Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2023, 14:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230220-en
3 signatures
150 seconds
General
-
Target
tmp.exe
-
Size
1.2MB
-
MD5
cd7ee7a99ca42119744b7412d0488fa9
-
SHA1
734f91a23a1589d19deb6910607145f158f8f478
-
SHA256
ad322d1fada253d07e90d48b5c9e7ed6a0fcd12bcc2648df015464da59e66ef0
-
SHA512
cd8c855b492e85390a567057923c56b7a8f2983cc636bd1e43b37e31b5997fc454d28a1def4229dea64dc10a46db343971dc3628ef1ad92dedec8c0821fce72c
-
SSDEEP
24576:egG1BJHjCU9WxVR364yaBb5HlS4ZJZduLUxOdzUqeO1Gh2d36GMJ:dG1v9oX1dyc7JZdu2OaedBM
Score
10/10
Malware Config
Signatures
-
Detect PureCrypter injector 33 IoCs
resource yara_rule behavioral2/memory/3336-134-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-135-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-137-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-139-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-142-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-144-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-146-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-148-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-150-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-152-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-154-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-156-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-158-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-160-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-162-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-164-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-166-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-168-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-170-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-172-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-174-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-176-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-178-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-180-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-182-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-184-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-186-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-188-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-190-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-192-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-194-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-196-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter behavioral2/memory/3336-198-0x0000000004E30000-0x000000000509A000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3336 tmp.exe