Analysis
-
max time kernel
31s -
max time network
10s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
13-02-2023 07:21
General
-
Target
e1614217a227ee00d452c21059af1d4572420cd6079d384ec265e2b1a5192f90.exe
-
Size
41KB
-
MD5
ab4a6ddfc90f2d379d70d0fad747f6e5
-
SHA1
87ac21f928c9f4e3d76cc6ea110b6133defd8507
-
SHA256
e1614217a227ee00d452c21059af1d4572420cd6079d384ec265e2b1a5192f90
-
SHA512
d0512d9629ffe3feee10f8f6bfa5419f97e1da78e7972866f76270326657b5760cc3bb3c594fe4ebbbb22571429f0fe88a007f75991db39136d22ff8dd274815
-
SSDEEP
768:ppoHKflwYtttWtYtYBtYtxqGGGGGGGGHGGGGGGGGGGGGGGGGGGGGGGGGGGGGUu8y:DoHFGGGGGGGGHGGGGGGGGGGGGGGGGGGH
Score
10/10
Malware Config
Extracted
Family
purecrypter
C2
http://163.123.142.210/Zhevuwz.dat
Signatures
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1614217a227ee00d452c21059af1d4572420cd6079d384ec265e2b1a5192f90.exe"C:\Users\Admin\AppData\Local\Temp\e1614217a227ee00d452c21059af1d4572420cd6079d384ec265e2b1a5192f90.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
10.1MB
-
Filesize
11.4MB
-
Filesize
12KB
-
Filesize
3.0MB
-
Filesize
124KB
-
Filesize
12KB
-
Filesize
56KB
-
Filesize
1.1MB
-
Filesize
528KB