Analysis
-
max time kernel
101s -
max time network
99s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
31-01-2023 13:48
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20221111-en
General
-
Target
tmp.exe
-
Size
8KB
-
MD5
9ce72ed428e9196e4e47d6977dd91646
-
SHA1
b52204e0f6b40129d3ed22da0f4f9e230ef04362
-
SHA256
3d106d9e8d65c6f681f07ad74f99cf196eb4d9553eebab2d7448ffe65ac15d36
-
SHA512
663a2cae6ddb9e92d76ee664fe960915da177b74c2b1d06ea66370626bee52467c99f7d071d331d0bb4b988f46cd67ab413923246d403a6112918c96f8fb8096
-
SSDEEP
192:oAU3/5oNY99v2YuYsjPKmWBWQShNWdhLdW7:+Rr9t2Y6PKmKOWPdW
Malware Config
Extracted
C:\FILE RECOVERY.txt
mallox.resurrection@onionmail.org
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
Signatures
-
Detect PureCrypter injector 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1700-56-0x0000000006A60000-0x0000000006CD8000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Stops running service(s) 3 TTPs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
RegAsm.exedescription ioc process File opened (read-only) \??\Q: RegAsm.exe File opened (read-only) \??\S: RegAsm.exe File opened (read-only) \??\T: RegAsm.exe File opened (read-only) \??\U: RegAsm.exe File opened (read-only) \??\B: RegAsm.exe File opened (read-only) \??\H: RegAsm.exe File opened (read-only) \??\L: RegAsm.exe File opened (read-only) \??\O: RegAsm.exe File opened (read-only) \??\V: RegAsm.exe File opened (read-only) \??\E: RegAsm.exe File opened (read-only) \??\I: RegAsm.exe File opened (read-only) \??\J: RegAsm.exe File opened (read-only) \??\R: RegAsm.exe File opened (read-only) \??\W: RegAsm.exe File opened (read-only) \??\X: RegAsm.exe File opened (read-only) \??\A: RegAsm.exe File opened (read-only) \??\F: RegAsm.exe File opened (read-only) \??\K: RegAsm.exe File opened (read-only) \??\M: RegAsm.exe File opened (read-only) \??\Z: RegAsm.exe File opened (read-only) \??\G: RegAsm.exe File opened (read-only) \??\N: RegAsm.exe File opened (read-only) \??\P: RegAsm.exe File opened (read-only) \??\Y: RegAsm.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tmp.exedescription pid process target process PID 1700 set thread context of 564 1700 tmp.exe RegAsm.exe -
Drops file in Program Files directory 64 IoCs
Processes:
RegAsm.exedescription ioc process File opened for modification C:\Program Files\7-Zip\Lang\co.txt RegAsm.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099150.JPG RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Things\SHOT.WAV RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCINFO.XML RegAsm.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png RegAsm.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00231_.WMF RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21298_.GIF RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR34F.GIF RegAsm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0234001.WMF RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR3B.GIF RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\FEZIP.POC RegAsm.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\FILE RECOVERY.txt RegAsm.exe File created C:\Program Files (x86)\Windows Media Player\en-US\FILE RECOVERY.txt RegAsm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.xml RegAsm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7.png RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectStatusIcons.jpg RegAsm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Manaus RegAsm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-core.xml RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0387604.JPG RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_right.gif RegAsm.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt RegAsm.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\FILE RECOVERY.txt RegAsm.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\vlc.mo RegAsm.exe File created C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\FILE RECOVERY.txt RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00223_.WMF RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\OFFICE10.MMW RegAsm.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\main.css RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01748_.GIF RegAsm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_ja.jar RegAsm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-outline.jar RegAsm.exe File opened for modification C:\Program Files\Windows Journal\fr-FR\PDIALOG.exe.mui RegAsm.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\form_responses.gif RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101866.BMP RegAsm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_zh_CN.jar RegAsm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-fallback.xml RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14533_.GIF RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PSRCHLEX.DAT RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\TAB_OFF.GIF RegAsm.exe File created C:\Program Files (x86)\Uninstall Information\FILE RECOVERY.txt RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02398_.WMF RegAsm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\classlist RegAsm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_ja_4.4.0.v20140623020002.jar RegAsm.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\vlc.mo RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SPRNG_01.MID RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18242_.WMF RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Fancy.dotx RegAsm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tbilisi RegAsm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSEvents.man RegAsm.exe File opened for modification C:\Program Files\Microsoft Games\Chess\FILE RECOVERY.txt RegAsm.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt RegAsm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif RegAsm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedback.gif RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0196374.WMF RegAsm.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT RegAsm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_justify.gif RegAsm.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt RegAsm.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 1932 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1852 vssadmin.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
RegAsm.exepid process 564 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
tmp.exeRegAsm.exevssvc.exedescription pid process Token: SeDebugPrivilege 1700 tmp.exe Token: SeTakeOwnershipPrivilege 564 RegAsm.exe Token: SeDebugPrivilege 564 RegAsm.exe Token: SeBackupPrivilege 1304 vssvc.exe Token: SeRestorePrivilege 1304 vssvc.exe Token: SeAuditPrivilege 1304 vssvc.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
tmp.exeRegAsm.execmd.execmd.exedescription pid process target process PID 1700 wrote to memory of 564 1700 tmp.exe RegAsm.exe PID 1700 wrote to memory of 564 1700 tmp.exe RegAsm.exe PID 1700 wrote to memory of 564 1700 tmp.exe RegAsm.exe PID 1700 wrote to memory of 564 1700 tmp.exe RegAsm.exe PID 1700 wrote to memory of 564 1700 tmp.exe RegAsm.exe PID 1700 wrote to memory of 564 1700 tmp.exe RegAsm.exe PID 1700 wrote to memory of 564 1700 tmp.exe RegAsm.exe PID 1700 wrote to memory of 564 1700 tmp.exe RegAsm.exe PID 1700 wrote to memory of 564 1700 tmp.exe RegAsm.exe PID 1700 wrote to memory of 564 1700 tmp.exe RegAsm.exe PID 1700 wrote to memory of 564 1700 tmp.exe RegAsm.exe PID 1700 wrote to memory of 564 1700 tmp.exe RegAsm.exe PID 1700 wrote to memory of 564 1700 tmp.exe RegAsm.exe PID 1700 wrote to memory of 564 1700 tmp.exe RegAsm.exe PID 564 wrote to memory of 1852 564 RegAsm.exe vssadmin.exe PID 564 wrote to memory of 1852 564 RegAsm.exe vssadmin.exe PID 564 wrote to memory of 1852 564 RegAsm.exe vssadmin.exe PID 564 wrote to memory of 1852 564 RegAsm.exe vssadmin.exe PID 564 wrote to memory of 1844 564 RegAsm.exe cmd.exe PID 564 wrote to memory of 1844 564 RegAsm.exe cmd.exe PID 564 wrote to memory of 1844 564 RegAsm.exe cmd.exe PID 564 wrote to memory of 1844 564 RegAsm.exe cmd.exe PID 564 wrote to memory of 1784 564 RegAsm.exe cmd.exe PID 564 wrote to memory of 1784 564 RegAsm.exe cmd.exe PID 564 wrote to memory of 1784 564 RegAsm.exe cmd.exe PID 564 wrote to memory of 1784 564 RegAsm.exe cmd.exe PID 564 wrote to memory of 856 564 RegAsm.exe cmd.exe PID 564 wrote to memory of 856 564 RegAsm.exe cmd.exe PID 564 wrote to memory of 856 564 RegAsm.exe cmd.exe PID 564 wrote to memory of 856 564 RegAsm.exe cmd.exe PID 1784 wrote to memory of 1932 1784 cmd.exe sc.exe PID 1784 wrote to memory of 1932 1784 cmd.exe sc.exe PID 1784 wrote to memory of 1932 1784 cmd.exe sc.exe PID 1784 wrote to memory of 1932 1784 cmd.exe sc.exe PID 564 wrote to memory of 1036 564 RegAsm.exe cmd.exe PID 564 wrote to memory of 1036 564 RegAsm.exe cmd.exe PID 564 wrote to memory of 1036 564 RegAsm.exe cmd.exe PID 564 wrote to memory of 1036 564 RegAsm.exe cmd.exe PID 1036 wrote to memory of 1008 1036 cmd.exe PING.EXE PID 1036 wrote to memory of 1008 1036 cmd.exe PING.EXE PID 1036 wrote to memory of 1008 1036 cmd.exe PING.EXE PID 1036 wrote to memory of 1008 1036 cmd.exe PING.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
RegAsm.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\vssadmin.exe"C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C sc delete "MSSQLFDLauncher"&&sc delete "MSSQLSERVER"&&sc delete "SQLSERVERAGENT"&&sc delete "SQLBrowser"&&sc delete "SQLTELEMETRY"&&sc delete "MsDtsServer130"&&sc delete "SSISTELEMETRY130"&&sc delete "SQLWriter"&&sc delete "MSSQL$VEEAMSQL2012"&&sc delete "SQLAgent$VEEAMSQL2012"&&sc delete "MSSQL"&&sc delete "SQLAgent"&&sc delete "MSSQLServerADHelper100"&&sc delete "MSSQLServerOLAPService"&&sc delete "MsDtsServer100"&&sc delete "ReportServer"&&sc delete "SQLTELEMETRY$HL"&&sc delete "TMBMServer"&&sc delete "MSSQL$PROGID"&&sc delete "MSSQL$WOLTERSKLUWER"&&sc delete "SQLAgent$PROGID"&&sc delete "SQLAgent$WOLTERSKLUWER"&&sc delete "MSSQLFDLauncher$OPTIMA"&&sc delete "MSSQL$OPTIMA"&&sc delete "SQLAgent$OPTIMA"&&sc delete "ReportServer$OPTIMA"&&sc delete "msftesql$SQLEXPRESS"&&sc delete "postgresql-x64-9.4"&&rem Kill "SQL"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im MsDtsSrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im Ssms.exe&&taskkill -f -im SQLAGENT.EXE&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im ReportingServicesService.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQLFDLauncher"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 && del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" >> NUL3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/564-67-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/564-68-0x0000000000408F6E-mapping.dmp
-
memory/564-81-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/564-58-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/564-59-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/564-61-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/564-63-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/564-64-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/564-71-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/564-79-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/564-78-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/564-65-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/856-76-0x0000000000000000-mapping.dmp
-
memory/1008-82-0x0000000000000000-mapping.dmp
-
memory/1036-80-0x0000000000000000-mapping.dmp
-
memory/1700-55-0x0000000075FF1000-0x0000000075FF3000-memory.dmpFilesize
8KB
-
memory/1700-56-0x0000000006A60000-0x0000000006CD8000-memory.dmpFilesize
2.5MB
-
memory/1700-57-0x0000000003EB0000-0x0000000003F02000-memory.dmpFilesize
328KB
-
memory/1700-54-0x0000000000030000-0x0000000000038000-memory.dmpFilesize
32KB
-
memory/1784-75-0x0000000000000000-mapping.dmp
-
memory/1844-74-0x0000000000000000-mapping.dmp
-
memory/1852-73-0x0000000000000000-mapping.dmp
-
memory/1932-77-0x0000000000000000-mapping.dmp