Resubmissions

12/01/2024, 13:14

240112-qg1c2shdb4 5

12/01/2024, 13:02

240112-qaa5ksgdfl 5

12/01/2024, 08:15

240112-j5sjsadbf3 5

Analysis

  • max time kernel
    596s
  • max time network
    604s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/01/2024, 13:02

General

  • Target

    =?UTF-8?Q?G=C3=BCnl=C3=BCk_Kiral=C4=B1k_Evlerle_=C4=B0lgili_?= =?UTF-8?Q?Y=C3=B6netmelik_Resm=C3=AE_Gazete'de.html

  • Size

    309KB

  • MD5

    bbd167ae7c3eb6d4fe1289e095a945b7

  • SHA1

    bc978547f7ade6338048cafdf8d8ac596a931817

  • SHA256

    a2601413162176c9474137ce40b97b80713b397cd92cf6437168c57c4ecaab3d

  • SHA512

    2e8019e0839432eca17dddb1d21e8440d25af3c61c06b23aa313880163ae6d057edde4ab9d8b51191846e1e2b9bc64dd75bfd0146ac62e15b69aded97daab7e4

  • SSDEEP

    3072:pPDU+89SCjcDE/N2DyMlL6Vz9095SLGfciivW1l4inL:pPDUpSW/pMlWV+uiiOD

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\=_UTF-8_Q_G=C3=BCnl=C3=BCk_Kiral=C4=B1k_Evlerle_=C4=B0lgili__= =_UTF-8_Q_Y=C3=B6netmelik_Resm=C3=AE_Gazete'de.html"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3884
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3884 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:3200
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
    1⤵
      PID:3904
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k UnistackSvcGroup
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2340

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

      Filesize

      16KB

      MD5

      44196fbcbcb8796eca579659131d9a96

      SHA1

      543442020ca235340a89c7a11ed6c83099b93ce6

      SHA256

      56d43e87b594f79db37fd1053eb3e37a4c0c0849dec39657f15b29c28351a3d5

      SHA512

      3f14a8b154eff39cf3c280141cc6d7b21199a205ff59e1b0406392e9167f114f974c6ba1e3b38fcfffb16e3e82865fe046a0b187f0e2e92e6a77b15796dca69c

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BP0ZYM9B\dnserrordiagoff[1]

      Filesize

      1KB

      MD5

      7e81a79f38695e467a49ee41dd24146d

      SHA1

      035e110c36bf3072525b05394f73d1ba54d0d316

      SHA256

      a705d1e0916a79b0d6e60c41a9ce301ed95b3fc00e927f940ab27061c208a536

      SHA512

      53c5f2f2b9ad8b555f9ae6644941cf2016108e803ea6ab2c7418e31e66874dea5a2bc04be0fa9766e7206617879520e730e9e3e0de136bae886c2e786082d622

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q9YQXK50\suggestions[1].en-US

      Filesize

      17KB

      MD5

      5a34cb996293fde2cb7a4ac89587393a

      SHA1

      3c96c993500690d1a77873cd62bc639b3a10653f

      SHA256

      c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

      SHA512

      e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VH9W14NQ\errorPageStrings[1]

      Filesize

      4KB

      MD5

      d65ec06f21c379c87040b83cc1abac6b

      SHA1

      208d0a0bb775661758394be7e4afb18357e46c8b

      SHA256

      a1270e90cea31b46432ec44731bf4400d22b38eb2855326bf934fe8f1b169a4f

      SHA512

      8a166d26b49a5d95aea49bc649e5ea58786a2191f4d2adac6f5fbb7523940ce4482d6a2502aa870a931224f215cb2010a8c9b99a2c1820150e4d365cab28299e

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VH9W14NQ\httpErrorPagesScripts[1]

      Filesize

      11KB

      MD5

      9234071287e637f85d721463c488704c

      SHA1

      cca09b1e0fba38ba29d3972ed8dcecefdef8c152

      SHA256

      65cc039890c7ceb927ce40f6f199d74e49b8058c3f8a6e22e8f916ad90ea8649

      SHA512

      87d691987e7a2f69ad8605f35f94241ab7e68ad4f55ad384f1f0d40dc59ffd1432c758123661ee39443d624c881b01dcd228a67afb8700fe5e66fc794a6c0384

    • memory/2340-147-0x000001F0DEE80000-0x000001F0DEE81000-memory.dmp

      Filesize

      4KB

    • memory/2340-151-0x000001F0DEE80000-0x000001F0DEE81000-memory.dmp

      Filesize

      4KB

    • memory/2340-142-0x000001F0DEE80000-0x000001F0DEE81000-memory.dmp

      Filesize

      4KB

    • memory/2340-143-0x000001F0DEE80000-0x000001F0DEE81000-memory.dmp

      Filesize

      4KB

    • memory/2340-144-0x000001F0DEE80000-0x000001F0DEE81000-memory.dmp

      Filesize

      4KB

    • memory/2340-145-0x000001F0DEE80000-0x000001F0DEE81000-memory.dmp

      Filesize

      4KB

    • memory/2340-146-0x000001F0DEE80000-0x000001F0DEE81000-memory.dmp

      Filesize

      4KB

    • memory/2340-125-0x000001F0D6880000-0x000001F0D6890000-memory.dmp

      Filesize

      64KB

    • memory/2340-148-0x000001F0DEE80000-0x000001F0DEE81000-memory.dmp

      Filesize

      4KB

    • memory/2340-149-0x000001F0DEE80000-0x000001F0DEE81000-memory.dmp

      Filesize

      4KB

    • memory/2340-150-0x000001F0DEE80000-0x000001F0DEE81000-memory.dmp

      Filesize

      4KB

    • memory/2340-141-0x000001F0DEE70000-0x000001F0DEE71000-memory.dmp

      Filesize

      4KB

    • memory/2340-152-0x000001F0DEAC0000-0x000001F0DEAC1000-memory.dmp

      Filesize

      4KB

    • memory/2340-153-0x000001F0DEAB0000-0x000001F0DEAB1000-memory.dmp

      Filesize

      4KB

    • memory/2340-155-0x000001F0DEAC0000-0x000001F0DEAC1000-memory.dmp

      Filesize

      4KB

    • memory/2340-158-0x000001F0DEAB0000-0x000001F0DEAB1000-memory.dmp

      Filesize

      4KB

    • memory/2340-161-0x000001F0DE9F0000-0x000001F0DE9F1000-memory.dmp

      Filesize

      4KB

    • memory/2340-109-0x000001F0D6780000-0x000001F0D6790000-memory.dmp

      Filesize

      64KB

    • memory/2340-173-0x000001F0DEBF0000-0x000001F0DEBF1000-memory.dmp

      Filesize

      4KB

    • memory/2340-175-0x000001F0DEC00000-0x000001F0DEC01000-memory.dmp

      Filesize

      4KB

    • memory/2340-177-0x000001F0DED10000-0x000001F0DED11000-memory.dmp

      Filesize

      4KB

    • memory/2340-176-0x000001F0DEC00000-0x000001F0DEC01000-memory.dmp

      Filesize

      4KB