Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
07/05/2024, 08:11
General
- Target Fiyat teklifi. SERYAPIM İNŞ. 2023 YILI MİZAN.exe
- Size 712KB
- Sample240507-j3ak7aah64
- SHA256 b4146ebcc1fa90a7e4adfcabba15f5fe474348666fe15c98367216932fcfa7bf
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fiyat teklifi. SERYAPIM İNŞ. 2023 YILI MİZAN.exe"C:\Users\Admin\AppData\Local\Temp\Fiyat teklifi. SERYAPIM İNŞ. 2023 YILI MİZAN.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Fiyat teklifi. SERYAPIM İNŞ. 2023 YILI MİZAN.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 17122⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2808 -ip 28081⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_1btl14vg.fbo.ps1
memory/2808-1-0x00000000002E0000-0x0000000000396000-memory.dmp
memory/2808-2-0x0000000005340000-0x00000000058E4000-memory.dmp
memory/2808-3-0x0000000004D90000-0x0000000004E22000-memory.dmp
memory/2808-4-0x0000000004D60000-0x0000000004D6A000-memory.dmp
memory/2808-5-0x0000000075140000-0x00000000758F0000-memory.dmp
memory/2808-6-0x00000000050F0000-0x000000000510C000-memory.dmp
memory/2808-7-0x0000000005330000-0x000000000533E000-memory.dmp
memory/2808-8-0x0000000005F20000-0x0000000005F36000-memory.dmp
memory/2808-9-0x00000000065F0000-0x0000000006672000-memory.dmp
memory/2808-10-0x0000000008BF0000-0x0000000008C8C000-memory.dmp
memory/2808-31-0x0000000075140000-0x00000000758F0000-memory.dmp
memory/2808-0-0x000000007514E000-0x000000007514F000-memory.dmp
memory/3652-28-0x0000000005500000-0x0000000005854000-memory.dmp
memory/3652-34-0x000000006FF80000-0x000000006FFCC000-memory.dmp
memory/3652-15-0x0000000075140000-0x00000000758F0000-memory.dmp
memory/3652-16-0x0000000004A40000-0x0000000004A62000-memory.dmp
memory/3652-23-0x0000000005390000-0x00000000053F6000-memory.dmp
memory/3652-22-0x0000000005320000-0x0000000005386000-memory.dmp
memory/3652-13-0x0000000004CF0000-0x0000000005318000-memory.dmp
memory/3652-12-0x0000000075140000-0x00000000758F0000-memory.dmp
memory/3652-29-0x0000000005A00000-0x0000000005A1E000-memory.dmp
memory/3652-30-0x0000000005A20000-0x0000000005A6C000-memory.dmp
memory/3652-11-0x00000000020D0000-0x0000000002106000-memory.dmp
memory/3652-33-0x0000000075140000-0x00000000758F0000-memory.dmp
memory/3652-32-0x0000000006990000-0x00000000069C2000-memory.dmp
memory/3652-14-0x0000000075140000-0x00000000758F0000-memory.dmp
memory/3652-44-0x0000000006BD0000-0x0000000006BEE000-memory.dmp
memory/3652-46-0x0000000006BF0000-0x0000000006C93000-memory.dmp
memory/3652-45-0x0000000075140000-0x00000000758F0000-memory.dmp
memory/3652-47-0x0000000007370000-0x00000000079EA000-memory.dmp
memory/3652-48-0x0000000006D20000-0x0000000006D3A000-memory.dmp
memory/3652-49-0x0000000006DB0000-0x0000000006DBA000-memory.dmp
memory/3652-50-0x0000000006FC0000-0x0000000007056000-memory.dmp
memory/3652-51-0x0000000006F40000-0x0000000006F51000-memory.dmp
memory/3652-52-0x0000000006F70000-0x0000000006F7E000-memory.dmp
memory/3652-53-0x0000000006F80000-0x0000000006F94000-memory.dmp
memory/3652-54-0x0000000007080000-0x000000000709A000-memory.dmp
memory/3652-55-0x0000000007060000-0x0000000007068000-memory.dmp
memory/3652-58-0x0000000075140000-0x00000000758F0000-memory.dmp