Analysis
-
max time kernel
150s -
max time network
38s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
26/01/2023, 04:59
General
-
Target
28cfc00452c4e3e6c0082fdca3c520fc.exe
-
Size
24KB
-
MD5
28cfc00452c4e3e6c0082fdca3c520fc
-
SHA1
1260166c856aee0225371c7ab269f3a228cf8fb5
-
SHA256
93b17c9c6d764b7e218d2d1669e8bd68059da3fe346936071b012d22d52fb35e
-
SHA512
8413d173f55e5fe9d8fd415fd1f9e76358916ee1de5d1e6dbab3a1b18b0848011e76f7a2ee332f4fca64e8dcb26a8d1492c8d1ebe9ad165eba84c8dda6065af8
-
SSDEEP
96:IEfPqlezZjTldKYgr+Doo+HzQLCmNeit3l/kSw6k7l6xiRQe3T3erAo00wGvzNt:IEfPql6VpJ/oGlL/kHH7l6Ej7e
Malware Config
Signatures
-
Detect PureCrypter injector 1 IoCs
-
Detects Smokeloader packer 4 IoCs
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\28cfc00452c4e3e6c0082fdca3c520fc.exe"C:\Users\Admin\AppData\Local\Temp\28cfc00452c4e3e6c0082fdca3c520fc.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\28cfc00452c4e3e6c0082fdca3c520fc.exeC:\Users\Admin\AppData\Local\Temp\28cfc00452c4e3e6c0082fdca3c520fc.exe2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
280KB
-
Filesize
48KB
-
Filesize
2.3MB
-
Filesize
8KB