Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
14-04-2024 23:29
General
-
Target
efc321c36f4e1634c063378e4c3b3918_JaffaCakes118.exe
-
Size
28KB
-
MD5
efc321c36f4e1634c063378e4c3b3918
-
SHA1
97761a7e2ffa6fb8948184c2091099c681261a79
-
SHA256
17324605be6f982cfcc72159f95280a29ccd42e1c57f8701ecfb9ddd6a8a4b7f
-
SHA512
c2c9086b2d95efab45527cdddad2ebafd5a3c4196a897e0ca111f43c50778d9468d444fe3573e717a3e44eebbd84c5fb1b6d6842f27f505ab5d9192d23ec0c2b
-
SSDEEP
384:LXhMsjem623pFSVc/j7gVOYU9pspDNRPaw7/VWf+RmUqEiFKzi:LXhMsjem6QLgV+sp5UaTNFi
Score
10/10
Malware Config
Extracted
Family
purecrypter
C2
https://redessociaissmm.com/wp-content/documentation/File.png
Signatures
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\efc321c36f4e1634c063378e4c3b3918_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\efc321c36f4e1634c063378e4c3b3918_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 14522⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1812 -ip 18121⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.7MB
-
Filesize
48KB
-
Filesize
64KB
-
Filesize
7.7MB