Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
05-01-2025 16:25
General
-
Target
JaffaCakes118_b082437e6c30747af43f9e9ce795e17a.exe
-
Size
12KB
-
MD5
b082437e6c30747af43f9e9ce795e17a
-
SHA1
30759f7e545f2d80ff8d51c8e07c83c1452851cf
-
SHA256
b87e6905e6a2c6166fc3f7b84bde785a0914cb444814acd2a54ac433ae61db29
-
SHA512
7a127819d90d468c913f160a05c6a550df5f5374684d0e7b5ddcea038c2fae8203a676d8eee0e163e93d6628253ac4e9c790b6442bbfde35a411066ae69b65d4
-
SSDEEP
192:Rd+SoL+WA4g2sLhMGmcNSdG/I3YzWYEI5lzfg/DvQbE:SSoSWAD2wy/I2G/I3YzWlI5lTiob
Score
10/10
Malware Config
Extracted
Family
purecrypter
C2
http://37.0.8.173/conhost-l.png
Signatures
-
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Purecrypter family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b082437e6c30747af43f9e9ce795e17a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b082437e6c30747af43f9e9ce795e17a.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2368 -s 10722⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB