hxxps://teletekmedya[.]com/

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 15:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://teletekmedya.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3788	msedge.exe
3788	msedge.exe
3416	msedge.exe
3416	msedge.exe
2392	identity_helper.exe
2392	identity_helper.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 972	3416	msedge.exe	80
PID 3416 wrote to memory of 972	3416	msedge.exe	80
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3160	3416	msedge.exe	81
PID 3416 wrote to memory of 3788	3416	msedge.exe	82
PID 3416 wrote to memory of 3788	3416	msedge.exe	82
PID 3416 wrote to memory of 3556	3416	msedge.exe	83
PID 3416 wrote to memory of 3556	3416	msedge.exe	83
PID 3416 wrote to memory of 3556	3416	msedge.exe	83
PID 3416 wrote to memory of 3556	3416	msedge.exe	83
PID 3416 wrote to memory of 3556	3416	msedge.exe	83
PID 3416 wrote to memory of 3556	3416	msedge.exe	83
PID 3416 wrote to memory of 3556	3416	msedge.exe	83
PID 3416 wrote to memory of 3556	3416	msedge.exe	83
PID 3416 wrote to memory of 3556	3416	msedge.exe	83
PID 3416 wrote to memory of 3556	3416	msedge.exe	83
PID 3416 wrote to memory of 3556	3416	msedge.exe	83
PID 3416 wrote to memory of 3556	3416	msedge.exe	83
PID 3416 wrote to memory of 3556	3416	msedge.exe	83
PID 3416 wrote to memory of 3556	3416	msedge.exe	83
PID 3416 wrote to memory of 3556	3416	msedge.exe	83
PID 3416 wrote to memory of 3556	3416	msedge.exe	83
PID 3416 wrote to memory of 3556	3416	msedge.exe	83
PID 3416 wrote to memory of 3556	3416	msedge.exe	83
PID 3416 wrote to memory of 3556	3416	msedge.exe	83
PID 3416 wrote to memory of 3556	3416	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://teletekmedya.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9303d46f8,0x7ff9303d4708,0x7ff9303d4718
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,2758082266090033504,15813882647339115408,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,2758082266090033504,15813882647339115408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,2758082266090033504,15813882647339115408,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2758082266090033504,15813882647339115408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2758082266090033504,15813882647339115408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2108,2758082266090033504,15813882647339115408,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4752 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,2758082266090033504,15813882647339115408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,2758082266090033504,15813882647339115408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2758082266090033504,15813882647339115408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2758082266090033504,15813882647339115408,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2758082266090033504,15813882647339115408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2758082266090033504,15813882647339115408,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,2758082266090033504,15813882647339115408,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2480

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2d4 0x4e0
1⤵
PID:3248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

Filesize
1024KB

MD5
a0b090114fac703ed725a02ce8d85850

SHA1
54375defd886540c858226a67ed7bca681c8f739

SHA256
adbaee6c1103334838752751dc6d94cb82482f675d4357e37d9029967fee4836

SHA512
6db7f6691b5f39258bbea55a93da6b5972eee14697003e1bcf2075158fd28b6cc4ae475976cbef2b73d8966726e79b11b1080b573265365e9eb7cdb15516f26c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
2d81c110a9efcc0b455f65a2e3b06a46

SHA1
1ce9095156f86d40a28a7c3d9d035ca1d0b6eb98

SHA256
a21f4707a967918066e5b5613473e0f7a24b3679b8c618e714a1350b1ebdd913

SHA512
84e265c739187ea54b201230c46120ee99ef9def026dfa5bb4216a87ea1fc6ade6bc8ccac8cfd21708c7b693eec67b384863e376c39f220b89e69ec1d0d07e2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
17a4171a74f5545d9ffde64ba60eec88

SHA1
d1530ab8585b7f324cb4e88eb77a225154ff983b

SHA256
c0e38ea2a8f06064164e4ad272a38891f3ef98b9936bd01ae2c4c8a025afd62a

SHA512
5550735a685341a9619aa99bae9da07c1ba2a0767c1b5ab345788001657176b24e3cd64025a024e97f1a538d12ca91803d60760d2bed56edc04cca4430bda0c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7d1ff200287b8cef48a7e60f49206f28

SHA1
988cc51df323369e86b633f36e4e65ec1350f45f

SHA256
542c8b7cc9da2c4bfde850533a6bc5f252a9353a1cd43acee5b97fbb8510ae0c

SHA512
84a5be904a2dee614c2063055ec5ccc56f9add30e2bf41fdb1b3cdb6a0863c422ceed682155a44538789f78ce0a7794a4dcf478b71cc53a7246661ed3eccacab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
be74a17ca20449e5f0dc8ceada8d43eb

SHA1
5a2db9cf785d326e27a73fea7b11ec59e185476a

SHA256
db2eca80349c4f7726af5b82e6487bb1a8e9c8a1b00f8d46f00714b5f2216a0b

SHA512
96e465afdf53d73a22e85d125e68d067f0bcce61b42550418f3e5c2b4d997639f1b8cc0de9cc746ecbca2b6cb8f714d4c8f6cb1b21d615c51f9e366033eee1dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
96bfc10245c2085821a6b4d7147e639d

SHA1
e92032cc469864bfd5d20c6620ea9e8066137aad

SHA256
79e0cbc307335e86d19bd12ffacc07a290034b557d0329b55d3e166f22ae41f7

SHA512
c2d3beee596c44deace80f50dd66ad4321230764d5391b33e1cf77adff7bf2034dcbce47a00a1e985036299439106feccd472c57f5f4c32ef21e5e355336f169

Download Submit