Analysis
- max time kernel
138s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
17/09/2024, 10:38
General
- Target e6a304a190393045871a1144609dc414_JaffaCakes118.exe
- Size 12KB
- Sample240917-mplcbaycma
- SHA256 6ad6f24871ddeedb5dd1fd49abec8faae3a0809b3211c7ecce5fbce40dd28a75
Score
10/10
Malware Config
Extracted
Family
-
purecrypter
C2
-
https://store2.gofile.io/download/15a5b26e-809f-49c3-aa8f-3c0a207e9711/Fsyymzlzzxciphnzblhopzku.dll
Signatures
- PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6a304a190393045871a1144609dc414_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e6a304a190393045871a1144609dc414_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 17842⤵
- Program crash
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4616,i,15336851255456239337,16379811035920490645,262144 --variations-seed-version --mojo-platform-channel-handle=1008 /prefetch:81⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3968 -ip 39681⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3968-0-0x000000007494E000-0x000000007494F000-memory.dmp
memory/3968-1-0x0000000000230000-0x0000000000238000-memory.dmp
memory/3968-2-0x0000000074940000-0x00000000750F0000-memory.dmp
memory/3968-3-0x000000007494E000-0x000000007494F000-memory.dmp
memory/3968-4-0x0000000074940000-0x00000000750F0000-memory.dmp
memory/3968-5-0x0000000074940000-0x00000000750F0000-memory.dmp