7cfdee81e16e4e607bf07ee5b0c96bfaba6b9fb55ddbfe6fa8fb02ea24ffebcb

Analysis

max time kernel
78s
max time network
102s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
31/12/2023, 02:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

TurtleSUSP-2e3820.exe
Size

266KB
MD5

e8bd178499c32f2db3cace8dbbf96779
SHA1

2e38203e95813430c72833fb2714207673a96313
SHA256

7cfdee81e16e4e607bf07ee5b0c96bfaba6b9fb55ddbfe6fa8fb02ea24ffebcb
SHA512

dda8ea1f9ab476d39a6cfbc01de6b832a702ebfc3d7b1d0f26a7bc0fbd0706e1d29842a1ba507b7864a82fa7530c81a691beba86828e8b5767acc36e237b29a6
SSDEEP

6144:mekmEXJFzPMHb8OSiQi3OYdjT1AOoP5ep:dkmoJFzP6tT1CG

Score

8^/10

evasion

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	D:\autorun.inf	TurtleSUSP-2e3820.exe
File created	F:\autorun.inf	TurtleSUSP-2e3820.exe
File created	C:\autorun.inf	TurtleSUSP-2e3820.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\RemoteCtrl.exe	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: 35	4960	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 4960	768	TurtleSUSP-2e3820.exe	77
PID 768 wrote to memory of 4960	768	TurtleSUSP-2e3820.exe	77
PID 768 wrote to memory of 4960	768	TurtleSUSP-2e3820.exe	77

C:\Users\Admin\AppData\Local\Temp\TurtleSUSP-2e3820.exe
"C:\Users\Admin\AppData\Local\Temp\TurtleSUSP-2e3820.exe"
1⤵
- Drops autorun.inf file
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c mklink C:\Windows\system32\RemoteCtrl.exe C:\Users\Admin\AppData\Local\Temp\RemoteCtrl.exe
  2⤵
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads