Behavioral Report

Analysis

max time kernel
54s
max time network
57s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-02-2023 14:47

Sharing

Copy URL

Twitter E-mail

Report Files Registry Network Processes Mutex Misc

General

Target

a3a1f1bee14b0e117ca9698ca7d4a964.exe
Size

2MB
MD5

a3a1f1bee14b0e117ca9698ca7d4a964
SHA1

c69838ade96ae8c914093516975929b84a86f098
SHA256

e5a5e82935acb5bf1706cd0e04a9bee5b0d995c4bf19ee3c363ceb9e6855ecab
SHA512

deaba5ffd966efaaabb864ac5886ebbb1c45f5286fb9a1897338d6fb6dcd733cd2f76ac769ca6795d3f7d1122c349879a339de1f8af9391853f3e2d448950773
SSDEEP

49152:dKfd3LCcCAwvevqw6m4OHoP45KBNu20Rt3CNuiO:ed3m06m4OIP45wN10Ro+

Score

10^/10

purecrypter downloader loader persistence

Malware Config

Signatures

Detect PureCrypter injector 1 IoCs
loader

Processes:

resource yara_rule

behavioral1/memory/856-55-0x000000001BC70000-0x000000001BF34000-memory.dmp family_purecrypter

resource	yara_rule
behavioral1/memory/856-55-0x000000001BC70000-0x000000001BF34000-memory.dmp	family_purecrypter

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

TTPs:

Winlogon Helper DLL Modify Registry

Processes:

a3a1f1bee14b0e117ca9698ca7d4a964.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\System32\\RuntimeBroker.exe\","	a3a1f1bee14b0e117ca9698ca7d4a964.exe

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Suspicious use of SetThreadContext 1 IoCs

Processes:

a3a1f1bee14b0e117ca9698ca7d4a964.exe

description pid process target process

PID 856 set thread context of 952 856 a3a1f1bee14b0e117ca9698ca7d4a964.exe a3a1f1bee14b0e117ca9698ca7d4a964.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

TTPs:

System Information Discovery
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exea3a1f1bee14b0e117ca9698ca7d4a964.exe

pid process

1156 powershell.exe
952 a3a1f1bee14b0e117ca9698ca7d4a964.exe
952 a3a1f1bee14b0e117ca9698ca7d4a964.exe

description	pid	process	target process
PID 856 set thread context of 952	856	a3a1f1bee14b0e117ca9698ca7d4a964.exe	a3a1f1bee14b0e117ca9698ca7d4a964.exe

pid	process
1156	powershell.exe
952	a3a1f1bee14b0e117ca9698ca7d4a964.exe
952	a3a1f1bee14b0e117ca9698ca7d4a964.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exea3a1f1bee14b0e117ca9698ca7d4a964.exea3a1f1bee14b0e117ca9698ca7d4a964.exe

description	pid	process
Token: SeDebugPrivilege	1156	powershell.exe
Token: SeDebugPrivilege	856	a3a1f1bee14b0e117ca9698ca7d4a964.exe
Token: SeDebugPrivilege	952	a3a1f1bee14b0e117ca9698ca7d4a964.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

a3a1f1bee14b0e117ca9698ca7d4a964.exe

description	pid	process	target process
PID 856 wrote to memory of 1156	856	a3a1f1bee14b0e117ca9698ca7d4a964.exe	powershell.exe
PID 856 wrote to memory of 1156	856	a3a1f1bee14b0e117ca9698ca7d4a964.exe	powershell.exe
PID 856 wrote to memory of 1156	856	a3a1f1bee14b0e117ca9698ca7d4a964.exe	powershell.exe
PID 856 wrote to memory of 952	856	a3a1f1bee14b0e117ca9698ca7d4a964.exe	a3a1f1bee14b0e117ca9698ca7d4a964.exe
PID 856 wrote to memory of 952	856	a3a1f1bee14b0e117ca9698ca7d4a964.exe	a3a1f1bee14b0e117ca9698ca7d4a964.exe
PID 856 wrote to memory of 952	856	a3a1f1bee14b0e117ca9698ca7d4a964.exe	a3a1f1bee14b0e117ca9698ca7d4a964.exe
PID 856 wrote to memory of 952	856	a3a1f1bee14b0e117ca9698ca7d4a964.exe	a3a1f1bee14b0e117ca9698ca7d4a964.exe
PID 856 wrote to memory of 952	856	a3a1f1bee14b0e117ca9698ca7d4a964.exe	a3a1f1bee14b0e117ca9698ca7d4a964.exe
PID 856 wrote to memory of 952	856	a3a1f1bee14b0e117ca9698ca7d4a964.exe	a3a1f1bee14b0e117ca9698ca7d4a964.exe
PID 856 wrote to memory of 952	856	a3a1f1bee14b0e117ca9698ca7d4a964.exe	a3a1f1bee14b0e117ca9698ca7d4a964.exe

C:\Users\Admin\AppData\Local\Temp\a3a1f1bee14b0e117ca9698ca7d4a964.exe

"C:\Users\Admin\AppData\Local\Temp\a3a1f1bee14b0e117ca9698ca7d4a964.exe"

Modifies WinLogon for persistence
Suspicious use of SetThreadContext
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory

PID:856

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==

Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken

PID:1156

C:\Users\Admin\AppData\Local\Temp\a3a1f1bee14b0e117ca9698ca7d4a964.exe

C:\Users\Admin\AppData\Local\Temp\a3a1f1bee14b0e117ca9698ca7d4a964.exe

Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken

PID:952

Network

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Modify Registry

T1112

Discovery

System Information Discovery

T1082

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Replay Monitor

00:00 00:00

Downloads

memory/856-54-0x0000000000290000-0x0000000000552000-memory.dmp

Filesize
2MB

Download
memory/856-55-0x000000001BC70000-0x000000001BF34000-memory.dmp

Filesize
2MB

Download
memory/856-65-0x000000001AF00000-0x000000001AFB4000-memory.dmp

Filesize
720KB

Download
memory/856-74-0x000000001B4E7000-0x000000001B506000-memory.dmp

Filesize
124KB

Download
memory/856-60-0x000000001B4E7000-0x000000001B506000-memory.dmp

Filesize
124KB

Download
memory/952-77-0x00000000026D0000-0x000000000271C000-memory.dmp

Filesize
304KB

Download
memory/952-76-0x000000001B640000-0x000000001B696000-memory.dmp

Filesize
344KB

Download
memory/952-75-0x000000001AEA0000-0x000000001AF40000-memory.dmp

Filesize
640KB

Download
memory/952-69-0x0000000140000000-0x0000000140078000-memory.dmp

Filesize
480KB

Download
memory/952-70-0x0000000140000000-0x0000000140078000-memory.dmp

Filesize
480KB

Download
memory/952-71-0x0000000140000000-mapping.dmp

Download
memory/952-78-0x00000000025A6000-0x00000000025C5000-memory.dmp

Filesize
124KB

Download
memory/952-66-0x0000000140000000-0x0000000140078000-memory.dmp

Filesize
480KB

Download
memory/952-67-0x0000000140000000-0x0000000140078000-memory.dmp

Filesize
480KB

Download
memory/1156-59-0x000007FEEB6A0000-0x000007FEEC1FD000-memory.dmp

Filesize
11MB

Download
memory/1156-64-0x000000000239B000-0x00000000023BA000-memory.dmp

Filesize
124KB

Download
memory/1156-63-0x0000000002394000-0x0000000002397000-memory.dmp

Filesize
12KB

Download
memory/1156-62-0x000000000239B000-0x00000000023BA000-memory.dmp

Filesize
124KB

Download
memory/1156-61-0x0000000002394000-0x0000000002397000-memory.dmp

Filesize
12KB

Download
memory/1156-58-0x000007FEEC200000-0x000007FEECC23000-memory.dmp

Filesize
10MB

Download
memory/1156-57-0x000007FEFBD11000-0x000007FEFBD13000-memory.dmp

Filesize
8KB

Download
memory/1156-56-0x0000000000000000-mapping.dmp

Download