a65d7954886db0d06e6cc4f1ce0cfce3792fef8e33e749c0836e5da163d518bc

Analysis

max time kernel
145s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PureWind.exe
Size

450KB
MD5

3994a103924fedb63c154557879c5f67
SHA1

fc029fa96c267f6c3830a80f357671a73b44138d
SHA256

6e9cba8c9d1fc6916444dcfbfbdca8439d85790c3e2fb8cfcc54c54b969d9073
SHA512

59cf6a3c18af23d92720fa0103cb38a757628761fcf8a783619a477cca183fcb99a6668d67332f527a2d04c7d716a40440f89e73b5269af90f8d04d4a80f711a
SSDEEP

12288:rB69jlHPdUzi8Rb1WdeMJzZ7KYuShPckIp3I4FdEV:AVPedghF7KrG0TFI4FdM

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2672	PureWind.exe
2460	dw20.exe

Loads dropped DLL 2 IoCs

pid	Process
2076	PureWind.exe
2672	PureWind.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PureWind.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PureWind.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: 33	2076	PureWind.exe
Token: SeIncBasePriorityPrivilege	2076	PureWind.exe
Token: 33	2076	PureWind.exe
Token: SeIncBasePriorityPrivilege	2076	PureWind.exe
Token: 33	2672	PureWind.exe
Token: SeIncBasePriorityPrivilege	2672	PureWind.exe
Token: 33	2672	PureWind.exe
Token: SeIncBasePriorityPrivilege	2672	PureWind.exe
Token: 33	2672	PureWind.exe
Token: SeIncBasePriorityPrivilege	2672	PureWind.exe
Token: 33	2672	PureWind.exe
Token: SeIncBasePriorityPrivilege	2672	PureWind.exe
Token: 33	2460	dw20.exe
Token: SeIncBasePriorityPrivilege	2460	dw20.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2672	PureWind.exe
2672	PureWind.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2672	2076	PureWind.exe	30
PID 2076 wrote to memory of 2672	2076	PureWind.exe	30
PID 2076 wrote to memory of 2672	2076	PureWind.exe	30
PID 2076 wrote to memory of 2672	2076	PureWind.exe	30
PID 2672 wrote to memory of 2460	2672	PureWind.exe	32
PID 2672 wrote to memory of 2460	2672	PureWind.exe	32
PID 2672 wrote to memory of 2460	2672	PureWind.exe	32
PID 2672 wrote to memory of 2460	2672	PureWind.exe	32

C:\Users\Admin\AppData\Local\Temp\PureWind.exe
"C:\Users\Admin\AppData\Local\Temp\PureWind.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2076
- \DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Xenocode\Sandbox\PureWind 清风小说浏览器\2.0.09.1029\2009.10.28T05.28\Virtual\STUBEXE\7.1.343\@APPDATALOCAL@\Temp\PureWind.exe
  "C:\Users\Admin\AppData\Local\Temp\PureWind.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2672
- - \DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Xenocode\Sandbox\PureWind 清风小说浏览器\2.0.09.1029\2009.10.28T05.28\Native\STUBEXE\7.1.343\@WINDIR@\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 1416
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Xenocode\Sandbox\PureWind 清风小说浏览器\2.0.09.1029\2009.10.28T05.28\Native\STUBEXE\7.1.343\@WINDIR@\Microsoft.NET\Framework\v2.0.50727\dw20.exe

Filesize
17KB

MD5
cc916bb53ad5f0f5e044bf650cde5994

SHA1
a2e92e9f6c105b17a24ab23464ed0bdb6234a324

SHA256
c29b37a047b565ed5a8145d8fac578ce3eaeea2106dda7346dfaecf1188fb6c9

SHA512
cab3e2642cbb50e8163a36e4c6511d4cc825b38558b81f1a329c60d4ea2e43ce08ae1ed0202706feaa62127ebe6206f82a47347bde56fdbd1719178b5ca8f8f4

Download Submit
\Users\Admin\AppData\Local\Xenocode\Sandbox\PureWind 清风小说浏览器\2.0.09.1029\2009.10.28T05.28\Virtual\STUBEXE\7.1.343\@APPDATALOCAL@\Temp\PureWind.exe

Filesize
17KB

MD5
512508fcf8fb9ce6fd3e49bfe553e9d3

SHA1
0704979d5e5ad75aa271178d9e594511f413fae1

SHA256
56d73eaf88474ba28d872e9bd7252d84f8982713063eb022618d1d8b2111baf4

SHA512
c5cf416b7d7352681850eb3161dd6e573255e60173f990e9e47afdb45c98a3576d8111e6055eada6d9d14c0c90df8e12be31b2607fec958e48985b4eea840cd4

Download Submit
memory/2076-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2076-1-0x00000000776C0000-0x00000000776C1000-memory.dmp

Filesize
4KB

Download
memory/2076-3-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download
memory/2076-4-0x00000000002F0000-0x000000000035E000-memory.dmp

Filesize
440KB

Download
memory/2076-5-0x00000000002F0000-0x000000000035E000-memory.dmp

Filesize
440KB

Download
memory/2076-8-0x00000000002F0000-0x000000000035E000-memory.dmp

Filesize
440KB

Download
memory/2076-22-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2076-0-0x00000000002F0000-0x000000000035E000-memory.dmp

Filesize
440KB

Download
memory/2460-19-0x00000000003C0000-0x000000000042E000-memory.dmp

Filesize
440KB

Download
memory/2460-20-0x00000000003C0000-0x000000000042E000-memory.dmp

Filesize
440KB

Download
memory/2460-25-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download
memory/2672-13-0x00000000002E0000-0x000000000034E000-memory.dmp

Filesize
440KB

Download
memory/2672-14-0x00000000002E0000-0x000000000034E000-memory.dmp

Filesize
440KB

Download
memory/2672-15-0x00000000002E0000-0x000000000034E000-memory.dmp

Filesize
440KB

Download
memory/2672-12-0x00000000002E0000-0x000000000034E000-memory.dmp

Filesize
440KB

Download
memory/2672-11-0x00000000002E0000-0x000000000034E000-memory.dmp

Filesize
440KB

Download
memory/2672-9-0x00000000002E0000-0x000000000034E000-memory.dmp

Filesize
440KB

Download
memory/2672-23-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2672-24-0x00000000002E0000-0x000000000034E000-memory.dmp

Filesize
440KB

Download