privateloader | 3f8c1bcecaa764e01dbac9f6042f1ac137045c663892bdc13e3e061a4da8f0b6

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 00:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_3f8c1bcecaa764e01dbac9f6042f1ac137045c663892bdc13e3e061a4da8f0b6.exe
Size

693.0MB
MD5

a0b4ce51c6a56b281cd6671897c7e75b
SHA1

7c42dd02e5cc7ab3fbd43b7972369a1d6efd4b88
SHA256

3f8c1bcecaa764e01dbac9f6042f1ac137045c663892bdc13e3e061a4da8f0b6
SHA512

a2ac6723efb6f581fa1000850e3c5337a0b6b1268d6556fbc4e45b904a726d5ae4d9da8b67100d6f8116f69f3da84ffe49e486c4983710a5e9718aac1c7ced15
SSDEEP

98304:fqDIinDs0nSAz3z1DMzazEdFYtV57cxNGatD4nAXrA9smv2Ekh9:fliwSrBYztdFYZc54UXmuEM

Score

10^/10

privateloader loader

Malware Config

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Privateloader family
privateloader

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	JaffaCakes118_3f8c1bcecaa764e01dbac9f6042f1ac137045c663892bdc13e3e061a4da8f0b6.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	JaffaCakes118_3f8c1bcecaa764e01dbac9f6042f1ac137045c663892bdc13e3e061a4da8f0b6.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	JaffaCakes118_3f8c1bcecaa764e01dbac9f6042f1ac137045c663892bdc13e3e061a4da8f0b6.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	JaffaCakes118_3f8c1bcecaa764e01dbac9f6042f1ac137045c663892bdc13e3e061a4da8f0b6.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2072	JaffaCakes118_3f8c1bcecaa764e01dbac9f6042f1ac137045c663892bdc13e3e061a4da8f0b6.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2184	2072	JaffaCakes118_3f8c1bcecaa764e01dbac9f6042f1ac137045c663892bdc13e3e061a4da8f0b6.exe	30
PID 2072 wrote to memory of 2184	2072	JaffaCakes118_3f8c1bcecaa764e01dbac9f6042f1ac137045c663892bdc13e3e061a4da8f0b6.exe	30
PID 2072 wrote to memory of 2184	2072	JaffaCakes118_3f8c1bcecaa764e01dbac9f6042f1ac137045c663892bdc13e3e061a4da8f0b6.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3f8c1bcecaa764e01dbac9f6042f1ac137045c663892bdc13e3e061a4da8f0b6.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3f8c1bcecaa764e01dbac9f6042f1ac137045c663892bdc13e3e061a4da8f0b6.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2072 -s 492
  2⤵
  PID:2184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\GroupPolicy\gpt.ini

Filesize
127B

MD5
8ef9853d1881c5fe4d681bfb31282a01

SHA1
a05609065520e4b4e553784c566430ad9736f19f

SHA256
9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

SHA512
5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

Download Submit
memory/2072-18-0x0000000077830000-0x0000000077832000-memory.dmp

Filesize
8KB

Download
memory/2072-42-0x0000000140008000-0x000000014030B000-memory.dmp

Filesize
3.0MB

Download
memory/2072-15-0x0000000077820000-0x0000000077822000-memory.dmp

Filesize
8KB

Download
memory/2072-4-0x0000000077800000-0x0000000077802000-memory.dmp

Filesize
8KB

Download
memory/2072-2-0x0000000077800000-0x0000000077802000-memory.dmp

Filesize
8KB

Download
memory/2072-0-0x0000000077800000-0x0000000077802000-memory.dmp

Filesize
8KB

Download
memory/2072-13-0x0000000077820000-0x0000000077822000-memory.dmp

Filesize
8KB

Download
memory/2072-11-0x0000000077820000-0x0000000077822000-memory.dmp

Filesize
8KB

Download
memory/2072-5-0x0000000077810000-0x0000000077812000-memory.dmp

Filesize
8KB

Download
memory/2072-7-0x0000000077810000-0x0000000077812000-memory.dmp

Filesize
8KB

Download
memory/2072-20-0x0000000077830000-0x0000000077832000-memory.dmp

Filesize
8KB

Download
memory/2072-16-0x0000000077830000-0x0000000077832000-memory.dmp

Filesize
8KB

Download
memory/2072-23-0x000007FEFD570000-0x000007FEFD572000-memory.dmp

Filesize
8KB

Download
memory/2072-25-0x000007FEFD570000-0x000007FEFD572000-memory.dmp

Filesize
8KB

Download
memory/2072-28-0x000007FEFD580000-0x000007FEFD582000-memory.dmp

Filesize
8KB

Download
memory/2072-30-0x000007FEFD580000-0x000007FEFD582000-memory.dmp

Filesize
8KB

Download
memory/2072-31-0x000000013FCA0000-0x00000001408CD000-memory.dmp

Filesize
12.2MB

Download
memory/2072-9-0x0000000077810000-0x0000000077812000-memory.dmp

Filesize
8KB

Download
memory/2072-10-0x0000000140008000-0x000000014030B000-memory.dmp

Filesize
3.0MB

Download