Analysis
- max time kernel
97s - max time network
177s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
11/03/2024, 17:31
General
- Target TEKLİF TALEP VE FİYAT TEKLİFİ_xlxs.exe
- Size 874KB
- Sample240311-v3qsyshd9v
- SHA256 9a405f12de1dc4e10c3515e36540aeaaabbceb7d3b4857e3d6ecba4c06cc4e8d
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TEKLİF TALEP VE FİYAT TEKLİFİ_xlxs.exe"C:\Users\Admin\AppData\Local\Temp\TEKLİF TALEP VE FİYAT TEKLİFİ_xlxs.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\TEKLİF TALEP VE FİYAT TEKLİFİ_xlxs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\FaVCDogIdSVqPg.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FaVCDogIdSVqPg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3908.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 17442⤵
- Program crash
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:81⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3336 -ip 33361⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_gcxqtqcz.nbw.ps1
tmp3908.tmp
memory/1688-77-0x00000000079C0000-0x00000000079DE000-memory.dmp
memory/1688-57-0x000000006FA10000-0x000000006FA5C000-memory.dmp
memory/1688-87-0x0000000007E30000-0x0000000007E3E000-memory.dmp
memory/1688-85-0x0000000007E80000-0x0000000007F16000-memory.dmp
memory/1688-81-0x0000000008250000-0x00000000088CA000-memory.dmp
memory/1688-80-0x0000000007A30000-0x0000000007AD3000-memory.dmp
memory/1688-78-0x0000000005380000-0x0000000005390000-memory.dmp
memory/1688-79-0x000000007F920000-0x000000007F930000-memory.dmp
memory/1688-91-0x0000000007F20000-0x0000000007F28000-memory.dmp
memory/1688-89-0x0000000007E40000-0x0000000007E54000-memory.dmp
memory/1688-55-0x0000000005380000-0x0000000005390000-memory.dmp
memory/1688-53-0x0000000005380000-0x0000000005390000-memory.dmp
memory/1688-51-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/1688-46-0x00000000062A0000-0x00000000065F4000-memory.dmp
memory/1688-20-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/1688-21-0x0000000005380000-0x0000000005390000-memory.dmp
memory/1688-22-0x0000000005380000-0x0000000005390000-memory.dmp
memory/1688-95-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/1716-18-0x0000000002540000-0x0000000002576000-memory.dmp
memory/1716-13-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/1716-26-0x0000000004FD0000-0x0000000005036000-memory.dmp
memory/1716-27-0x0000000005040000-0x00000000050A6000-memory.dmp
memory/1716-23-0x0000000005110000-0x0000000005738000-memory.dmp
memory/1716-17-0x0000000004AD0000-0x0000000004AE0000-memory.dmp
memory/1716-47-0x0000000005EA0000-0x0000000005EBE000-memory.dmp
memory/1716-48-0x0000000005F70000-0x0000000005FBC000-memory.dmp
memory/1716-49-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/1716-50-0x0000000004AD0000-0x0000000004AE0000-memory.dmp
memory/1716-94-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/1716-82-0x0000000007230000-0x000000000724A000-memory.dmp
memory/1716-54-0x0000000004AD0000-0x0000000004AE0000-memory.dmp
memory/1716-90-0x0000000007570000-0x000000000758A000-memory.dmp
memory/1716-52-0x0000000004AD0000-0x0000000004AE0000-memory.dmp
memory/1716-58-0x000000006FA10000-0x000000006FA5C000-memory.dmp
memory/1716-88-0x0000000007460000-0x000000000746E000-memory.dmp
memory/1716-25-0x0000000004F30000-0x0000000004F52000-memory.dmp
memory/1716-56-0x0000000007020000-0x0000000007052000-memory.dmp
memory/1716-86-0x0000000007430000-0x0000000007441000-memory.dmp
memory/1716-83-0x00000000072A0000-0x00000000072AA000-memory.dmp
memory/3336-10-0x00000000076F0000-0x00000000076FE000-memory.dmp
memory/3336-7-0x0000000005180000-0x000000000519C000-memory.dmp
memory/3336-6-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/3336-8-0x0000000004B60000-0x0000000004B70000-memory.dmp
memory/3336-84-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/3336-5-0x0000000004BB0000-0x0000000004BBA000-memory.dmp
memory/3336-9-0x00000000076E0000-0x00000000076EC000-memory.dmp
memory/3336-4-0x0000000004B60000-0x0000000004B70000-memory.dmp
memory/3336-11-0x0000000007A00000-0x0000000007A82000-memory.dmp
memory/3336-3-0x0000000004BF0000-0x0000000004C82000-memory.dmp
memory/3336-12-0x0000000008E10000-0x0000000008EAC000-memory.dmp
memory/3336-2-0x00000000051A0000-0x0000000005744000-memory.dmp
memory/3336-1-0x00000000000D0000-0x00000000001B0000-memory.dmp
memory/3336-0-0x0000000075310000-0x0000000075AC0000-memory.dmp