pid	process
1744	iexplore.exe
1744	iexplore.exe
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

iexplore.execontrol.exe

description	pid	process	target process
PID 1744 wrote to memory of 2676	1744	iexplore.exe	IEXPLORE.EXE
PID 1744 wrote to memory of 2676	1744	iexplore.exe	IEXPLORE.EXE
PID 1744 wrote to memory of 2676	1744	iexplore.exe	IEXPLORE.EXE
PID 1744 wrote to memory of 2676	1744	iexplore.exe	IEXPLORE.EXE
PID 292 wrote to memory of 2452	292	control.exe	rundll32.exe
PID 292 wrote to memory of 2452	292	control.exe	rundll32.exe
PID 292 wrote to memory of 2452	292	control.exe	rundll32.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.mediafire.com/file/t9usn5skz63s9p9/Sipari%C5%9F+%C3%96zellikleri+pdf.tgz/file
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1744 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2676

C:\Windows\System32\control.exe
"C:\Windows\System32\control.exe" "C:\Windows\system32\appwiz.cpl",
1⤵
- Suspicious use of WriteProcessMemory
PID:292

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\system32\appwiz.cpl",
2⤵
PID:2452

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
e12af1c249d9ff7803d1a7e549ec58b8

SHA1
15cc9766f50ccf1630c9c632e9f62ba046d60d44

SHA256
3f4431ff6aea727a3c11c919d8c3ae7bdb4058bb63027543669507da0d520098

SHA512
ad4d1cd87a347a2bf614b2dc7b2a4c3854fd1df7ed7a57cf563da104266276d6ad7b33e8020c3a10b46589ca51c3a5c3c20df9bb92a820d26901fe33f216b4cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcc7d8c8aa9838147c64fbe354e900ca

SHA1
f2db4e5711102958a77167c99ee445afd88cdbce

SHA256
e693e68b2dd15a554c8d77fa8cacc53856df6950f37053e65109e93a5dbece10

SHA512
7ce3721158f7eeb04efdd49dfaf71c609f1a1d7cbfbb1af70b3f5c1503602b549836e2e997129f0f5307f604a0a83c20d2c10909dccc643960e4b2fbf52dcc36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2bb1e041cbc3877c7111b90829a57a8

SHA1
9a20791629dd8792ca8e40880a97e32f984bbe33

SHA256
229d8563999693fa85ef513a0164b58fa6aadfbf1306301d6d77cf3b22a81d70

SHA512
a4e99b9fc0ea3f2a08c0fa6169ee6d106c92ace153e8a178a8f5ab39d9c88098925eea98887f128bb6d17641821f410ffb39a5150571e13385fad29984b9b613

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93725733e4d5e4533a980550c3b3b90f

SHA1
c5f2866ca4bd8ca81ca82124f62068b6865c2cf2

SHA256
165d99d6572dc04a3a5f3c1e650e07123515b031f0adbd61b154a7281fddab65

SHA512
120eef0c55ed6c40f824f676b685083819d6a71619a8dca1c7ac942008aaf1fab4d2dbc351e73e55f1b304fcb2899f0a95c66826aa838d909b01a34a8b1cf285

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0638b12f46db24fd2aebc93f2522737

SHA1
4c5d9e6456f03228f850c24d084e849c9e245820

SHA256
c37c87dc4fa20427c2782f76f312b40e9358cea66b8f742fe7a7149b1c9a0d28

SHA512
56935ffa6d6e981e0f87fc3c39610cf9be8cb4e5a53a8e74ef8c9e7ef5997d47e249b1a4b5a476af854c1f9aa9824215b0a50782daca6122bf7cebb37bb02f96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0445936c32e971fc6cbae2a75c53e196

SHA1
1784511b1f011bfc7084d17bec04e21c12fcae63

SHA256
9379ed88f1f0ddcebadaa19c3d10534c6333722de04db96744bed1e3c52ac28e

SHA512
0301ad9c2692da1054615da1d48446aea38c31e7e0364daa87f52d191b0548eecaa98c3700d69357984bb59f3ed18436234de90d5ab448748b80448e6f9a2b9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00b599181dfe337b98f16b06ec66daba

SHA1
951b26929242adeef50148dc55fbb23c9d5a81cf

SHA256
e0d81c4a9fa7b3f250e372f52246f5b8330cd6befea65582caf43d5337c1b5aa

SHA512
e74fd2ed9a2029d592c374e54c1ab1f03227a3488312d2f3fa239a075d4dac6f6a6587f99d9b21fd6b67074865743bfe5c6ffed54ce6a2e747d5d44b6a0bdcc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5126412a9b1ec3e6475e2a6ccebff6ba

SHA1
fbb2e7208623985916cecbc590b82226c4147361

SHA256
32f75817689c3004255698ed2747188c762f92bb52f1eb5eb9d0426276081a52

SHA512
a65b9c2852131960036adb5231dd1de36d6ce1f1410ff15892692c9a1702a46f1bbb3a3eaac29e902f7b201d7009d6b1c9425e02745a648f7ce38efec6e593df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb3e8f922d1857c5fa460eda093fff17

SHA1
7d5a11f777616bf3dd68b1f47fe0ce643c4db0c4

SHA256
757191fdef6c2a4c22760ed34e9c917adc13c2cdddb3527865e8ccca825b748c

SHA512
0781f5f9e3e04884ab0ff041f2eb2a087087b94e4d14653d983006ee60df8184a1a936fa4fd2515aaccea6c37d1c4d6b02e4c2ecc5f26b1a5d846c95aea0abe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08794b96d5a46ef40162208d07d100cd

SHA1
319dec9ff7e2837e647b1b87dc2495e3e9e5a04d

SHA256
ad0e4e55c2d22267a1449a9bf359fb7072add637f669f1e3f52a034c4cbb37f3

SHA512
f9ec32e3a5362a0c2026b449fece7d87fae20603e3f40e07aab1ec436986f1aad82949dece7f230ef0595a784b3c64d027ddac6926d75fba1184b30a31c766ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
040b16f7576ed33f6995ae320a56b9f1

SHA1
bf7abff78f9900c624ab4318c1efec56c990e3c8

SHA256
4405857f37ab710ba29c90744e6e10e37144102ad95dcdbd56202afcd5c7daeb

SHA512
6c666c7671ab4c6d1e4953dfbaeae8efe34abd4d0d3662ecc25542cc2be7b6eefeedd620d1122b58ce7a99273d23d03c02d6dea6b61852004544a88f992d935f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6e09bc02d2d0a06e3be19f52f5e4603

SHA1
c3b20cdc62763c423bed525faecde9920b971cd9

SHA256
0648fd6c910558358598243506a0aa65d8a5acb9185b0ba508bb9017f9df8596

SHA512
ef825d34c77c024cf0d2ac5fa1e031c7f92e5d742ab56cb9d6709e73a2a634dbf90ebb3bd9812bf4f5177d7cdc1f84084466204c4b0fdd60352c03d17a13c881

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
1cd640d65eb58a52c3d229afef28121d

SHA1
9433107ab0d26871c1fef5d99d112df92b7ce7c7

SHA256
f24c9c88eb225e1414a065207b88a40a919e225df75fa9b7ee28a0cd88b330be

SHA512
3971fa3ed2b8f0b75c50245dc3f99b858b5ea80af1911566e5014321854a53dafd94f7e52ea42de5ef45ef602aa3eb3dc16c83305b3861a57b87bafeabe15e67

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab510D.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar523C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit