Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
31-03-2024 21:13
General
-
Target
5e4006f91dabad1c5e0ae08e2241775e_JaffaCakes118.exe
-
Size
76KB
-
MD5
5e4006f91dabad1c5e0ae08e2241775e
-
SHA1
73328586aa35340ade37e1b95522eef12e8314ac
-
SHA256
1f3ebec39406d9a1db488ee7720e4d174dda862451540da480b834efd654699e
-
SHA512
139e804381f0a8f0cd03ae056e5c9b298927de9ca04791b190c97130c5c6f2c1038f7029ddecc41d90037e9ad1405af4571a431f567adca676d4c369401e2508
-
SSDEEP
768:aYiJikJFIULFMBc237bobA7ymRd0uxUDTJL6oNsgBvAyox0cD:avFIULFMAAiu6JL6oNsgFAyox0cD
Score
10/10
Malware Config
Extracted
Family
purecrypter
C2
https://store2.gofile.io/download/eb70087b-81a9-4e93-9686-1c2ede8226d9/Xmsulcrmuvqyuqzguomjpi.dll
Signatures
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e4006f91dabad1c5e0ae08e2241775e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5e4006f91dabad1c5e0ae08e2241775e_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 17682⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3828 -ip 38281⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
7.7MB