Extracted

Extracted

Extracted

• • Target

    ID-191304203986.docm

  • Size

    44KB

  • MD5

    8c498f9e6dd65c5a9704208922224661

  • SHA1

    1dc2f872c2e23e1eb0c6090909c5807553ad1e75

  • SHA256

    38f581881093c044667d565a698aa389f14585a58d5c8b692dc2be851293f1c2

  • SHA512

    b6a5eceef6739421ed2f0f6a479df496ecb1894b7694651b24a50689d663b1d7f1b1bf58c2edacf6a2fa59908a58f25cd00e389765871cb1856acb3431bcca50

  • SSDEEP

    768:T6D/hwDg0kIo+rQGtBMIYta9l87miNPZjinjUeipoRkqk:T6D/u801rQIBMNg86AB+njUpoqqk

  Score

  10^/10

  purplefoxdiscoveryevasionrootkittrojan

  • Detect PurpleFox MSI

    Detect PurpleFox MSI.

    rootkit

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox

  • Blocklisted process makes network request

  • Stops running service(s)

    evasion

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2