494303b1cbd6db4ad8784f03ef83b345bf61105cf975fd1c2021a1d7fb4c5430

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 13:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PDF Satın Alma Siparişi PO.08463.pdf.exe
Size 991KB
Sample240213-q2ebbabc7w
SHA256 494303b1cbd6db4ad8784f03ef83b345bf61105cf975fd1c2021a1d7fb4c5430
MD5 1544cee76d2ff971e13f6a68b68c8dcd
SHA1 ab7ad699feffa09d0ef3f0a431443fe2389ca504
SHA512 a1af03ebec8534ab94c90fd9cdd3473b4688eb41421426efcb3822af3a5f9c7fc491dbe0aa4756844c4bc3bfc76de361eab6ba756b6f835f32ba550845646539
SSDEEP 24576:bOEzJxGRj50/tXY7K82kmoShfz87brh8:KejGjd2kf8fz87h
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2516	3060	WerFault.exe	15

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2660	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3060	PDF Satın Alma Siparişi PO.08463.pdf.exe
2092	powershell.exe
2652	powershell.exe
3060	PDF Satın Alma Siparişi PO.08463.pdf.exe
3060	PDF Satın Alma Siparişi PO.08463.pdf.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3060	PDF Satın Alma Siparişi PO.08463.pdf.exe
Token: SeDebugPrivilege	2092	powershell.exe
Token: SeDebugPrivilege	2652	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2092	3060	PDF Satın Alma Siparişi PO.08463.pdf.exe	28
PID 3060 wrote to memory of 2092	3060	PDF Satın Alma Siparişi PO.08463.pdf.exe	28
PID 3060 wrote to memory of 2092	3060	PDF Satın Alma Siparişi PO.08463.pdf.exe	28
PID 3060 wrote to memory of 2092	3060	PDF Satın Alma Siparişi PO.08463.pdf.exe	28
PID 3060 wrote to memory of 2652	3060	PDF Satın Alma Siparişi PO.08463.pdf.exe	30
PID 3060 wrote to memory of 2652	3060	PDF Satın Alma Siparişi PO.08463.pdf.exe	30
PID 3060 wrote to memory of 2652	3060	PDF Satın Alma Siparişi PO.08463.pdf.exe	30
PID 3060 wrote to memory of 2652	3060	PDF Satın Alma Siparişi PO.08463.pdf.exe	30
PID 3060 wrote to memory of 2660	3060	PDF Satın Alma Siparişi PO.08463.pdf.exe	31
PID 3060 wrote to memory of 2660	3060	PDF Satın Alma Siparişi PO.08463.pdf.exe	31
PID 3060 wrote to memory of 2660	3060	PDF Satın Alma Siparişi PO.08463.pdf.exe	31
PID 3060 wrote to memory of 2660	3060	PDF Satın Alma Siparişi PO.08463.pdf.exe	31
PID 3060 wrote to memory of 2516	3060	PDF Satın Alma Siparişi PO.08463.pdf.exe	34
PID 3060 wrote to memory of 2516	3060	PDF Satın Alma Siparişi PO.08463.pdf.exe	34
PID 3060 wrote to memory of 2516	3060	PDF Satın Alma Siparişi PO.08463.pdf.exe	34
PID 3060 wrote to memory of 2516	3060	PDF Satın Alma Siparişi PO.08463.pdf.exe	34

C:\Users\Admin\AppData\Local\Temp\PDF Satın Alma Siparişi PO.08463.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\PDF Satın Alma Siparişi PO.08463.pdf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PDF Satın Alma Siparişi PO.08463.pdf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2092
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qfyxJgIq.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2652
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qfyxJgIq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp390A.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 1048
  2⤵
  - Program crash
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp390A.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp390A.tmp
Size 1KB
SHA256 5e81ec423d4be5457e68e80bb1d5fdb9d081f484788c976ea97ad958eeac55c3
MD5 7ff6ca959d489e70dcee5a1832c7ddef
SHA1 75fba78e7e8013448a73a9bda362b4d7f8a2422c
SHA512 39cb221a8d6f1c973fa8f49db996e703f1907c320ec42791aa42d8f451096c83a9d3a2873ff95d0c2b6524c2e91c04eed782986ed18e9ecbd187c6ed7c7d6f65
MD5 SHA1 SHA512

Submit Download

TZRT4VJ23LFVLJITUKWB.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\TZRT4VJ23LFVLJITUKWB.temp
Size 7KB
SHA256 aeeeb7e8671131ce5c239658e7ff08f1745a73880a14ec69bb24805eaa02592a
MD5 0d5449498a1f6f8a4d27f2a6d1c8b0de
SHA1 ede76f5ca080810045b72cca1365f65597314672
SHA512 efa95c203c3dba7e21f57643806e8d0e60c3c02d69da9d84797336dc319f6e3e7bffd2016958b5ef55cc479c1a1d108ef508ab90d91a220787df9779408ab88f
SSDEEP 96:8+kiCVM89nqvsqvJCwor+kiCVM89nqvsEHyqvJCworSuiPQHZY7BsXlUVi:rk/hUoCk/hAHnorS/kY7Bsl
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2092-26-0x0000000002960000-0x00000000029A0000-memory.dmp

Download

memory/2092-22-0x000000006E680000-0x000000006EC2B000-memory.dmp

Download

memory/2092-27-0x000000006E680000-0x000000006EC2B000-memory.dmp

Download

memory/2092-25-0x0000000002960000-0x00000000029A0000-memory.dmp

Download

memory/2092-20-0x000000006E680000-0x000000006EC2B000-memory.dmp

Download

memory/2652-28-0x000000006E680000-0x000000006EC2B000-memory.dmp

Download

memory/2652-24-0x0000000002900000-0x0000000002940000-memory.dmp

Download

memory/2652-23-0x000000006E680000-0x000000006EC2B000-memory.dmp

Download

memory/2652-19-0x000000006E680000-0x000000006EC2B000-memory.dmp

Download

memory/2652-21-0x0000000002900000-0x0000000002940000-memory.dmp

Download

memory/3060-2-0x0000000004A90000-0x0000000004AD0000-memory.dmp

Download

memory/3060-0-0x0000000000FB0000-0x00000000010AE000-memory.dmp

Download

memory/3060-3-0x0000000000650000-0x0000000000664000-memory.dmp

Download

memory/3060-1-0x0000000074B60000-0x000000007524E000-memory.dmp

Download

memory/3060-6-0x0000000000F00000-0x0000000000F88000-memory.dmp

Download

memory/3060-5-0x0000000000680000-0x000000000068E000-memory.dmp

Download

memory/3060-4-0x0000000000670000-0x000000000067A000-memory.dmp

Download

memory/3060-29-0x0000000074B60000-0x000000007524E000-memory.dmp

Download

memory/3060-30-0x0000000004A90000-0x0000000004AD0000-memory.dmp

Download