Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    162s
  • max time network
    208s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04/02/2023, 22:18

General

  • Target

    dd218eb78e26587e43df5f00ff3ad87e23154c672615309a193a657323b62e20.exe

  • Size

    3.0MB

  • MD5

    cdb75538c7adc7829a93cdf9a27c1fd7

  • SHA1

    2e5ff4e8f2b4b087ccc7f4cb2ad59d4c3617a0c9

  • SHA256

    dd218eb78e26587e43df5f00ff3ad87e23154c672615309a193a657323b62e20

  • SHA512

    f6eab79f9ba0111608ddc3b81b57224e5ccc86f2a4b3f14a11ef627a2d44f6539c061d5bcad7a68f7df0c05bbcb14d0285bfa508085233075452a3a75d1671d4

  • SSDEEP

    98304:k5Sh7zrcGtirr9gIKvvwPDxISVNImdJ3R9/4:WAXrjtirrGIyYTD3R9A

Malware Config

Signatures

  • Detect PureCrypter injector 1 IoCs
  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dd218eb78e26587e43df5f00ff3ad87e23154c672615309a193a657323b62e20.exe
    "C:\Users\Admin\AppData\Local\Temp\dd218eb78e26587e43df5f00ff3ad87e23154c672615309a193a657323b62e20.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAANgA1AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4880

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2976-140-0x000001C67FCCA000-0x000001C67FCCF000-memory.dmp

    Filesize

    20KB

  • memory/2976-138-0x000001C61A060000-0x000001C61A114000-memory.dmp

    Filesize

    720KB

  • memory/2976-118-0x000001C618330000-0x000001C618352000-memory.dmp

    Filesize

    136KB

  • memory/2976-145-0x000001C67FCCA000-0x000001C67FCCF000-memory.dmp

    Filesize

    20KB

  • memory/2976-144-0x000001C61A380000-0x000001C61A3D4000-memory.dmp

    Filesize

    336KB

  • memory/2976-136-0x000001C619650000-0x000001C619726000-memory.dmp

    Filesize

    856KB

  • memory/2976-117-0x000001C618000000-0x000001C6182E6000-memory.dmp

    Filesize

    2.9MB

  • memory/2976-141-0x000001C61A210000-0x000001C61A266000-memory.dmp

    Filesize

    344KB

  • memory/2976-137-0x000001C619960000-0x000001C6199F8000-memory.dmp

    Filesize

    608KB

  • memory/2976-116-0x000001C67D4C0000-0x000001C67D7C6000-memory.dmp

    Filesize

    3.0MB

  • memory/2976-139-0x000001C619730000-0x000001C6197CB000-memory.dmp

    Filesize

    620KB

  • memory/2976-142-0x000001C61A270000-0x000001C61A2C4000-memory.dmp

    Filesize

    336KB

  • memory/2976-143-0x000001C61A330000-0x000001C61A37C000-memory.dmp

    Filesize

    304KB

  • memory/4880-128-0x00000269F9D50000-0x00000269F9DC6000-memory.dmp

    Filesize

    472KB