Analysis
- max time kernel
139s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
16/08/2024, 08:05
General
- Target 9d92eac2b25165ab5f82ca4118ae6a9f_JaffaCakes118.exe
- Size 18KB
- Sample240816-jy5krsteqa
- SHA256 e9d7e3b14fe2fa512bd8e7d1c9e444cd6293e454677c14d8dceb4958fa24a13e
Score
10/10
Malware Config
Extracted
Family
-
purecrypter
C2
-
https://store2.gofile.io/download/50a4adeb-19a4-4365-b358-92edbd1c702c/Pajoibg.dll
Signatures
- PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d92eac2b25165ab5f82ca4118ae6a9f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9d92eac2b25165ab5f82ca4118ae6a9f_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 17762⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 804 -ip 8041⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/804-0-0x0000000074EEE000-0x0000000074EEF000-memory.dmp
memory/804-1-0x0000000000250000-0x000000000025A000-memory.dmp
memory/804-2-0x0000000074EE0000-0x0000000075690000-memory.dmp
memory/804-3-0x0000000074EEE000-0x0000000074EEF000-memory.dmp
memory/804-4-0x0000000074EE0000-0x0000000075690000-memory.dmp
memory/804-5-0x0000000074EE0000-0x0000000075690000-memory.dmp