privateloader | 184fecb312eaf2126f45867b2a6975769ab0b0af44abea6d2fa91fb48607072f

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_184fecb312eaf2126f45867b2a6975769ab0b0af44abea6d2fa91fb48607072f.exe
Size

699.0MB
MD5

85053ea117b5f3e6b195abf8073d7f62
SHA1

e4289435a70f4f8f75e2f5ebd6a9d012cbac8c88
SHA256

184fecb312eaf2126f45867b2a6975769ab0b0af44abea6d2fa91fb48607072f
SHA512

6615cf2e3dbe265a0d1c3afdb56354145a987b93a051c68a83caea9eaf8e2364bf03b3fb768f35d0953d07f1cabfc06e674610a0b0e149c6e9beccf772c5ec83
SSDEEP

98304:nxh4vGomjs9hJ+dvvGwWyO+P5IdFfzO0lCV37+tjBqc0DND8hawxmbxdej:wsjs0dvNdO+xoFf/43ytgDNwh9xoej

Score

10^/10

privateloader loader

Malware Config

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Privateloader family
privateloader

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	JaffaCakes118_184fecb312eaf2126f45867b2a6975769ab0b0af44abea6d2fa91fb48607072f.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	JaffaCakes118_184fecb312eaf2126f45867b2a6975769ab0b0af44abea6d2fa91fb48607072f.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	JaffaCakes118_184fecb312eaf2126f45867b2a6975769ab0b0af44abea6d2fa91fb48607072f.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	JaffaCakes118_184fecb312eaf2126f45867b2a6975769ab0b0af44abea6d2fa91fb48607072f.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1420	JaffaCakes118_184fecb312eaf2126f45867b2a6975769ab0b0af44abea6d2fa91fb48607072f.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 2860	1420	JaffaCakes118_184fecb312eaf2126f45867b2a6975769ab0b0af44abea6d2fa91fb48607072f.exe	30
PID 1420 wrote to memory of 2860	1420	JaffaCakes118_184fecb312eaf2126f45867b2a6975769ab0b0af44abea6d2fa91fb48607072f.exe	30
PID 1420 wrote to memory of 2860	1420	JaffaCakes118_184fecb312eaf2126f45867b2a6975769ab0b0af44abea6d2fa91fb48607072f.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_184fecb312eaf2126f45867b2a6975769ab0b0af44abea6d2fa91fb48607072f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_184fecb312eaf2126f45867b2a6975769ab0b0af44abea6d2fa91fb48607072f.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1420 -s 216
  2⤵
  PID:2860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1420-9-0x0000000077C10000-0x0000000077C12000-memory.dmp

Filesize
8KB

Download
memory/1420-10-0x000000013FD02000-0x000000014003A000-memory.dmp

Filesize
3.2MB

Download
memory/1420-7-0x0000000077C10000-0x0000000077C12000-memory.dmp

Filesize
8KB

Download
memory/1420-5-0x0000000077C10000-0x0000000077C12000-memory.dmp

Filesize
8KB

Download
memory/1420-4-0x0000000077C00000-0x0000000077C02000-memory.dmp

Filesize
8KB

Download
memory/1420-2-0x0000000077C00000-0x0000000077C02000-memory.dmp

Filesize
8KB

Download
memory/1420-0-0x0000000077C00000-0x0000000077C02000-memory.dmp

Filesize
8KB

Download
memory/1420-11-0x0000000077C20000-0x0000000077C22000-memory.dmp

Filesize
8KB

Download
memory/1420-13-0x0000000077C20000-0x0000000077C22000-memory.dmp

Filesize
8KB

Download
memory/1420-15-0x0000000077C20000-0x0000000077C22000-memory.dmp

Filesize
8KB

Download
memory/1420-20-0x0000000077C30000-0x0000000077C32000-memory.dmp

Filesize
8KB

Download
memory/1420-18-0x0000000077C30000-0x0000000077C32000-memory.dmp

Filesize
8KB

Download
memory/1420-16-0x0000000077C30000-0x0000000077C32000-memory.dmp

Filesize
8KB

Download
memory/1420-23-0x000007FEFD9B0000-0x000007FEFD9B2000-memory.dmp

Filesize
8KB

Download
memory/1420-25-0x000007FEFD9B0000-0x000007FEFD9B2000-memory.dmp

Filesize
8KB

Download
memory/1420-30-0x000007FEFD9C0000-0x000007FEFD9C2000-memory.dmp

Filesize
8KB

Download
memory/1420-28-0x000007FEFD9C0000-0x000007FEFD9C2000-memory.dmp

Filesize
8KB

Download
memory/1420-31-0x000000013F9A0000-0x000000014060E000-memory.dmp

Filesize
12.4MB

Download
memory/1420-42-0x000000013FD02000-0x000000014003A000-memory.dmp

Filesize
3.2MB

Download