Overview

overview

10

Static

static

5

Gereksinim...ll.bat

windows10-2004-x64

7

Gereksinim...ll.bat

windows11-ltsc_2024-x64

7

Gereksinim...64.exe

windows10-2004-x64

7

Gereksinim...64.exe

windows11-ltsc_2024-x64

7

Gereksinim...86.exe

windows10-2004-x64

7

Gereksinim...86.exe

windows11-ltsc_2024-x64

7

Gereksinim...64.exe

windows10-2004-x64

3

Gereksinim...64.exe

windows11-ltsc_2024-x64

3

Gereksinim...86.exe

windows10-2004-x64

3

Gereksinim...86.exe

windows11-ltsc_2024-x64

3

Gereksinim...64.exe

windows10-2004-x64

3

Gereksinim...64.exe

windows11-ltsc_2024-x64

3

Gereksinim...86.exe

windows10-2004-x64

3

Gereksinim...86.exe

windows11-ltsc_2024-x64

3

Gereksinim...64.exe

windows10-2004-x64

4

Gereksinim...64.exe

windows11-ltsc_2024-x64

4

Gereksinim...86.exe

windows10-2004-x64

4

Gereksinim...86.exe

windows11-ltsc_2024-x64

4

Gereksinim...64.exe

windows10-2004-x64

4

Gereksinim...64.exe

windows11-ltsc_2024-x64

4

Gereksinim...86.exe

windows10-2004-x64

4

Gereksinim...86.exe

windows11-ltsc_2024-x64

4

Gereksinim...64.exe

windows10-2004-x64

4

Gereksinim...64.exe

windows11-ltsc_2024-x64

4

Gereksinim...86.exe

windows10-2004-x64

4

Gereksinim...86.exe

windows11-ltsc_2024-x64

4

Gereksinim...er.bat

windows10-2004-x64

3

Gereksinim...er.bat

windows11-ltsc_2024-x64

3

Gereksinim...gs.vbs

windows10-2004-x64

5

Gereksinim...gs.vbs

windows11-ltsc_2024-x64

5

Gereksinim...ol.exe

windows10-2004-x64

5

Gereksinim...ol.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Gereksinimler.rar
  • Size 93.8MB
  • Sample260823-e88mysxwe1
  • SHA256 365bef00d710d57b4c1c3ff4399083e91717d3a24cb029ee6e5a17b5cb0e88b4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationransomwarespywaretrojanupx

Malware Config

Targets

    • Target
      Gereksinimler ROVİDA/AIO/install_all.bat
    • Size 1KB
    • SHA256 492ee4c16ac45a5483088583c9caa08252d3a1bb3922dbbec834d61673538f17
    • MD5 SHA1 SHA512 TLSH
    Score
    7/10
    discoveryexecutionpersistenceprivilege_escalationransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2
    • Target
      Gereksinimler ROVİDA/AIO/vcredist2005_x64.exe
    • Size 3.0MB
    • SHA256 0551a61c85b718e1fa015b0c3e3f4c4eea0637055536c00e7969286b4fa663e0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discoverypersistenceprivilege_escalationransomware

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral3behavioral4
    • Target
      Gereksinimler ROVİDA/AIO/vcredist2005_x86.exe
    • Size 2.6MB
    • SHA256 4ee4da0fe62d5fa1b5e80c6e6d88a4a2f8b3b140c35da51053d0d7b72a381d29
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discoverypersistenceprivilege_escalationransomware

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral5behavioral6
    • Target
      Gereksinimler ROVİDA/AIO/vcredist2008_x64.exe
    • Size 5.0MB
    • SHA256 b811f2c047a3e828517c234bd4aa4883e1ec591d88fad21289ae68a6915a6665
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      Gereksinimler ROVİDA/AIO/vcredist2008_x86.exe
    • Size 4.3MB
    • SHA256 6b3e4c51c6c0e5f68c8a72b497445af3dbf976394cbb62aa23569065c28deeb6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      Gereksinimler ROVİDA/AIO/vcredist2010_x64.exe
    • Size 9.8MB
    • SHA256 cc7ec044218c72a9a15fca2363baed8fc51095ee3b2a7593476771f9eba3d223
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      Gereksinimler ROVİDA/AIO/vcredist2010_x86.exe
    • Size 8.6MB
    • SHA256 67313b3d1bc86e83091e8de22981f14968f1a7fb12eb7ad467754c40cd94cc3d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral13behavioral14
    • Target
      Gereksinimler ROVİDA/AIO/vcredist2012_x64.exe
    • Size 6.9MB
    • SHA256 681be3e5ba9fd3da02c09d7e565adfa078640ed66a0d58583efad2c1e3cc4064
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral15behavioral16
    • Target
      Gereksinimler ROVİDA/AIO/vcredist2012_x86.exe
    • Size 6.3MB
    • SHA256 b924ad8062eaf4e70437c8be50fa612162795ff0839479546ce907ffa8d6e386
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral17behavioral18
    • Target
      Gereksinimler ROVİDA/AIO/vcredist2013_x64.exe
    • Size 6.9MB
    • SHA256 a4bba7701e355ae29c403431f871a537897c363e215cafe706615e270984f17c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral19behavioral20
    • Target
      Gereksinimler ROVİDA/AIO/vcredist2013_x86.exe
    • Size 6.2MB
    • SHA256 53b605d1100ab0a88b867447bbf9274b5938125024ba01f5105a9e178a3dcdbd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral21behavioral22
    • Target
      Gereksinimler ROVİDA/AIO/vcredist2015_2017_2019_2022_x64.exe
    • Size 24.5MB
    • SHA256 1821577409c35b2b9505ac833e246376cc68a8262972100444010b57226f0940
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral23behavioral24
    • Target
      Gereksinimler ROVİDA/AIO/vcredist2015_2017_2019_2022_x86.exe
    • Size 13.3MB
    • SHA256 dd1a8be03398367745a87a5e35bebdab00fdad080cf42af0c3f20802d08c25d4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral25behavioral26
    • Target
      Gereksinimler ROVİDA/Checker.bat
    • Size 781B
    • SHA256 0a901394627c00d4c9f2788863a4d111d3a1e7a52cda7475c4f164240d8302d1
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral27behavioral28
    • Target
      Gereksinimler ROVİDA/Defender Control/Defender_Settings.vbs
    • Size 313B
    • SHA256 af42a17d428c8e9d6f4a6d3393ec268f4d12bbfd01a897d87275482a45c847e9
    • MD5 SHA1 SHA512 TLSH
    Score
    5/10
    execution

    • Drops file in System32 directory

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral29behavioral30
    • Target
      Gereksinimler ROVİDA/Defender Control/dControl.exe
    • Size 447KB
    • SHA256 1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryupxadwaredefense_evasionevasionexecutionpersistenceprivilege_escalationspywaretrojan

    • Modifies Windows Defender DisableAntiSpyware settings

      evasiontrojan

    • Modifies Windows Defender TamperProtection settings

      evasiontrojan

    • Modifies firewall policy service

      defense_evasion

    • Modifies security service

      defense_evasion

    • Windows security bypass

      defense_evasiontrojan

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Windows security modification

      defense_evasiontrojan

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Indicator Removal: Clear Persistence

      remove IFEO.

      defense_evasion

    • Modifies Security services

      Modifies the startup behavior of a security service.

      defense_evasion

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

4
T1059

PowerShell

2
T1059.001

Visual Basic

1
T1059.005

Windows Command Shell

1
T1059.003

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

4
T1543

Windows Service

4
T1543.003

Event Triggered Execution

3
T1546

Component Object Model Hijacking

1
T1546.015

Image File Execution Options Injection

1
T1546.012

Installer Packages

1
T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

4
T1543

Windows Service

4
T1543.003

Event Triggered Execution

3
T1546

Component Object Model Hijacking

1
T1546.015

Image File Execution Options Injection

1
T1546.012

Installer Packages

1
T1546.016

Defense Evasion

Impair Defenses

6
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

4
T1562.001

Indicator Removal

1
T1070

Clear Persistence

1
T1070.009

Modify Registry

9
T1112

System Binary Proxy Execution

1
T1218

Msiexec

1
T1218.007

Credential Access

Discovery

Peripheral Device Discovery

2
T1120

Query Registry

6
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

upx
Score
5/10

behavioral1

discoveryexecutionpersistenceprivilege_escalationransomware
Score
7/10

behavioral2

discoveryexecutionpersistenceprivilege_escalationransomware
Score
7/10

behavioral3

discoverypersistenceprivilege_escalationransomware
Score
7/10

behavioral4

discoverypersistenceprivilege_escalationransomware
Score
7/10

behavioral5

discoverypersistenceprivilege_escalationransomware
Score
7/10

behavioral6

discoverypersistenceprivilege_escalationransomware
Score
7/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
4/10

behavioral16

discovery
Score
4/10

behavioral17

discovery
Score
4/10

behavioral18

discovery
Score
4/10

behavioral19

discovery
Score
4/10

behavioral20

discovery
Score
4/10

behavioral21

discovery
Score
4/10

behavioral22

discovery
Score
4/10

behavioral23

discovery
Score
4/10

behavioral24

discovery
Score
4/10

behavioral25

discovery
Score
4/10

behavioral26

discovery
Score
4/10

behavioral27

execution
Score
3/10

behavioral28

execution
Score
3/10

behavioral29

execution
Score
5/10

behavioral30

execution
Score
5/10

behavioral31

discoveryupx
Score
5/10

behavioral32

adwaredefense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationspywaretrojanupx
Score
10/10