fdd4dfe60eeae023316a989c59f900f9a155a929cf14fc0ee44c959782502692

Analysis

max time kernel
151s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220812-es
resource tags

arch:x64arch:x86image:win10v2004-20220812-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
02-02-2023 02:24

Target

PureRef-1.11.1_x64.exe
Size

9.4MB
MD5

004410168d99bf360941e310d96de84a
SHA1

3296b90c98989bae39c26e15759356fc39dbee1b
SHA256

fdd4dfe60eeae023316a989c59f900f9a155a929cf14fc0ee44c959782502692
SHA512

cd1fc8b8c56a5cfe48fce9eb1ceabfa831d4bb2a8192631230bb5bf7396f3e378182cb93683f06a1d035b76aa7f0ff794bb2c2b777ac6fef17e98589925d5d59
SSDEEP

196608:4QoJVJpGvIlu9qmMWcvvrVTgDEQK1xzk6KtT4LNHm26tYoStDpXKj+:SDsqmErRKEQK3rKtkLtmhtYBlaS

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
4148	PureRef-1.11.1_x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\PureRef-1.11.1_x64.exe
"C:\Users\Admin\AppData\Local\Temp\PureRef-1.11.1_x64.exe"
1⤵
- Loads dropped DLL
PID:4148

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsfD884.tmp\System.dll

Filesize
12KB

MD5
8cf2ac271d7679b1d68eefc1ae0c5618

SHA1
7cc1caaa747ee16dc894a600a4256f64fa65a9b8

SHA256
6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba

SHA512
ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

Download Submit