Analysis
-
max time kernel
43s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-02-2023 19:19
Static task
static1
Behavioral task
behavioral1
Sample
SMGS.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
SMGS.exe
Resource
win10v2004-20220812-en
General
-
Target
SMGS.exe
-
Size
4.8MB
-
MD5
973d6bb15efd90c87c861bb50682b4e0
-
SHA1
6be806023c19d7b332118bdc60ec2cabf4afd7a7
-
SHA256
464bf35525b6f482b91e5a1ba287c58304e7c41558c8070e42bdaa19769b5b05
-
SHA512
02355d9053c02c7470cdf6bde0a7d30ddf8a15a98c70dedf67a44639db3f92f1f961cb887e262b91eaeaeeef406e83c1294c690165afe2d7b50bae2e13896237
-
SSDEEP
24576:VBgHFLM9d5M7WbzMdMp+5R6hIONsEQ/xWxPNnb1T/d+BIPFsKmQhhEG6veOSV1jF:
Malware Config
Signatures
-
Detect PureCrypter injector 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1952-55-0x0000000006180000-0x00000000063E6000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
SMGS.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Zzycvoloo = "\"C:\\Users\\Admin\\AppData\\Roaming\\Nqtsofal\\Zzycvoloo.exe\"" SMGS.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
powershell.exeSMGS.exepid process 828 powershell.exe 1952 SMGS.exe 1952 SMGS.exe 1952 SMGS.exe 1952 SMGS.exe 1952 SMGS.exe 1952 SMGS.exe 1952 SMGS.exe 1952 SMGS.exe 1952 SMGS.exe 1952 SMGS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SMGS.exepowershell.exedescription pid process Token: SeDebugPrivilege 1952 SMGS.exe Token: SeDebugPrivilege 828 powershell.exe -
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
SMGS.exedescription pid process target process PID 1952 wrote to memory of 828 1952 SMGS.exe powershell.exe PID 1952 wrote to memory of 828 1952 SMGS.exe powershell.exe PID 1952 wrote to memory of 828 1952 SMGS.exe powershell.exe PID 1952 wrote to memory of 828 1952 SMGS.exe powershell.exe PID 1952 wrote to memory of 1700 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 1700 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 1700 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 1700 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 1176 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 1176 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 1176 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 1176 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 1144 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 1144 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 1144 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 1144 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 564 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 564 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 564 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 564 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 888 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 888 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 888 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 888 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 1084 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 1084 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 1084 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 1084 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 1436 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 1436 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 1436 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 1436 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 908 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 908 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 908 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 908 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 892 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 892 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 892 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 892 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 336 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 336 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 336 1952 SMGS.exe SMGS.exe PID 1952 wrote to memory of 336 1952 SMGS.exe SMGS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SMGS.exe"C:\Users\Admin\AppData\Local\Temp\SMGS.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\SMGS.exeC:\Users\Admin\AppData\Local\Temp\SMGS.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\SMGS.exeC:\Users\Admin\AppData\Local\Temp\SMGS.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\SMGS.exeC:\Users\Admin\AppData\Local\Temp\SMGS.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\SMGS.exeC:\Users\Admin\AppData\Local\Temp\SMGS.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\SMGS.exeC:\Users\Admin\AppData\Local\Temp\SMGS.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\SMGS.exeC:\Users\Admin\AppData\Local\Temp\SMGS.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\SMGS.exeC:\Users\Admin\AppData\Local\Temp\SMGS.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\SMGS.exeC:\Users\Admin\AppData\Local\Temp\SMGS.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\SMGS.exeC:\Users\Admin\AppData\Local\Temp\SMGS.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\SMGS.exeC:\Users\Admin\AppData\Local\Temp\SMGS.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/828-56-0x0000000000000000-mapping.dmp
-
memory/828-57-0x0000000075E31000-0x0000000075E33000-memory.dmpFilesize
8KB
-
memory/828-58-0x000000006FCC0000-0x000000007026B000-memory.dmpFilesize
5.7MB
-
memory/828-59-0x000000006FCC0000-0x000000007026B000-memory.dmpFilesize
5.7MB
-
memory/828-60-0x000000006FCC0000-0x000000007026B000-memory.dmpFilesize
5.7MB
-
memory/1952-54-0x00000000000B0000-0x0000000000578000-memory.dmpFilesize
4.8MB
-
memory/1952-55-0x0000000006180000-0x00000000063E6000-memory.dmpFilesize
2.4MB
-
memory/1952-61-0x0000000004F40000-0x0000000004F8A000-memory.dmpFilesize
296KB