purecrypter | 17324605be6f982cfcc72159f95280a29ccd42e1c57f8701ecfb9ddd6a8a4b7f

Analysis

max time kernel
117s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-04-2024 23:29

Target

efc321c36f4e1634c063378e4c3b3918_JaffaCakes118.exe
Size

28KB
MD5

efc321c36f4e1634c063378e4c3b3918
SHA1

97761a7e2ffa6fb8948184c2091099c681261a79
SHA256

17324605be6f982cfcc72159f95280a29ccd42e1c57f8701ecfb9ddd6a8a4b7f
SHA512

c2c9086b2d95efab45527cdddad2ebafd5a3c4196a897e0ca111f43c50778d9468d444fe3573e717a3e44eebbd84c5fb1b6d6842f27f505ab5d9192d23ec0c2b
SSDEEP

384:LXhMsjem623pFSVc/j7gVOYU9pspDNRPaw7/VWf+RmUqEiFKzi:LXhMsjem6QLgV+sp5UaTNFi

Score

10^/10

Family

purecrypter

https://redessociaissmm.com/wp-content/documentation/File.png

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2520 2852 WerFault.exe efc321c36f4e1634c063378e4c3b3918_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

efc321c36f4e1634c063378e4c3b3918_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2852 efc321c36f4e1634c063378e4c3b3918_JaffaCakes118.exe

pid	pid_target	process	target process
2520	2852	WerFault.exe	efc321c36f4e1634c063378e4c3b3918_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2852	efc321c36f4e1634c063378e4c3b3918_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

efc321c36f4e1634c063378e4c3b3918_JaffaCakes118.exe

description	pid	process	target process
PID 2852 wrote to memory of 2520	2852	efc321c36f4e1634c063378e4c3b3918_JaffaCakes118.exe	WerFault.exe
PID 2852 wrote to memory of 2520	2852	efc321c36f4e1634c063378e4c3b3918_JaffaCakes118.exe	WerFault.exe
PID 2852 wrote to memory of 2520	2852	efc321c36f4e1634c063378e4c3b3918_JaffaCakes118.exe	WerFault.exe
PID 2852 wrote to memory of 2520	2852	efc321c36f4e1634c063378e4c3b3918_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\efc321c36f4e1634c063378e4c3b3918_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\efc321c36f4e1634c063378e4c3b3918_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 1048
  2⤵
  - Program crash
  PID:2520

memory/2852-0-0x0000000000FF0000-0x0000000000FFC000-memory.dmp

Filesize
48KB

Download
memory/2852-1-0x0000000074B00000-0x00000000751EE000-memory.dmp

Filesize
6.9MB

Download
memory/2852-2-0x0000000004EC0000-0x0000000004F00000-memory.dmp

Filesize
256KB

Download
memory/2852-3-0x0000000074B00000-0x00000000751EE000-memory.dmp

Filesize
6.9MB

Download
memory/2852-4-0x0000000004EC0000-0x0000000004F00000-memory.dmp

Filesize
256KB

Download