Analysis
- max time kernel
105s - max time network
167s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
25/06/2024, 19:44
Behavioral task
behavioral1
Sample
turu.exe
Resource
win7-20240508-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
turu.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target turu.exe
- Size 65KB
- Sample240625-yf7dzayfph
- SHA256 0174841d3dc6ff63135c23732a8dd375e4c86b8025050b47b515a92373ec445a
- MD5 c6cbe0c2fef6507a9a7f828a4a59cfb6
- SHA1 1e7030c9bce0bb2c720980d6c62272149d1f040e
- SHA512 b98cd97426866fe9fe81c5792273a0de200fa543b4a6768d08293f31be1478bfdc76c3beec05c35d7022cb2cf03f6e8dcd9d18f52842cf9fd68678958bd0e253
- SSDEEP 1536:QXkoUoN36tSQviFw1Kn7uBnvbLfLteF3nLrB9z3nJaF9bYS9vM:QXkoUoN36tSQviFCyqBnHfWl9z5aF9b
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe turu.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe turu.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.url turu.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\turu.exe\" .." turu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\turu.exe\" .." turu.exe - Kills process with taskkill 3 IoCs
pid Process 3360 TASKKILL.exe 4412 taskkill.exe 3648 TASKKILL.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3148 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe 4136 turu.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 4136 turu.exe Token: SeDebugPrivilege 3648 TASKKILL.exe Token: SeDebugPrivilege 3360 TASKKILL.exe Token: 33 4136 turu.exe Token: SeIncBasePriorityPrivilege 4136 turu.exe Token: 33 4136 turu.exe Token: SeIncBasePriorityPrivilege 4136 turu.exe Token: SeShutdownPrivilege 4136 turu.exe Token: 33 4136 turu.exe Token: SeIncBasePriorityPrivilege 4136 turu.exe Token: 33 4136 turu.exe Token: SeIncBasePriorityPrivilege 4136 turu.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4136 wrote to memory of 3648 4136 turu.exe 93 PID 4136 wrote to memory of 3648 4136 turu.exe 93 PID 4136 wrote to memory of 3648 4136 turu.exe 93 PID 4136 wrote to memory of 3360 4136 turu.exe 94 PID 4136 wrote to memory of 3360 4136 turu.exe 94 PID 4136 wrote to memory of 3360 4136 turu.exe 94 PID 4136 wrote to memory of 4412 4136 turu.exe 105 PID 4136 wrote to memory of 4412 4136 turu.exe 105 PID 4136 wrote to memory of 4412 4136 turu.exe 105 PID 4136 wrote to memory of 4568 4136 turu.exe 107 PID 4136 wrote to memory of 4568 4136 turu.exe 107 PID 4136 wrote to memory of 4568 4136 turu.exe 107 PID 4136 wrote to memory of 3148 4136 turu.exe 109 PID 4136 wrote to memory of 3148 4136 turu.exe 109 PID 4136 wrote to memory of 3148 4136 turu.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\turu.exe"C:\Users\Admin\AppData\Local\Temp\turu.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3648
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3360
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im Wireshark.exe2⤵
- Kills process with taskkill
PID:4412
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f2⤵PID:4568
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\turu.exe2⤵
- Scheduled Task/Job: Scheduled Task
PID:3148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:81⤵PID:3464
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1