Overview

overview

10

Static

static

10

1f1f27deff...18.exe

windows7-x64

10

1f1f27deff...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1f1f27deffe539d99e12d720f1fbd7da_JaffaCakes118

  • Size

    5.2MB

  • Sample

    240329-l2xensfc77

  • MD5

    1f1f27deffe539d99e12d720f1fbd7da

  • SHA1

    a021497f416dded6636e88d8955a3a7632fbfcf2

  • SHA256

    7ece8e0973bdd09081b496e90d84e88152a60bfdd98123372fc3aed1c9d49863

  • SHA512

    2c4f8b7cf581a3ca57d7463e410a9f58bb484fef0708f15106db4c1601ebda739eef5bde96bad48e38367d53637a3deac94443d6fbf8b3d907b8838e054b1522

  • SSDEEP

    98304:5L6uEe3WyV1kpTAuLz2LgdOnV5N2Vv9Pe11dHO2:5oe3Wy/qEuLz20ne1DHO2

Score
10/10
xmrigminerpersistence

Malware Config

Targets

    • Target

      1f1f27deffe539d99e12d720f1fbd7da_JaffaCakes118

    • Size

      5.2MB

    • MD5

      1f1f27deffe539d99e12d720f1fbd7da

    • SHA1

      a021497f416dded6636e88d8955a3a7632fbfcf2

    • SHA256

      7ece8e0973bdd09081b496e90d84e88152a60bfdd98123372fc3aed1c9d49863

    • SHA512

      2c4f8b7cf581a3ca57d7463e410a9f58bb484fef0708f15106db4c1601ebda739eef5bde96bad48e38367d53637a3deac94443d6fbf8b3d907b8838e054b1522

    • SSDEEP

      98304:5L6uEe3WyV1kpTAuLz2LgdOnV5N2Vv9Pe11dHO2:5oe3Wy/qEuLz20ne1DHO2

    Score
    10/10
    xmrigminerpersistence

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks