525f80eb0f76072ea7249be97195ce21982c8aa3297b2fcdc0b74e7380b6f400

General

Target
TSM Enerji ihalesi NTF EMR-5 PDF.js
Size 479KB
Sample260817-qctpps11cv
SHA256 525f80eb0f76072ea7249be97195ce21982c8aa3297b2fcdc0b74e7380b6f400
MD5 7a70bc28ffc7fe4372605393f63306b4
SHA1 8dbe541055ef9c42415514254c856ecb69311f2e
SHA512 c6300f43b574c0c8a5af844a79f7d1e17c360d1191115fe0d57f9bb38aaf2b3f83cb310f71e217682e7f754f0fa94cd14aaa5c102bde60028459f56bda49a9fb
SSDEEP 3072:YSW5rb1REEiRYbLdLZ2W8OUQ1P+bU5ef2Wz+IjnYIfVbm3v/KZyeW+MlEX8FX21D:gZO+A68mZXlSlDLTUpOLbDA7c
TLSH
T1AAA4513E99416C4970679802D6AE41A591EFADDBBFDF0D07519BC2DC83A312498C3FE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Badlisted process makes network request 24 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	5016	powershell.exe
4	5016	powershell.exe
5	5016	powershell.exe
7	5016	powershell.exe
13	5016	powershell.exe
14	5016	powershell.exe
15	5016	powershell.exe
16	5016	powershell.exe
17	5016	powershell.exe
18	5016	powershell.exe
19	5016	powershell.exe
20	5016	powershell.exe
21	5016	powershell.exe
22	5016	powershell.exe
23	5016	powershell.exe
25	5016	powershell.exe
26	5016	powershell.exe
27	5016	powershell.exe
28	5016	powershell.exe
29	5016	powershell.exe
30	5016	powershell.exe
31	5016	powershell.exe
32	5016	powershell.exe
33	5016	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5016	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2388	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5016	powershell.exe
5016	powershell.exe
5016	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5016	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 2388	3728	wscript.exe	91
PID 2388 wrote to memory of 5016	2388	wscript.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\TSM Enerji ihalesi NTF EMR-5 PDF.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\22j8msx90q70\22j8msx90q70.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -NonInteractive -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\22j8msx90q70\22j8msx90q70.ps1"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5016

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:4892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

3

T1059

JavaScript

1

T1059.007

PowerShell

1

T1059.001

Visual Basic

1

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

22j8msx90q70.ps1

Path C:\Users\Admin\AppData\Local\Temp\22j8msx90q70\22j8msx90q70.ps1
Size 1KB
SHA256 ce5dbd78dea489c74e8eb4140a0ff8fd17cb279399497e619d696182b4a916a6
MD5 eb62ae675b0337239c590fe85652d23e
SHA1 30f18a70eff8f05adddc3c9c22a082e44fd3fce2
SHA512 d5df76a923fb46dcecef2c1e1478d5525f725801f8ad80f576b0ef60ba333fec816da69b203b1e0ae619813b1991f95d6c44818d9c4b7b3498516c6668578830
TLSH
T1D83124242347DDB919586063EAD319C9A17C491CBF897723BB63C5C81187988A9DC3C7
MD5 SHA1 SHA512 TLSH

Submit Download

22j8msx90q70.vbs

Path C:\Users\Admin\AppData\Local\Temp\22j8msx90q70\22j8msx90q70.vbs
Size 230B
SHA256 a8d4222f823e5409a7c669f30c4f84364cd88e936fed0de7987f3864d71e3928
MD5 13af740326c2251c7974ef9b2926146d
SHA1 fab909044ff337f918163440b3997bddb4312978
SHA512 49a9f3c1c42a6bd44dfbfe9a602a7393fd1565c897a5f0780d12cb0706778e1310809d704edcd6c539978b10e5f2df84d19ce3f342bef83eaa348dacbb9b1870
TLSH
T14AD09700B139E26CDC28C46A80A3866CA0BB54682500B7323350C504B9805A8CE9910A
MD5 SHA1 SHA512 TLSH

Submit Download

22j8msx90q70a

Path C:\Users\Admin\AppData\Local\Temp\22j8msx90q70\22j8msx90q70a
Size 67KB
SHA256 a25207573aa6991a2c2f33d4d1f9ce2fb96713f4291fa9dd8597f80dc0680d56
MD5 e947dfccd24fa4d31a29ef57d09356c0
SHA1 808842b2c313f36e5b6ce81840de5128b9c77fa3
SHA512 b11c2747e1743cdc92c6d397d8074fc8dc41311e445dec34e08aa3d530f679e20ee5031db8829b4cd29aa00fb26d11422b2a145fba9265c1c702fdff809a7c3f
SSDEEP 1536:EothlDt7ve+OaDpgpOORl4JEYCfTLjs1hI1exC:rthlDle1aDpgpO2l4EsI8A
TLSH
T1B46301B1529C4D09EBA5C63533DFEBA360A906F8811E80E0130A34D5FDDFD62EA55079
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

22j8msx90q70b

Path C:\Users\Admin\AppData\Local\Temp\22j8msx90q70\22j8msx90q70b
Size 67KB
SHA256 22136ece39bfe4ebf00c6c23c80c28a0175aa23f11dbbce6228178d7d8aad67b
MD5 7a5b15d729239e90deae12882571ca81
SHA1 9bb30da69d3569377606f4a790a74ea0b692eba5
SHA512 12cde2246c23dc9271b396556d56ac55c208d7a87a69bf58bb8ec7fb54afed715190333d8a1530a09e8d1eedbb92ea76a40e7ba987ec2f1a98b35648ec4d4934
SSDEEP 1536:Oo/Wbn6MvuesvtBVfK9xATNfjaRJQc3AX++dJF/R/nkYnNi:OoC6teSTK3WXcm/RsYnNi
TLSH
T14763120ACE4E70863C95DE85F57D1D344AD5DE03583AEA920D7C0EE787A6C204D5F1B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5016-8-0x00000239DA4A0000-0x00000239DA4C2000-memory.dmp

Download

memory/5016-12-0x00000239DAE10000-0x00000239DAE62000-memory.dmp

Download

memory/5016-13-0x00000239DA490000-0x00000239DA4A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads