Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
14-07-2024 22:53
General
-
Target
472133e13a9b510ccd555a4ea86e482c_JaffaCakes118.exe
-
Size
9KB
-
MD5
472133e13a9b510ccd555a4ea86e482c
-
SHA1
2b7ec60ea548c8cdb013db202922d19a652e6371
-
SHA256
49f684229ae0a07d377b454d605f238e386517c3e734f9a923ef069b8d9e0c23
-
SHA512
7a0470fad5710b5a7bd417232dfb5bf48d4d4762d4e35d1872591971e2e85ac0310329611bee488ed6224cfda9d5f9b993f300f68157be950c9d8e8d0bf4afde
-
SSDEEP
192:i9VOPth6XEVQIWZGKBGjAEsssssskBiZWkFWN:eOPtIXEVQIWZ7dd8WkFW
Score
10/10
Malware Config
Extracted
Family
purecrypter
C2
https://store2.gofile.io/download/25bc99c8-d5d3-411e-a455-7a7ada55c81d/Uznplbwysqwjwkkocjyge.dll
Signatures
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\472133e13a9b510ccd555a4ea86e482c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\472133e13a9b510ccd555a4ea86e482c_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 17762⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1924 -ip 19241⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
7.7MB