Analysis
- max time kernel
133s - max time network
177s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
18/02/2023, 21:58
General
- Target Hogwarts Legacy by Empress.zip
- Size 33.3MB
- Sample230218-1vnlhsda3x
- SHA256 14bd04d358baa93e39f94953f4a5db0c9f3318081f75e1a8dfa287cb60774fa4
Malware Config
Extracted
-
purecrypter
-
http://comicmaster.org.uk/img/css/design/fabric/bo/Kvxut.dat
Signatures
- PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
- Executes dropped EXE 5 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Hogwarts Legacy by Empress.zip"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\Hogwarts Legacy by Empress\" -spe -an -ai#7zMap4814:132:7zEvent292231⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\Hogwarts Legacy by Empress\Hogwarts Legacy by Empress.exe"C:\Users\Admin\AppData\Local\Temp\Hogwarts Legacy by Empress\Hogwarts Legacy by Empress.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setupov16.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setupov16.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Hogwarts Legacy by Empress\Hogwarts Legacy by Empress.exe"C:\Users\Admin\AppData\Local\Temp\Hogwarts Legacy by Empress\Hogwarts Legacy by Empress.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\setupov16.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\setupov16.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Hogwarts Legacy by Empress\Hogwarts Legacy by Empress.exe"C:\Users\Admin\AppData\Local\Temp\Hogwarts Legacy by Empress\Hogwarts Legacy by Empress.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\setupov16.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\setupov16.exe2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
Hogwarts Legacy by Empress.exe
Hogwarts Legacy by Empress.exe
Hogwarts Legacy by Empress.exe
Hogwarts Legacy by Empress.exe
setupov16.exe
setupov16.exe
setupov16.exe
setupov16.exe
setupov16.exe
setupov16.exe
memory/4364-148-0x0000000005FE0000-0x0000000006046000-memory.dmp
memory/4364-149-0x00000000060C0000-0x0000000006126000-memory.dmp
memory/4364-153-0x00000000066E0000-0x00000000066FE000-memory.dmp
memory/4364-155-0x0000000007D40000-0x00000000083BA000-memory.dmp
memory/4364-156-0x0000000006BE0000-0x0000000006BFA000-memory.dmp
memory/4488-146-0x00000000028F0000-0x0000000002926000-memory.dmp
memory/4488-147-0x0000000004FF0000-0x0000000005618000-memory.dmp
memory/4852-143-0x0000000006340000-0x0000000006362000-memory.dmp
memory/4852-139-0x00000000006C0000-0x00000000006C8000-memory.dmp