Analysis

  • max time kernel
    120s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07/03/2024, 17:58

General

  • Target

    dekont_06.03.2024 MaximumİşyerimİşlemÖzetiniz.exe

  • Size

    710KB

  • MD5

    96ac4013d30d6dea4a0eb3ea2b4a3e22

  • SHA1

    c539ae8ab18d240b7b761baa2840076b191a7e4e

  • SHA256

    f164ce16a674a43c3b7d06100e60136389aa00502051103abdd88f741ca58ba8

  • SHA512

    0f45309f44c7e8f451ac6f34587a90a515eeec6cff2e6f1a856108677111b0e7875e5e05ff8e43858e2c0ed0c619e9a8a87fcc495edeb53c4df51c435c045e13

  • SSDEEP

    12288:QBtsy/j21yyxK+TgFA2huBs3oV6npo8wOZK0oBGrjAF0etpkjysdOD:Zy/j2cyY+Y0i3odJCyBfj/kjylD

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dekont_06.03.2024 MaximumİşyerimİşlemÖzetiniz.exe
    "C:\Users\Admin\AppData\Local\Temp\dekont_06.03.2024 MaximumİşyerimİşlemÖzetiniz.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1440
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\dekont_06.03.2024 MaximumİşyerimİşlemÖzetiniz.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2564
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 924
      2⤵
      • Program crash
      PID:2632

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1440-6-0x0000000004DA0000-0x0000000004E22000-memory.dmp

    Filesize

    520KB

  • memory/1440-12-0x0000000074050000-0x000000007473E000-memory.dmp

    Filesize

    6.9MB

  • memory/1440-2-0x0000000004A40000-0x0000000004A80000-memory.dmp

    Filesize

    256KB

  • memory/1440-3-0x0000000000350000-0x0000000000364000-memory.dmp

    Filesize

    80KB

  • memory/1440-4-0x00000000003C0000-0x00000000003CA000-memory.dmp

    Filesize

    40KB

  • memory/1440-5-0x00000000003D0000-0x00000000003DE000-memory.dmp

    Filesize

    56KB

  • memory/1440-15-0x0000000004A40000-0x0000000004A80000-memory.dmp

    Filesize

    256KB

  • memory/1440-0-0x0000000000E20000-0x0000000000ED6000-memory.dmp

    Filesize

    728KB

  • memory/1440-1-0x0000000074050000-0x000000007473E000-memory.dmp

    Filesize

    6.9MB

  • memory/2564-11-0x00000000024F0000-0x0000000002530000-memory.dmp

    Filesize

    256KB

  • memory/2564-14-0x000000006E6C0000-0x000000006EC6B000-memory.dmp

    Filesize

    5.7MB

  • memory/2564-13-0x00000000024F0000-0x0000000002530000-memory.dmp

    Filesize

    256KB

  • memory/2564-9-0x000000006E6C0000-0x000000006EC6B000-memory.dmp

    Filesize

    5.7MB

  • memory/2564-10-0x000000006E6C0000-0x000000006EC6B000-memory.dmp

    Filesize

    5.7MB