Analysis
-
max time kernel
93s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
31-03-2024 07:59
General
-
Target
5139e24e3fa4d06a143dd7d297a44ee7_JaffaCakes118.exe
-
Size
76KB
-
MD5
5139e24e3fa4d06a143dd7d297a44ee7
-
SHA1
2ee7f89720c68680db7e0b96b30069ed1bed913a
-
SHA256
f5a980b01f25dea8e566dff4cc9750bdd5ea67e76c6d02fe490d7366039c9f92
-
SHA512
89358f28afa42de62c7519d6427d71481a9acafba58e665ea199e0f41fe4fa507028d316070b9317d74005b408f2e965261347755854ec7d1a1607606af445b6
-
SSDEEP
768:1gktFPr7fIULFMBc237bobA7ymRd0uxUDTJL6oNsgBvAyox0cj:1pxr7fIULFMAAiu6JL6oNsgFAyox0cj
Score
10/10
Malware Config
Extracted
Family
purecrypter
C2
https://store2.gofile.io/download/6d09093e-3140-4f91-86bc-50e2ec5aba70/Spxetbpourfw.dll
Signatures
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5139e24e3fa4d06a143dd7d297a44ee7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5139e24e3fa4d06a143dd7d297a44ee7_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 17762⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4464 -ip 44641⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.7MB
-
Filesize
96KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
7.7MB