585eef76ac77387abc285372bcb29d75f5af405c5a6fad321a12742d2e30e505

Resubmissions

24/07/2024, 18:05

240724-wpkv8azdjm10

24/07/2024, 17:51

23/07/2024, 14:00

23/07/2024, 13:41

23/07/2024, 13:06

Analysis

max time kernel
70s
max time network
317s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
23.07.2024 salı sipariş listesi.10.jar
Size 501KB
Sample240723-ra872stdnj
SHA256 585eef76ac77387abc285372bcb29d75f5af405c5a6fad321a12742d2e30e505
MD5 66080b1deb2855443979232873da2883
SHA1 120d6420b585fdceeb71b201933124dd59949d2c
SHA512 11d14ec59dc7bc8ce7ab94229de75f58cbe4e1d0133f39f2cc4227c8409b088cee97bf255567d79d8c20988d362780037cea6c55198be3a750d98e11357e1e7f
SSDEEP 12288:XQBjqknS3UMcCy5ZJ8UpRNwBWdPe+Z/OluJ5g:AFSkFCyDKUpQBW/O8S
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Opens file in notepad (likely ransom note) 4 IoCs

ransomware

pid	Process
2812	NOTEPAD.EXE
1480	NOTEPAD.EXE
1276	NOTEPAD.EXE
808	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2820	chrome.exe
2820	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe
Token: SeShutdownPrivilege	2820	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe
2820	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2944	2820	chrome.exe	32
PID 2820 wrote to memory of 2944	2820	chrome.exe	32
PID 2820 wrote to memory of 2944	2820	chrome.exe	32
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2632	2820	chrome.exe	34
PID 2820 wrote to memory of 2664	2820	chrome.exe	35
PID 2820 wrote to memory of 2664	2820	chrome.exe	35
PID 2820 wrote to memory of 2664	2820	chrome.exe	35
PID 2820 wrote to memory of 572	2820	chrome.exe	36
PID 2820 wrote to memory of 572	2820	chrome.exe	36
PID 2820 wrote to memory of 572	2820	chrome.exe	36
PID 2820 wrote to memory of 572	2820	chrome.exe	36
PID 2820 wrote to memory of 572	2820	chrome.exe	36
PID 2820 wrote to memory of 572	2820	chrome.exe	36
PID 2820 wrote to memory of 572	2820	chrome.exe	36
PID 2820 wrote to memory of 572	2820	chrome.exe	36
PID 2820 wrote to memory of 572	2820	chrome.exe	36
PID 2820 wrote to memory of 572	2820	chrome.exe	36
PID 2820 wrote to memory of 572	2820	chrome.exe	36
PID 2820 wrote to memory of 572	2820	chrome.exe	36
PID 2820 wrote to memory of 572	2820	chrome.exe	36
PID 2820 wrote to memory of 572	2820	chrome.exe	36
PID 2820 wrote to memory of 572	2820	chrome.exe	36
PID 2820 wrote to memory of 572	2820	chrome.exe	36
PID 2820 wrote to memory of 572	2820	chrome.exe	36
PID 2820 wrote to memory of 572	2820	chrome.exe	36
PID 2820 wrote to memory of 572	2820	chrome.exe	36

C:\Windows\system32\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\23.07.2024 salı sipariş listesi.10.jar"
1⤵
PID:1636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6c69758,0x7fef6c69768,0x7fef6c69778
  2⤵
  PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1156 --field-trial-handle=1248,i,5052520183977133049,4945536821946098347,131072 /prefetch:2
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1248,i,5052520183977133049,4945536821946098347,131072 /prefetch:8
  2⤵
  PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1636 --field-trial-handle=1248,i,5052520183977133049,4945536821946098347,131072 /prefetch:8
  2⤵
  PID:572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2300 --field-trial-handle=1248,i,5052520183977133049,4945536821946098347,131072 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2308 --field-trial-handle=1248,i,5052520183977133049,4945536821946098347,131072 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1488 --field-trial-handle=1248,i,5052520183977133049,4945536821946098347,131072 /prefetch:2
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2244 --field-trial-handle=1248,i,5052520183977133049,4945536821946098347,131072 /prefetch:1
  2⤵
  PID:304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3696 --field-trial-handle=1248,i,5052520183977133049,4945536821946098347,131072 /prefetch:8
  2⤵
  PID:2420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3736 --field-trial-handle=1248,i,5052520183977133049,4945536821946098347,131072 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=1564 --field-trial-handle=1248,i,5052520183977133049,4945536821946098347,131072 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=664 --field-trial-handle=1248,i,5052520183977133049,4945536821946098347,131072 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1092 --field-trial-handle=1248,i,5052520183977133049,4945536821946098347,131072 /prefetch:8
  2⤵
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2552 --field-trial-handle=1248,i,5052520183977133049,4945536821946098347,131072 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3824 --field-trial-handle=1248,i,5052520183977133049,4945536821946098347,131072 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3744 --field-trial-handle=1248,i,5052520183977133049,4945536821946098347,131072 /prefetch:8
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3996 --field-trial-handle=1248,i,5052520183977133049,4945536821946098347,131072 /prefetch:8
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=4108 --field-trial-handle=1248,i,5052520183977133049,4945536821946098347,131072 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4028 --field-trial-handle=1248,i,5052520183977133049,4945536821946098347,131072 /prefetch:8
  2⤵
  PID:484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4128 --field-trial-handle=1248,i,5052520183977133049,4945536821946098347,131072 /prefetch:8
  2⤵
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2536 --field-trial-handle=1248,i,5052520183977133049,4945536821946098347,131072 /prefetch:8
  2⤵
  PID:2496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4276 --field-trial-handle=1248,i,5052520183977133049,4945536821946098347,131072 /prefetch:8
  2⤵
  PID:496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4252 --field-trial-handle=1248,i,5052520183977133049,4945536821946098347,131072 /prefetch:8
  2⤵
  PID:2844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4328 --field-trial-handle=1248,i,5052520183977133049,4945536821946098347,131072 /prefetch:8
  2⤵
  PID:2636
- C:\Users\Admin\Downloads\JavaSetup8u421.exe
  "C:\Users\Admin\Downloads\JavaSetup8u421.exe"
  2⤵
  PID:1120
- - C:\Users\Admin\AppData\Local\Temp\jds259524277.tmp\JavaSetup8u421.exe
    "C:\Users\Admin\AppData\Local\Temp\jds259524277.tmp\JavaSetup8u421.exe"
    3⤵
    PID:1248
  - - C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\LZMA_EXE
      "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\LZMA_EXE" d "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\au.msi" "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\msi.tmp"
      4⤵
      PID:2716
  - - C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\LZMA_EXE
      "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\LZMA_EXE" d "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\jre1.8.0_421.msi" "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_421\msi.tmp"
      4⤵
      PID:2872
  - - C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaw.exe
      -Djdk.disableLastUsageTracking -cp "C:\Program Files (x86)\Java\jre1.8.0_421\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserWebJavaStatus
      4⤵
      PID:1280
  - - C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaw.exe
      -Djdk.disableLastUsageTracking -cp "C:\Program Files (x86)\Java\jre1.8.0_421\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserPreviousDecisionsExist 30
      4⤵
      PID:2636

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1448

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f4
1⤵
PID:1536

C:\Program Files\Java\jre7\bin\javaw.exe
"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\Desktop\23.07.2024 salı sipariş listesi.10.jar"
1⤵
PID:1204

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:1132
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5C491BB1DCF1DF99A7858124AA121797
  2⤵
  PID:1500
- C:\Program Files (x86)\Java\jre1.8.0_421\installer.exe
  "C:\Program Files (x86)\Java\jre1.8.0_421\installer.exe" /s INSTALLDIR="C:\Program Files (x86)\Java\jre1.8.0_421\\" INSTALL_SILENT=1 REPAIRMODE=0 ProductCode={77924AE4-039E-4CA4-87B4-2F32180421F0}
  2⤵
  PID:2124
- - C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaw.exe
    "C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking
    3⤵
    PID:3032
- - C:\Program Files (x86)\Java\jre1.8.0_421\bin\ssvagent.exe
    "C:\Program Files (x86)\Java\jre1.8.0_421\bin\ssvagent.exe" -doHKCUSSVSetup
    3⤵
    PID:2424
- - C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaws.exe
    "C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaws.exe" -wait -fix -permissions -silent
    3⤵
    PID:3000
  - - C:\Program Files (x86)\Java\jre1.8.0_421\bin\jp2launcher.exe
      "C:\Program Files (x86)\Java\jre1.8.0_421\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre1.8.0_421" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDIxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDIxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzQyMVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmUxLjguMF80MjFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzQyMVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDIxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDIxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==
      4⤵
      PID:1344
- - C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaws.exe
    "C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaws.exe" -wait -fix -shortcut -silent
    3⤵
    PID:1748
  - - C:\Program Files (x86)\Java\jre1.8.0_421\bin\jp2launcher.exe
      "C:\Program Files (x86)\Java\jre1.8.0_421\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre1.8.0_421" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDIxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDIxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzQyMVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmUxLjguMF80MjFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzQyMVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDIxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDIxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtc2hvcnRjdXQALXNpbGVudAAtbm90V2ViSmF2YQ==
      4⤵
      PID:3016
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 91868FD9BECAD47D6B03F803CFA8A386 M Global\MSI0000
  2⤵
  PID:556
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2E181524A218D7F528531C5F20273383
  2⤵
  PID:1636
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D08CA15889323196C0305143AD51DC59 M Global\MSI0000
  2⤵
  PID:2260

C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaw.exe
"C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaw.exe" -jar "C:\Users\Admin\Desktop\23.07.2024 salı sipariş listesi.10.jar"
1⤵
PID:2508

C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaw.exe
"C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaw.exe" -jar "C:\Users\Admin\Desktop\23.07.2024 salı sipariş listesi.10.jar"
1⤵
PID:2160

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap294:126:7zEvent14917
1⤵
PID:780

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\23.07.2024 salı sipariş listesi.10\" -spe -an -ai#7zMap31002:126:7zEvent13673
1⤵
PID:1280

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\23.07.2024 salı sipariş listesi.10\82l9NCqv58
1⤵
PID:1968
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\23.07.2024 salı sipariş listesi.10\82l9NCqv58
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:808

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\23.07.2024 salı sipariş listesi.10\e.class
1⤵
PID:2196
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\23.07.2024 salı sipariş listesi.10\e.class
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2812

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\23.07.2024 salı sipariş listesi.10\kye\csb\m.class
1⤵
- Opens file in notepad (likely ransom note)
PID:1480

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\23.07.2024 salı sipariş listesi.10\kye\csb\vy.class
1⤵
- Opens file in notepad (likely ransom note)
PID:1276

C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaw.exe
"C:\Program Files (x86)\Java\jre1.8.0_421\bin\javaw.exe" -jar "C:\Users\Admin\Desktop\23.07.2024 salı sipariş listesi.10.jar"
1⤵
PID:1304

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f78bde7.rbs

Path C:\Config.Msi\f78bde7.rbs
Size 758KB
SHA256 d15ca5c9fcfbaeb8e6f3282f6a961eeb72d09f6c015bac3a0dea9c0ff29d944d
MD5 dce8fa983e2b0b5ebab86460906e291f
SHA1 139e4d7d5bc7200c72c63b3e1050a06603dc4d92
SHA512 0cd1df6cc15f2bea558db9aae2dd40c6f77c511b3f39a87fa90e97bfd8766217c25c326e1d1f6ad47e51dbc0852f53b743de6d4ffd681db756d8c4eaaa11d09c
SSDEEP 12288:fEHd6kSVft9ccLR529t5RblaC1zhpPEF4CdQBvSV6hW:fEH0LV1PLR52DlaCxhpP0aSVd
MD5 SHA1 SHA512 SSDEEP

Submit Download

f78bded.rbs

Path C:\Config.Msi\f78bded.rbs
Size 7KB
SHA256 55d6f541683a51649cf25acc197ebf76bcac4bb1644ce713f7363c6b1de4d1f3
MD5 eda9d7e4e8d1a5552cc0f6b91620e533
SHA1 df39cc73690dc6f8f4432e5fe947218c3bfd8d07
SHA512 1547eeabb5dc4cb1398d1e333fee137613cdf1791b6ec875b62aaa2c27b679b022ac3d9dea34b6e23cf6f030ef010859647a9e6a9e9085dd16528145669ef026
SSDEEP 96:m3igIEIJt99if0eiHcSUC+DkYP7CsAqoYUC+DkYP7C6jeD3tbAqowHUm5OwmWxAj:myvjVePacGTacGxNUC3Up0A
MD5 SHA1 SHA512 SSDEEP

Submit Download

Reference Documentation.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Reference Documentation.lnk
Size 197B
SHA256 062cb9dec2b2ce02c633fc442d1a23e910e602548a54a54c8310b0dde9ae074d
MD5 b5e1de7d05841796c6d96dfe5b8b338c
SHA1 c7c64e5b35d0cca1a5c98a1c68e1e5d4c8b72547
SHA512 963a89b04f34bc00fea5b8e0f9648596c428beac2db30d8b0932974b15c0eb90b7c801ba6fa1082ea9d133258f393ae27e61f27fd3b3951f5c2e4b8c6a212c2d
MD5 SHA1 SHA512

Submit Download

Get Help.url

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Get Help.url
Size 188B
SHA256 18e050270fe6ffcc468f5c68ddc32bea2bfa097ac6369377ff1eb484b9985500
MD5 4657cb571d7862df5ecfdba279c23096
SHA1 25ac5709128cf9c7461e1ede2eee477dc973e957
SHA512 13330c0e481678168a1cb5207089f65ae07d3138327a4585552b29c0c7bf89337939bcfaaa5e705d51bbee69051e72e51efaec23c1c01650c1be082da4de0d7c
MD5 SHA1 SHA512

Submit Download

Visit Java.com.url

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Visit Java.com.url
Size 184B
SHA256 dab18623450b6c82688e6ae5b628506d0b301a087c762976453556502942eb8b
MD5 dd0b00f774329127d1e1f32a3dbed5f4
SHA1 5316d8f75479377c93ffa2bf93ee5e90c8a5361b
SHA512 bd114ecce8fc95475384705b4894925e908aa7a52f4311cd415dc2353ebff9f884b61cdd57e107abf6122a713f219b6ba39e9816dbb0a23f1d6f017bb7374869
MD5 SHA1 SHA512

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 f81c78a7da366620232f3de2b8e29ddece0b7d757eec261509a7dc7d4fd91a99
MD5 451926205c756eff44fdd2eb236050ba
SHA1 ad26eea5ccca9abe2b668b3c03c1b3e3afa1cc88
SHA512 4832979b80a1c3d961d68c4b6c794c3f3d887db3cf62f72b0f8b492aa0b26bd10635592351e747e3a9332c8dba7a38b59591720340fb6388039e679737eb677f
MD5 SHA1 SHA512

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_D2F6556190F7B1A25A117FFB5467EEBD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_D2F6556190F7B1A25A117FFB5467EEBD
Size 727B
SHA256 a761252c5ee80fb7bbb07996f8165e88dfd9af8a1649f537a1e06cfa86ac666a
MD5 3f82c7872e47a2ab9a0c005d0f846e11
SHA1 1c007066cd4bd23617c02a3e4f5fba5140391516
SHA512 f88dd1506f7d0b9b12ddada385c777c8f5a645145fc5bddb7c8c53d6013e5e12cb9bf7fa07ce1126c46c697d6d2c6f006dac26f300261d043f827e2d1c6ff619
MD5 SHA1 SHA512

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 1982d185000451560b3847f942dcfa4157a7532e6f46f150e370a21f5099c295
MD5 6331e247189e7307f65d4e2822f1d6b6
SHA1 c80f1097b134697f367ba871ce249fb11c95fddc
SHA512 061fdc5e5d98d6a335c8da1889d41fc28295111f233dae2b9d30386204eb16b2cbac8c8d77b900a4241e0f72662ee204ce76700e381393bb7223e73526be2117
MD5 SHA1 SHA512

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 13c0014d3c4d12c79ca26979e09fc56cf1770ef6dcb7f16b2aee39ed74d39813
MD5 50b852d7738ef437dd37bf474018b262
SHA1 c1935d07bb1f433cf04bf521ca2388dc001df7d0
SHA512 29eefe5890a0dce8763621ea569a8c6bbd22231529489dcf232d8a98517619a8cd25ee00ec09e65af7527b248f1c7f256eb4eb82a8c45a394ce67ed1d1aef20d
MD5 SHA1 SHA512

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_D2F6556190F7B1A25A117FFB5467EEBD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_D2F6556190F7B1A25A117FFB5467EEBD
Size 412B
SHA256 cf1e26bcc6904499177ed651508cb488f42654dd7877bd3a290d05dc3e0e9467
MD5 4d6d3ee916090c16e17810590d4667c6
SHA1 aef41600b9dce6ceb49fcec44869ff2c5fd83727
SHA512 73c473047a04ee5a9ab3b41efffd599a7c7cc99b46325a5bf05d1165ece34d8b2d020d2f1991e327541fad82bffa937d8a7f433d29272e15c012e7fe827bee7e
MD5 SHA1 SHA512

Submit Download