Overview

overview

10

Static

static

1

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    45s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    07-02-2023 06:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    tmp.exe

  • Size

    172KB

  • MD5

    a9fe419d1a7c914e4bcb26ba2d564338

  • SHA1

    287d701de4ece28a6b0245c89b2ea488c6fee16b

  • SHA256

    14d6746a7475a0f8cd26d1d30403688e8d36cdc3f093e159f5882dc614a0cccb

  • SHA512

    5ea544d93d2d19614e006f4b1762cb3e5d886e130c1fe77973cf83f2bac02dd9ea58eea0ac428e08bec65e03f1f37b41da3608f8a817d0a42dab49ee4b9f9cb9

  • SSDEEP

    1536:v+ac9URWzKr7PhuuUpV7+5JTiy95UuUCQahsf5mZIWiwwr7QXsouW2ASDDA6rRcS:v+apWaxa7Dy956S2j4xnsvXtPdSaeW

Score
10/10
purecrypterdownloaderloaderpersistence

Malware Config

Signatures

  • Detect PureCrypter injector 1 IoCs
    loader
  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1668
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      2⤵
        PID:1620
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
        2⤵
          PID:1612
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
          2⤵
            PID:1192
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
            2⤵
              PID:1152
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
              2⤵
                PID:1268
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
                2⤵
                  PID:1428
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
                  2⤵
                    PID:1040
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
                    2⤵
                      PID:964
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
                      2⤵
                        PID:1556
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
                        2⤵
                          PID:1016

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • memory/1668-57-0x000007FEFC2F1000-0x000007FEFC2F3000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/1668-59-0x000007FEEC610000-0x000007FEED033000-memory.dmp

                        Filesize

                        10.1MB

                        Download

                      • memory/1668-60-0x000007FEEBAB0000-0x000007FEEC60D000-memory.dmp

                        Filesize

                        11.4MB

                        Download

                      • memory/1668-61-0x0000000001F94000-0x0000000001F97000-memory.dmp

                        Filesize

                        12KB

                        Download

                      • memory/1668-62-0x0000000001F9B000-0x0000000001FBA000-memory.dmp

                        Filesize

                        124KB

                        Download

                      • memory/1668-63-0x0000000001F9B000-0x0000000001FBA000-memory.dmp

                        Filesize

                        124KB

                        Download

                      • memory/2024-54-0x000000013FF40000-0x000000013FF6E000-memory.dmp

                        Filesize

                        184KB

                        Download

                      • memory/2024-55-0x000000001FAB0000-0x000000001FD9A000-memory.dmp

                        Filesize

                        2.9MB

                        Download

                      • memory/2024-58-0x000000001AC37000-0x000000001AC56000-memory.dmp

                        Filesize

                        124KB

                        Download

                      • memory/2024-64-0x000000001C310000-0x000000001C3CC000-memory.dmp

                        Filesize

                        752KB

                        Download

                      • memory/2024-65-0x000000001AC37000-0x000000001AC56000-memory.dmp

                        Filesize

                        124KB

                        Download