Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
16-02-2022 10:17
General
-
Target
608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff.exe
-
Size
186KB
-
MD5
2ed8df319374ded66ac933e7b44eb270
-
SHA1
5f237f5ee1cf93f9860aa3264337727fea796e1d
-
SHA256
608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff
-
SHA512
0c1a5e1f7ab3e82d0c304809b488ba48c7d48c175a53480f26c616c69649caa67f937c6a475b3ed117514255d150cbb1f38cd5de1576fd216ebc4d38c7779c80
Malware Config
Extracted
purplefox
Sainbox
45.115.124.71
Extracted
purplefox
Signatures
-
resource yara_rule purplefox_dropper behavioral1/files/0x000600000001e726-137.dat purplefox_dropper behavioral1/files/0x000700000001e737-141.dat purplefox_dropper behavioral1/memory/3384-142-0x0000000180000000-0x0000000180874000-memory.dmp purplefox_dropper behavioral1/memory/3384-147-0x0000000002C40000-0x000000000347E000-memory.dmp purplefox_dropper -
resource yara_rule purplefox_rootkit behavioral1/files/0x000600000001e726-137.dat purplefox_rootkit behavioral1/files/0x000700000001e737-141.dat purplefox_rootkit behavioral1/memory/3384-142-0x0000000180000000-0x0000000180874000-memory.dmp purplefox_rootkit behavioral1/memory/3384-147-0x0000000002C40000-0x000000000347E000-memory.dmp purplefox_rootkit -
Executes dropped EXE 2 IoCs
pid Process 4568 7zz.exe 3384 ojbkcg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff.exe -
Loads dropped DLL 1 IoCs
pid Process 3384 ojbkcg.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: ojbkcg.exe File opened (read-only) \??\K: ojbkcg.exe File opened (read-only) \??\L: ojbkcg.exe File opened (read-only) \??\P: ojbkcg.exe File opened (read-only) \??\S: ojbkcg.exe File opened (read-only) \??\U: ojbkcg.exe File opened (read-only) \??\E: ojbkcg.exe File opened (read-only) \??\I: ojbkcg.exe File opened (read-only) \??\W: ojbkcg.exe File opened (read-only) \??\Z: ojbkcg.exe File opened (read-only) \??\R: ojbkcg.exe File opened (read-only) \??\F: ojbkcg.exe File opened (read-only) \??\O: ojbkcg.exe File opened (read-only) \??\V: ojbkcg.exe File opened (read-only) \??\G: ojbkcg.exe File opened (read-only) \??\M: ojbkcg.exe File opened (read-only) \??\N: ojbkcg.exe File opened (read-only) \??\Q: ojbkcg.exe File opened (read-only) \??\T: ojbkcg.exe File opened (read-only) \??\X: ojbkcg.exe File opened (read-only) \??\Y: ojbkcg.exe File opened (read-only) \??\B: ojbkcg.exe File opened (read-only) \??\H: ojbkcg.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ojbkcg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ojbkcg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2640 608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff.exe 2640 608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe 3384 ojbkcg.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3612 svchost.exe Token: SeCreatePagefilePrivilege 3612 svchost.exe Token: SeShutdownPrivilege 3612 svchost.exe Token: SeCreatePagefilePrivilege 3612 svchost.exe Token: SeShutdownPrivilege 3612 svchost.exe Token: SeCreatePagefilePrivilege 3612 svchost.exe Token: SeSecurityPrivilege 3036 TiWorker.exe Token: SeRestorePrivilege 3036 TiWorker.exe Token: SeBackupPrivilege 3036 TiWorker.exe Token: SeBackupPrivilege 3036 TiWorker.exe Token: SeRestorePrivilege 3036 TiWorker.exe Token: SeSecurityPrivilege 3036 TiWorker.exe Token: SeBackupPrivilege 3036 TiWorker.exe Token: SeRestorePrivilege 3036 TiWorker.exe Token: SeSecurityPrivilege 3036 TiWorker.exe Token: SeBackupPrivilege 3036 TiWorker.exe Token: SeRestorePrivilege 3036 TiWorker.exe Token: SeSecurityPrivilege 3036 TiWorker.exe Token: SeBackupPrivilege 3036 TiWorker.exe Token: SeRestorePrivilege 3036 TiWorker.exe Token: SeSecurityPrivilege 3036 TiWorker.exe Token: SeBackupPrivilege 3036 TiWorker.exe Token: SeRestorePrivilege 3036 TiWorker.exe Token: SeSecurityPrivilege 3036 TiWorker.exe Token: SeBackupPrivilege 3036 TiWorker.exe Token: SeRestorePrivilege 3036 TiWorker.exe Token: SeSecurityPrivilege 3036 TiWorker.exe Token: SeBackupPrivilege 3036 TiWorker.exe Token: SeRestorePrivilege 3036 TiWorker.exe Token: SeSecurityPrivilege 3036 TiWorker.exe Token: SeBackupPrivilege 3036 TiWorker.exe Token: SeRestorePrivilege 3036 TiWorker.exe Token: SeSecurityPrivilege 3036 TiWorker.exe Token: SeBackupPrivilege 3036 TiWorker.exe Token: SeRestorePrivilege 3036 TiWorker.exe Token: SeSecurityPrivilege 3036 TiWorker.exe Token: SeBackupPrivilege 3036 TiWorker.exe Token: SeRestorePrivilege 3036 TiWorker.exe Token: SeSecurityPrivilege 3036 TiWorker.exe Token: SeBackupPrivilege 3036 TiWorker.exe Token: SeRestorePrivilege 3036 TiWorker.exe Token: SeSecurityPrivilege 3036 TiWorker.exe Token: SeBackupPrivilege 3036 TiWorker.exe Token: SeRestorePrivilege 3036 TiWorker.exe Token: SeSecurityPrivilege 3036 TiWorker.exe Token: SeBackupPrivilege 3036 TiWorker.exe Token: SeRestorePrivilege 3036 TiWorker.exe Token: SeSecurityPrivilege 3036 TiWorker.exe Token: SeBackupPrivilege 3036 TiWorker.exe Token: SeRestorePrivilege 3036 TiWorker.exe Token: SeSecurityPrivilege 3036 TiWorker.exe Token: SeBackupPrivilege 3036 TiWorker.exe Token: SeRestorePrivilege 3036 TiWorker.exe Token: SeSecurityPrivilege 3036 TiWorker.exe Token: SeBackupPrivilege 3036 TiWorker.exe Token: SeRestorePrivilege 3036 TiWorker.exe Token: SeSecurityPrivilege 3036 TiWorker.exe Token: SeBackupPrivilege 3036 TiWorker.exe Token: SeRestorePrivilege 3036 TiWorker.exe Token: SeSecurityPrivilege 3036 TiWorker.exe Token: SeBackupPrivilege 3036 TiWorker.exe Token: SeRestorePrivilege 3036 TiWorker.exe Token: SeSecurityPrivilege 3036 TiWorker.exe Token: SeBackupPrivilege 3036 TiWorker.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2640 wrote to memory of 4568 2640 608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff.exe 89 PID 2640 wrote to memory of 4568 2640 608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff.exe 89 PID 2640 wrote to memory of 4568 2640 608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff.exe 89 PID 2640 wrote to memory of 3384 2640 608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff.exe 93 PID 2640 wrote to memory of 3384 2640 608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff.exe"C:\Users\Admin\AppData\Local\Temp\608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Public\Videos\1645006653\7zz.exe"C:\Users\Public\Videos\1645006653\7zz.exe" X -ep2 C:\Users\Public\Videos\1645006653\1.rar C:\Users\Public\Videos\16450066532⤵
- Executes dropped EXE
PID:4568
-
-
C:\Users\Public\Videos\1645006653\ojbkcg.exe"C:\Users\Public\Videos\1645006653\ojbkcg.exe" -a2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3384
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3612
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3036
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.2MB
MD58661e75b667f382c424512e70f229d5d
SHA13ebd07281aeef62e4cecc1fadfeb79b55dc626a3
SHA256c006b7b6196dc366e1c63efec480075dcf2e4c8d6186f0f00b790f95946934d9
SHA51213485d4f8317ec8ee09175bcdc59fac5d849c19c1b5b72254ba945c499b70cb0dc607b7dd49ed9db44c10ce998396324fadb3355c637b3c7e689cdaef761e577
-
Filesize
2.5MB
MD5329386fd9857d250ec2274643474758b
SHA12e422cd21f4e2ac5ed0144f5126f5a78c8151acb
SHA2563fffa18db7a9211c0a6e0211bcd3ffe7ae7ef001327dfb29a9af8bf4ba3f2de1
SHA5120e1774bfe51a2c304e0cd8dab55329bd60e8af2c264557b7029413bc7cbb565a8c8e0ef9382b1f4b00d779c64a54106a969d24aff87e8f71382e131d72b64aa6
-
Filesize
253KB
MD5b6ee97ccbebb6c4d06e1a7a7bb4ee1c8
SHA17451e21a49529eb7e42fc5fc03d6980fabc00c44
SHA25687d3ea42604943d2230cc0b5aea499da41fc7db46d141abf96875692040e4699
SHA512060d9790e31c71e9e9b3d132088c107a6ae79a707ae3654b4c7e5a9248fd610761c0c40c54f4930d36c0379b490e7bee1be5592da85e4fe4c3f5c4a1a2eddd12
-
Filesize
253KB
MD5b6ee97ccbebb6c4d06e1a7a7bb4ee1c8
SHA17451e21a49529eb7e42fc5fc03d6980fabc00c44
SHA25687d3ea42604943d2230cc0b5aea499da41fc7db46d141abf96875692040e4699
SHA512060d9790e31c71e9e9b3d132088c107a6ae79a707ae3654b4c7e5a9248fd610761c0c40c54f4930d36c0379b490e7bee1be5592da85e4fe4c3f5c4a1a2eddd12
-
Filesize
572KB
MD5f2ae502d448cfb81a5f40a9368d99b1a
SHA1f849be86e9e7ced0acd51a68f92992b8090d08a5
SHA25607ad4b984f288304003b080dd013784685181de4353a0b70a0247f96e535bd56
SHA5129f3aea471684e22bf9fc045ca0e47a8429fa0b13c188f9c7a51937efa8afcec976761b0c4c95aed7735096fcc2278bbd86b0ab581261a6aff6c694d7bb65e9be
-
Filesize
171KB
MD5e0923ede0d979012969c62063c74f44d
SHA1f1dcf61b66745eff17702db4d4e4b6baa23bface
SHA2568577bcbd02d38bce9601eb43511017b0bbc5176ebc3c48c08c81f755fcf216f4
SHA51265d0ec789d6bfe423ce2b49c54ed26389bf61d9789cb7d2de857f4f24ab15815207bceedf191446e15fb9b0f3752489b3cda69ae85768a06a01654fa4e5a6d68
-
Filesize
171KB
MD5e0923ede0d979012969c62063c74f44d
SHA1f1dcf61b66745eff17702db4d4e4b6baa23bface
SHA2568577bcbd02d38bce9601eb43511017b0bbc5176ebc3c48c08c81f755fcf216f4
SHA51265d0ec789d6bfe423ce2b49c54ed26389bf61d9789cb7d2de857f4f24ab15815207bceedf191446e15fb9b0f3752489b3cda69ae85768a06a01654fa4e5a6d68
-
Filesize
45KB
MD5c36bb659f08f046b139c8d1b980bf1ac
SHA1dd3247b225a8da3161f76055f31cbc5f64a66086
SHA256405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4
SHA5123eeae6a3b424fa1709b4443f625ee99fa2d2861661214b868d36bf5a63c0aaac61ad3bdd9c4b18cb9d820ef89653787df812289d31d65415c4dd08fd45d0c73f
-
Filesize
8.2MB
MD58661e75b667f382c424512e70f229d5d
SHA13ebd07281aeef62e4cecc1fadfeb79b55dc626a3
SHA256c006b7b6196dc366e1c63efec480075dcf2e4c8d6186f0f00b790f95946934d9
SHA51213485d4f8317ec8ee09175bcdc59fac5d849c19c1b5b72254ba945c499b70cb0dc607b7dd49ed9db44c10ce998396324fadb3355c637b3c7e689cdaef761e577