Analysis
-
max time kernel
34s -
max time network
57s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27/01/2023, 12:50
Static task
static1
Behavioral task
behavioral1
Sample
23ee744fa24aaada6ab0a81166c2f5466d29d502.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
23ee744fa24aaada6ab0a81166c2f5466d29d502.exe
Resource
win10v2004-20220812-en
General
-
Target
23ee744fa24aaada6ab0a81166c2f5466d29d502.exe
-
Size
477KB
-
MD5
447f1d5a645314beb0b1d6b0f2f5119f
-
SHA1
23ee744fa24aaada6ab0a81166c2f5466d29d502
-
SHA256
850f818aca36188fff35a492275cd63ba81f6e48263faa669fb5e192165f2f92
-
SHA512
2a4ed5f9a933ef0330c81672c17623143ee0c3693d6c56c85632c0bac2b7a8fb049bae0af904a1bd2a16db8ac338d78d0928e0edc7f5d866170d25c19407e752
-
SSDEEP
3072:N36LY3qIwBzFyIR+DSbhsR2OsHas+8yqB1LuiCx8V8rIiJzQvstptE8z0N:N36hWsHtlLv8EiFES0
Malware Config
Signatures
-
Detect PureCrypter injector 1 IoCs
resource yara_rule behavioral1/memory/1716-56-0x0000000006310000-0x0000000006574000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sfrdma = "\"C:\\Users\\Admin\\AppData\\Roaming\\Cffvs\\Sfrdma.exe\"" 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 1288 ipconfig.exe 572 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 1788 powershell.exe 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe Token: SeDebugPrivilege 1788 powershell.exe -
Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 1716 wrote to memory of 1128 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 28 PID 1716 wrote to memory of 1128 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 28 PID 1716 wrote to memory of 1128 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 28 PID 1716 wrote to memory of 1128 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 28 PID 1128 wrote to memory of 1288 1128 cmd.exe 30 PID 1128 wrote to memory of 1288 1128 cmd.exe 30 PID 1128 wrote to memory of 1288 1128 cmd.exe 30 PID 1128 wrote to memory of 1288 1128 cmd.exe 30 PID 1716 wrote to memory of 1788 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 31 PID 1716 wrote to memory of 1788 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 31 PID 1716 wrote to memory of 1788 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 31 PID 1716 wrote to memory of 1788 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 31 PID 1716 wrote to memory of 760 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 34 PID 1716 wrote to memory of 760 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 34 PID 1716 wrote to memory of 760 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 34 PID 1716 wrote to memory of 760 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 34 PID 760 wrote to memory of 572 760 cmd.exe 36 PID 760 wrote to memory of 572 760 cmd.exe 36 PID 760 wrote to memory of 572 760 cmd.exe 36 PID 760 wrote to memory of 572 760 cmd.exe 36 PID 1716 wrote to memory of 600 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 37 PID 1716 wrote to memory of 600 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 37 PID 1716 wrote to memory of 600 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 37 PID 1716 wrote to memory of 600 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 37 PID 1716 wrote to memory of 1384 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 38 PID 1716 wrote to memory of 1384 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 38 PID 1716 wrote to memory of 1384 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 38 PID 1716 wrote to memory of 1384 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 38 PID 1716 wrote to memory of 112 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 39 PID 1716 wrote to memory of 112 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 39 PID 1716 wrote to memory of 112 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 39 PID 1716 wrote to memory of 112 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 39 PID 1716 wrote to memory of 1544 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 40 PID 1716 wrote to memory of 1544 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 40 PID 1716 wrote to memory of 1544 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 40 PID 1716 wrote to memory of 1544 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 40 PID 1716 wrote to memory of 1816 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 41 PID 1716 wrote to memory of 1816 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 41 PID 1716 wrote to memory of 1816 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 41 PID 1716 wrote to memory of 1816 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 41 PID 1716 wrote to memory of 1148 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 42 PID 1716 wrote to memory of 1148 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 42 PID 1716 wrote to memory of 1148 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 42 PID 1716 wrote to memory of 1148 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 42 PID 1716 wrote to memory of 432 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 43 PID 1716 wrote to memory of 432 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 43 PID 1716 wrote to memory of 432 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 43 PID 1716 wrote to memory of 432 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 43 PID 1716 wrote to memory of 1120 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 44 PID 1716 wrote to memory of 1120 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 44 PID 1716 wrote to memory of 1120 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 44 PID 1716 wrote to memory of 1120 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 44 PID 1716 wrote to memory of 1056 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 45 PID 1716 wrote to memory of 1056 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 45 PID 1716 wrote to memory of 1056 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 45 PID 1716 wrote to memory of 1056 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 45 PID 1716 wrote to memory of 1620 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 46 PID 1716 wrote to memory of 1620 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 46 PID 1716 wrote to memory of 1620 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 46 PID 1716 wrote to memory of 1620 1716 23ee744fa24aaada6ab0a81166c2f5466d29d502.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\23ee744fa24aaada6ab0a81166c2f5466d29d502.exe"C:\Users\Admin\AppData\Local\Temp\23ee744fa24aaada6ab0a81166c2f5466d29d502.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig/release2⤵
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /release3⤵
- Gathers network information
PID:1288
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1788
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig/renew2⤵
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /renew3⤵
- Gathers network information
PID:572
-
-
-
C:\Users\Admin\AppData\Local\Temp\23ee744fa24aaada6ab0a81166c2f5466d29d502.exeC:\Users\Admin\AppData\Local\Temp\23ee744fa24aaada6ab0a81166c2f5466d29d502.exe2⤵PID:600
-
-
C:\Users\Admin\AppData\Local\Temp\23ee744fa24aaada6ab0a81166c2f5466d29d502.exeC:\Users\Admin\AppData\Local\Temp\23ee744fa24aaada6ab0a81166c2f5466d29d502.exe2⤵PID:1384
-
-
C:\Users\Admin\AppData\Local\Temp\23ee744fa24aaada6ab0a81166c2f5466d29d502.exeC:\Users\Admin\AppData\Local\Temp\23ee744fa24aaada6ab0a81166c2f5466d29d502.exe2⤵PID:112
-
-
C:\Users\Admin\AppData\Local\Temp\23ee744fa24aaada6ab0a81166c2f5466d29d502.exeC:\Users\Admin\AppData\Local\Temp\23ee744fa24aaada6ab0a81166c2f5466d29d502.exe2⤵PID:1544
-
-
C:\Users\Admin\AppData\Local\Temp\23ee744fa24aaada6ab0a81166c2f5466d29d502.exeC:\Users\Admin\AppData\Local\Temp\23ee744fa24aaada6ab0a81166c2f5466d29d502.exe2⤵PID:1816
-
-
C:\Users\Admin\AppData\Local\Temp\23ee744fa24aaada6ab0a81166c2f5466d29d502.exeC:\Users\Admin\AppData\Local\Temp\23ee744fa24aaada6ab0a81166c2f5466d29d502.exe2⤵PID:1148
-
-
C:\Users\Admin\AppData\Local\Temp\23ee744fa24aaada6ab0a81166c2f5466d29d502.exeC:\Users\Admin\AppData\Local\Temp\23ee744fa24aaada6ab0a81166c2f5466d29d502.exe2⤵PID:432
-
-
C:\Users\Admin\AppData\Local\Temp\23ee744fa24aaada6ab0a81166c2f5466d29d502.exeC:\Users\Admin\AppData\Local\Temp\23ee744fa24aaada6ab0a81166c2f5466d29d502.exe2⤵PID:1120
-
-
C:\Users\Admin\AppData\Local\Temp\23ee744fa24aaada6ab0a81166c2f5466d29d502.exeC:\Users\Admin\AppData\Local\Temp\23ee744fa24aaada6ab0a81166c2f5466d29d502.exe2⤵PID:1056
-
-
C:\Users\Admin\AppData\Local\Temp\23ee744fa24aaada6ab0a81166c2f5466d29d502.exeC:\Users\Admin\AppData\Local\Temp\23ee744fa24aaada6ab0a81166c2f5466d29d502.exe2⤵PID:1620
-