Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
31-03-2024 04:05
General
-
Target
4ca7ad65e21778c4ec8fab5129260d32_JaffaCakes118.exe
-
Size
28KB
-
MD5
4ca7ad65e21778c4ec8fab5129260d32
-
SHA1
461ae78946a55078590300798f08bc00e0e10d9d
-
SHA256
073a9a5eaf10598b2ebf99094fc29e04778ee7272319687d04c53f3d903de94c
-
SHA512
31b22762c0fb2d3d6c39bb5bd94c322a7d13cd6c5fd297e79955cd0095cbd4aaf7f4ab208ac304bf3069ce218a733dae6ac85d65cf15995bcbe649ad705820e8
-
SSDEEP
384:AxYcSYE/AbtbbjG2w1/ztG/IbM9noIUEJLzS88I/:A6UEgGmoUL
Score
10/10
Malware Config
Extracted
Family
purecrypter
C2
https://store2.gofile.io/download/fdd80845-961b-46c7-a15d-0aedbdce6384/Gxetichiqsm.dll
Signatures
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ca7ad65e21778c4ec8fab5129260d32_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4ca7ad65e21778c4ec8fab5129260d32_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 18082⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4324 -ip 43241⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
7.7MB