Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
30-03-2024 09:14
General
-
Target
38e162610466dd251d9b377a60f65c11_JaffaCakes118.exe
-
Size
33KB
-
MD5
38e162610466dd251d9b377a60f65c11
-
SHA1
2a597d5198230eaafe8d842e76776192ba3e6742
-
SHA256
7eb784edddde0eddd7b21c4907916f0109334a4237a9c2eb917caf8eae81480f
-
SHA512
385a3a4d1592539e64a14a096ab50f86925376cca6cd23dce1f88cf636affce84cd16c8716b68889bc10cb514822adc26bc2aec4cd6b6200fbbee611740994bc
-
SSDEEP
384:J5lchOF7FykxU3HNKiK7GsUeYDEBTGvX1Lokc3OwRM+6ew/QxXZR45XHgNd:XScdFjiIIlLzceQRxpS5wNd
Score
10/10
Malware Config
Extracted
Family
purecrypter
C2
https://store2.gofile.io/download/a3cd5cbe-ac92-4ed8-a75c-282d6ded34cd/Gppieq.dll
Signatures
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\38e162610466dd251d9b377a60f65c11_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\38e162610466dd251d9b377a60f65c11_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 17642⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5008 -ip 50081⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
7.7MB