Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    13-07-2024 12:50

General

  • Target

    41bca0b1de92c162838eb324d047563b_JaffaCakes118.exe

  • Size

    74KB

  • MD5

    41bca0b1de92c162838eb324d047563b

  • SHA1

    142ca54bef72fcedbd0bea81054966feeb912576

  • SHA256

    2eacf1b6a5a9477bb5a968bec79f11adecacd0b9a9cce83d7fd3c93adf4e3069

  • SHA512

    bd8aa76b612064dd25c44372011db14d5705811cabf2c6c725a05b4ca142d5e4f20f6d0a43e47dd994d8852b066035e5b98acad287ee6d448273fa5a8a857399

  • SSDEEP

    1536:x0/5u5fejAeXpmFM0pJAvckOXw72AtY4fAcK:C/cfpesFM02BY4fs

Malware Config

Extracted

Family

purecrypter

C2

https://store2.gofile.io/download/56e43684-e752-4269-bee5-fa1605761a88/Avquon.dll

Signatures

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

  • Program crash 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\41bca0b1de92c162838eb324d047563b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\41bca0b1de92c162838eb324d047563b_JaffaCakes118.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3016
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 1532
      2⤵
      • Program crash
      PID:2764

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3016-0-0x000000007469E000-0x000000007469F000-memory.dmp

    Filesize

    4KB

  • memory/3016-1-0x0000000000CB0000-0x0000000000CC8000-memory.dmp

    Filesize

    96KB

  • memory/3016-2-0x0000000074690000-0x0000000074D7E000-memory.dmp

    Filesize

    6.9MB

  • memory/3016-3-0x000000007469E000-0x000000007469F000-memory.dmp

    Filesize

    4KB

  • memory/3016-4-0x0000000074690000-0x0000000074D7E000-memory.dmp

    Filesize

    6.9MB