Resubmissions

15-12-2022 23:56

221215-3zc2pagf3v 10

15-12-2022 23:50

221215-3vj97sdg56 6

General

  • Target

    https://ewydrfdndsbrt.shop/index.php?key=116614230752

  • Sample

    221215-3zc2pagf3v

Malware Config

Targets

    • Target

      https://ewydrfdndsbrt.shop/index.php?key=116614230752

    • Detect PurpleFox MSI

      Detect PurpleFox MSI.

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Stops running service(s)

    • Loads dropped DLL

    • Modifies file permissions

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Program crash

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Defense Evasion

Impair Defenses

1
T1562

File Permissions Modification

1
T1222

Modify Registry

2
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Service Stop

1
T1489

Tasks