purecrypter | 921f2ab9efbdf8b31267044ad0090666510f22d740d55aeeef27262c89e7a5e3 | Triage

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2024 14:37

Sharing

Report Analysis Logs

General

Target

d68a36052fbc5c3295928486743027a5_JaffaCakes118.exe
Size

72KB
MD5

d68a36052fbc5c3295928486743027a5
SHA1

866dc0edd0185a780c631921b577e144208befe3
SHA256

921f2ab9efbdf8b31267044ad0090666510f22d740d55aeeef27262c89e7a5e3
SHA512

8b5d61662879c4b8deef428b4c3a37f9f8e3b2a834ce41af49f3763c418b0e292ad4e3cb56ae6d78ebce90d12ce5194e33b2aa98b86ca10dcd1658ba43364247
SSDEEP

1536:0K58xMrMJn7HJ0cYeWQzPhOvVihneW9+m:0K00wz5OdRSF

Score

10^/10

purecrypter downloader loader

Malware Config

Extracted

Family

purecrypter

C2

https://store2.gofile.io/download/efc616fd-ee67-4ff3-92ba-07dcf35cdf04/Bqpahwgsee.dll

Signatures

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Program crash 1 IoCs

pid	pid_target	Process	procid_target
748	3084	WerFault.exe	85

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3084	d68a36052fbc5c3295928486743027a5_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d68a36052fbc5c3295928486743027a5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d68a36052fbc5c3295928486743027a5_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 1804
  2⤵
  - Program crash
  PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 3084 -ip 3084
1⤵
PID:2928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3084-0-0x0000000000600000-0x0000000000618000-memory.dmp

Filesize
96KB

Download
memory/3084-1-0x0000000075350000-0x0000000075B00000-memory.dmp

Filesize
7.7MB

Download
memory/3084-2-0x0000000005230000-0x0000000005240000-memory.dmp

Filesize
64KB

Download
memory/3084-3-0x0000000075350000-0x0000000075B00000-memory.dmp

Filesize
7.7MB

Download