Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
31-03-2024 13:03
General
-
Target
5518dd63ae04917f0647f698d49f5c1a_JaffaCakes118.exe
-
Size
32KB
-
MD5
5518dd63ae04917f0647f698d49f5c1a
-
SHA1
fdf1f3970ab95e67765517bb29b8e2dc06bfcc5e
-
SHA256
51b9a732f19371ba83e4d9f920665d7ff402a57782ff43fd447cff2c73c6397d
-
SHA512
297af2b964d802effa7ceda0a16027d3a63da84f581bdc5fa9bc6d668cb0fd5493931287e875f92f4fc8f769ffc68735ee62d3ccfa21882b44bd1947ee65bfe4
-
SSDEEP
384:DaONo4AbpW5tdzMOs4UQWEctJpoI7lZdS6/pCqomSDxr2QmUa3P4keIKDQckRKD9:DaO6/Q5t5rUzEcCUDfqxr294dT90PG+
Score
10/10
Malware Config
Extracted
Family
purecrypter
C2
https://store2.gofile.io/download/8ce405ad-0ec4-4b82-9f2d-8d4ceab524d7/Lotrcnlgrg.dll
Signatures
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5518dd63ae04917f0647f698d49f5c1a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5518dd63ae04917f0647f698d49f5c1a_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 17762⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 4428 -ip 44281⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
7.7MB