purecrypter | a2be24512daa156d5c3cd4726819d6cb085e77a1d8f3a6b2c6bfc26221f8853c

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2024 10:40

Target

8a5336e1f45a85b04b3b8930a714a7b0_JaffaCakes118.exe
Size

84KB
MD5

8a5336e1f45a85b04b3b8930a714a7b0
SHA1

2bac2e1ddfebabfe1e8f15301434b47be53063c9
SHA256

a2be24512daa156d5c3cd4726819d6cb085e77a1d8f3a6b2c6bfc26221f8853c
SHA512

5f6a66e86b094b4e136fe195104620c18c406ff5eef7d12d0c1d041145d0b65ab5e76a99406c935f5bc8ca91df0706a777d5d701cbdf6a57369fd88382c7a2f7
SSDEEP

1536:XHJILdpECz3IULFMAAiu6JL6oNsgFAyox0cH:XHJAdpJz3IULY6JL6oNsYu

Score

10^/10

Family

purecrypter

https://store2.gofile.io/download/f9bf4a66-3371-4133-8e18-24107236761e/Ruqkwagyqbeobzsmhd.dll

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4992	2284	WerFault.exe	93

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2284	8a5336e1f45a85b04b3b8930a714a7b0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8a5336e1f45a85b04b3b8930a714a7b0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8a5336e1f45a85b04b3b8930a714a7b0_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2284
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 1768
  2⤵
  - Program crash
  PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2284 -ip 2284
1⤵
PID:3056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1684 --field-trial-handle=2284,i,13100272738549420251,6151825632958897606,262144 --variations-seed-version /prefetch:8
1⤵
PID:3864

memory/2284-0-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/2284-1-0x0000000000A60000-0x0000000000A7A000-memory.dmp

Filesize
104KB

Download
memory/2284-2-0x00000000055E0000-0x00000000055F0000-memory.dmp

Filesize
64KB

Download
memory/2284-3-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/2284-4-0x00000000055E0000-0x00000000055F0000-memory.dmp

Filesize
64KB

Download
memory/2284-5-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download