privateloader | a931840a162cb636603a137463cea414aa9d906654d6bb12a92d6cad981a1b0f

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
26-12-2024 21:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_a931840a162cb636603a137463cea414aa9d906654d6bb12a92d6cad981a1b0f.exe
Size

685.0MB
MD5

096dc1fabe1ad64b3e2396c8e6aa4fca
SHA1

2038df7cae2b236982d1acc5ce9314dcf1132ed0
SHA256

a931840a162cb636603a137463cea414aa9d906654d6bb12a92d6cad981a1b0f
SHA512

58f66cd7bc84b860b2c43059effd5e299f2493730ed88d5f1cb2381bf73d71d9cdabd26d6d986ee930bfb60fbdfb8b45336522d864e85300012c72a1e1200cf3
SSDEEP

196608:PhXPU493Ffe2lrHmPvq4+tocAgGYqBsb2N:PlM4ZZe2pKL8o1USN

Score

10^/10

privateloader loader

Malware Config

Signatures

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
Privateloader family
privateloader

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	JaffaCakes118_a931840a162cb636603a137463cea414aa9d906654d6bb12a92d6cad981a1b0f.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	JaffaCakes118_a931840a162cb636603a137463cea414aa9d906654d6bb12a92d6cad981a1b0f.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	JaffaCakes118_a931840a162cb636603a137463cea414aa9d906654d6bb12a92d6cad981a1b0f.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	JaffaCakes118_a931840a162cb636603a137463cea414aa9d906654d6bb12a92d6cad981a1b0f.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2644	JaffaCakes118_a931840a162cb636603a137463cea414aa9d906654d6bb12a92d6cad981a1b0f.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2288	2644	JaffaCakes118_a931840a162cb636603a137463cea414aa9d906654d6bb12a92d6cad981a1b0f.exe	31
PID 2644 wrote to memory of 2288	2644	JaffaCakes118_a931840a162cb636603a137463cea414aa9d906654d6bb12a92d6cad981a1b0f.exe	31
PID 2644 wrote to memory of 2288	2644	JaffaCakes118_a931840a162cb636603a137463cea414aa9d906654d6bb12a92d6cad981a1b0f.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a931840a162cb636603a137463cea414aa9d906654d6bb12a92d6cad981a1b0f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a931840a162cb636603a137463cea414aa9d906654d6bb12a92d6cad981a1b0f.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2644 -s 368
  2⤵
  PID:2288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2644-9-0x0000000077B20000-0x0000000077B22000-memory.dmp

Filesize
8KB

Download
memory/2644-10-0x000000013FAB8000-0x000000013FE90000-memory.dmp

Filesize
3.8MB

Download
memory/2644-7-0x0000000077B20000-0x0000000077B22000-memory.dmp

Filesize
8KB

Download
memory/2644-5-0x0000000077B20000-0x0000000077B22000-memory.dmp

Filesize
8KB

Download
memory/2644-4-0x0000000077B10000-0x0000000077B12000-memory.dmp

Filesize
8KB

Download
memory/2644-2-0x0000000077B10000-0x0000000077B12000-memory.dmp

Filesize
8KB

Download
memory/2644-0-0x0000000077B10000-0x0000000077B12000-memory.dmp

Filesize
8KB

Download
memory/2644-15-0x0000000077B30000-0x0000000077B32000-memory.dmp

Filesize
8KB

Download
memory/2644-13-0x0000000077B30000-0x0000000077B32000-memory.dmp

Filesize
8KB

Download
memory/2644-11-0x0000000077B30000-0x0000000077B32000-memory.dmp

Filesize
8KB

Download
memory/2644-16-0x0000000077B40000-0x0000000077B42000-memory.dmp

Filesize
8KB

Download
memory/2644-20-0x0000000077B40000-0x0000000077B42000-memory.dmp

Filesize
8KB

Download
memory/2644-18-0x0000000077B40000-0x0000000077B42000-memory.dmp

Filesize
8KB

Download
memory/2644-30-0x000007FEFDB10000-0x000007FEFDB12000-memory.dmp

Filesize
8KB

Download
memory/2644-28-0x000007FEFDB10000-0x000007FEFDB12000-memory.dmp

Filesize
8KB

Download
memory/2644-25-0x000007FEFDB00000-0x000007FEFDB02000-memory.dmp

Filesize
8KB

Download
memory/2644-23-0x000007FEFDB00000-0x000007FEFDB02000-memory.dmp

Filesize
8KB

Download
memory/2644-31-0x000000013F750000-0x0000000140540000-memory.dmp

Filesize
13.9MB

Download
memory/2644-42-0x000000013FAB8000-0x000000013FE90000-memory.dmp

Filesize
3.8MB

Download