Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
01/04/2024, 03:28
General
- Target 666f900d4bea7aed217c97cc75f756e4_JaffaCakes118.exe
- Size 76KB
- Sample240401-d1gntscg64
- SHA256 467d311a5b7aca52e3d2a2399928ae1ff2d20b26a5f131499a6dd3a7b28880a6
Score
10/10
Malware Config
Extracted
Family
-
purecrypter
C2
-
https://store2.gofile.io/download/8f4b715b-b774-4bce-b2ed-2b0e811119e8/Wsyytcpdwievapelubhdra.dll
Signatures
- PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
- Program crash 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\666f900d4bea7aed217c97cc75f756e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\666f900d4bea7aed217c97cc75f756e4_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 17762⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 856 -ip 8561⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/856-0-0x0000000000FD0000-0x0000000000FE8000-memory.dmp
memory/856-1-0x0000000074960000-0x0000000075110000-memory.dmp
memory/856-2-0x0000000005B70000-0x0000000005B80000-memory.dmp
memory/856-3-0x0000000074960000-0x0000000075110000-memory.dmp
memory/856-4-0x0000000074960000-0x0000000075110000-memory.dmp