ea597bc567ef5761cf2f6bce44cbab196724851ef09eff524864016ba40fcbb8

Analysis

max time kernel
298s
max time network
301s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Türk Havacılık ve Uzay Sanayii AŞ TEKLİF TALEBİ-19-08-2026 PDF.js
Size 540KB
Sample260819-we2e8azbke
SHA256 ea597bc567ef5761cf2f6bce44cbab196724851ef09eff524864016ba40fcbb8
MD5 43c0777d3c6a5481d2d029dc9b69816b
SHA1 6e2ddb6e899d62cf7c74e4fab82ca3365aa176aa
SHA512 b66abb089ae872f89660a5f5ae7469a6aa19bef318ebb9b742c862b6fa0fd1f46615c5c3984f4839f3b8c16f57ec487ba626e08d6a299be820fd13ac50665730
SSDEEP 6144:n3NrMdbsidIlersNaOnUYcUmvOmPbHOKOH/EXSr:n3Ez+UrxOf+Sr
TLSH
T1E2C4642DE8E44294587221A0D3D1814889BDECEE3B5F1A18269F57DEF3BC3562D139CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Badlisted process makes network request 47 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	3916	powershell.exe
8	3916	powershell.exe
9	3916	powershell.exe
10	3916	powershell.exe
12	3916	powershell.exe
13	3916	powershell.exe
14	3916	powershell.exe
15	3916	powershell.exe
16	3916	powershell.exe
17	3916	powershell.exe
19	3916	powershell.exe
20	3916	powershell.exe
21	3916	powershell.exe
22	3916	powershell.exe
23	3916	powershell.exe
24	3916	powershell.exe
25	3916	powershell.exe
26	3916	powershell.exe
27	3916	powershell.exe
28	3916	powershell.exe
29	3916	powershell.exe
30	3916	powershell.exe
31	3916	powershell.exe
32	3916	powershell.exe
33	3916	powershell.exe
34	3916	powershell.exe
35	3916	powershell.exe
36	3916	powershell.exe
37	3916	powershell.exe
38	3916	powershell.exe
39	3916	powershell.exe
40	3916	powershell.exe
41	3916	powershell.exe
42	3916	powershell.exe
43	3916	powershell.exe
44	3916	powershell.exe
45	3916	powershell.exe
46	3916	powershell.exe
47	3916	powershell.exe
48	3916	powershell.exe
49	3916	powershell.exe
50	3916	powershell.exe
51	3916	powershell.exe
52	3916	powershell.exe
53	3916	powershell.exe
54	3916	powershell.exe
55	3916	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3916	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3916	powershell.exe
3916	powershell.exe
3916	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3916	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4260	conhost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 5700	4260	conhost.exe	93
PID 4088 wrote to memory of 3916	4088	conhost.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Türk Havacılık ve Uzay Sanayii AŞ TEKLİF TALEBİ-19-08-2026 PDF.js"
1⤵
PID:2420

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:5700

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:2952

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" --headless "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoP -EP Bypass -NonInteractive -File "C:\Users\Admin\AppData\Local\Temp\1894mt0e0z2g\1894mt0e0z2g.ps1"
1⤵
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -NoP -EP Bypass -NonInteractive -File C:\Users\Admin\AppData\Local\Temp\1894mt0e0z2g\1894mt0e0z2g.ps1
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1894mt0e0z2g.ps1

Path C:\Users\Admin\AppData\Local\Temp\1894mt0e0z2g\1894mt0e0z2g.ps1
Size 1KB
SHA256 f3280fff97c1c65cee7594881d93bb9ae22e00f1d6e99fc357cb09933b44e216
MD5 bec9f8bd1a69dc6afe45a9960fc3a480
SHA1 34772874064fa0023e9a557cd1c0990b31e5e739
SHA512 c22465d5bfe7de3018319f103b2230f20f2d2b76ecead790a543fabbab4d844a96c0bbce4b2a4c80b6d1ec756021b22fd261b659727f6d3cbfd13f83913ffb2c
TLSH
T1E931117183B69A341541B073AFB6139A8139590D7DCCAF98F2DFC9107247A09ADDB38B
MD5 SHA1 SHA512 TLSH

Submit Download

1894mt0e0z2ga

Path C:\Users\Admin\AppData\Local\Temp\1894mt0e0z2g\1894mt0e0z2ga
Size 66KB
SHA256 55eff4b34a66ce2d179a16f9ea72d66ac5f7b51f6e7626ff2f89dde49f3eb495
MD5 24cf15452af9a520951bfed39b7c6791
SHA1 9f3d7106a6e61d642758a68d7938aafaefd1f267
SHA512 3d6f4ae560fc6b053482c15bb815b243f694debba8519c51b11dcaac33eaba36c15b22abbd4b8ecec0171f8e28fb9a942db38f04be5047be7369824782d050b6
SSDEEP 1536:7gPgqcVLqL8nGL9iyDlP5qY4W1YyPN5moALU+rLyFC:ELcGL9iyP6WqQ5mhjrLcC
TLSH
T1F56302F80F3C581EE300E645A8F32356761A85591B00ECF9B33B918D69BBB0657137BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1894mt0e0z2gb

Path C:\Users\Admin\AppData\Local\Temp\1894mt0e0z2g\1894mt0e0z2gb
Size 66KB
SHA256 6fb865f4e548d0fc88f2f5a45cdb419e20f60bed881d69722e718b51c816a7df
MD5 b293f530ad7cdd64ba296e271863250d
SHA1 48bcde51af96958636095a5632fe87834ab181c2
SHA512 9f6706eddf32262989fff71e8a4e3c5341c458f5faff42dce576b6228d3159d37cc5ce2bccffd49ccf4be0fbb9bfd991cd0410999ce132d106061adcf1b15f91
SSDEEP 1536:6eMAe4nkQ3x0MB3a86pAy424ComgPOADU4rAtW/zQxSE3H4J4:6eMkfx/BX6Jh47V1trb/+4J4
TLSH
T1D963021C15DEACBBB4C600567EFB770504C1CB8C09D69172392D2973696F7D22E164F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3916-5-0x000002A16D9A0000-0x000002A16D9C2000-memory.dmp

Download

memory/3916-9-0x000002A16D940000-0x000002A16D992000-memory.dmp

Download

memory/3916-10-0x000002A155310000-0x000002A155322000-memory.dmp

Download