Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
21-12-2024 20:12
General
-
Target
JaffaCakes118_102ed724d34c08511400035b9e55c21b17551ca3828e5ff6286aa3c3c636dbb5.exe
-
Size
667.6MB
-
MD5
173e5f48275b964100a5e8f2cd20baef
-
SHA1
fa84c4d6ba97353ec49d66ebff4e12051bb768ba
-
SHA256
102ed724d34c08511400035b9e55c21b17551ca3828e5ff6286aa3c3c636dbb5
-
SHA512
931b0d98c561cd47ddaab58994e1a88c0ed6db2c6ed5f4665c5d065107168a30f05f7edf516ec28ba4ec9e7b88ae2117b4360996546ae64468793f2a66c9b81e
-
SSDEEP
384:3Cr2V9NHy593U2rEGmDG2XxQiii0087viidbiif8tx3mirILECxV8w0FAjWK3miN:3lmtODh00atiYIILZ8w0FVIILZ8w0F1
Score
10/10
Malware Config
Extracted
Family
purecrypter
C2
https://4hmn.short.gy/uviWz6
Signatures
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Purecrypter family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_102ed724d34c08511400035b9e55c21b17551ca3828e5ff6286aa3c3c636dbb5.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_102ed724d34c08511400035b9e55c21b17551ca3828e5ff6286aa3c3c636dbb5.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB