Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/04/2024, 05:58

General

  • Target

    ccb76b45e1f9d0744cfee841d5378108_JaffaCakes118.exe

  • Size

    3.8MB

  • MD5

    ccb76b45e1f9d0744cfee841d5378108

  • SHA1

    e0db88dee1afb0443f78720a1b9eca1eee687450

  • SHA256

    5ec9a91003d9a9195b25eaecdd8bbdf167897422f2ee5cc12b167c19e9b63d94

  • SHA512

    dd04592fb7a93534f85524b6c61be139736643e14681b5a9eaa0e37efc8337685bdee5eb7c1d7c328ce8c4865c164cae9c3b8e285101aeda65e017201fd29957

  • SSDEEP

    98304:anLkBuHAohDUY6KQMMPqHI0Qk8culOGrxRI:HBSVhDUYTrDqk8cuAGM

Score
10/10

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 6 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ccb76b45e1f9d0744cfee841d5378108_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ccb76b45e1f9d0744cfee841d5378108_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2524
    • C:\Users\Admin\AppData\Local\Temp\ccb76b45e1f9d0744cfee841d5378108_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\ccb76b45e1f9d0744cfee841d5378108_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:4436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ccb76b45e1f9d0744cfee841d5378108_JaffaCakes118.exe

    Filesize

    784KB

    MD5

    9d381e36414064194c0eea8bf017f086

    SHA1

    358242e9df70533787e7ce9796b41b56ffe6a97c

    SHA256

    40292ec7fd2589f1658554e3fb17277d9aad4707b3fad306e9fa972b40c339d0

    SHA512

    d694361cbac4a5657d4407d40d140705f7cf5c478ca832adda78371e737c0f028a7b421d52c9f07eac757beb9b310fea91af7be54ae8fc26468eca873874d65d

  • memory/2524-0-0x0000000000400000-0x0000000000712000-memory.dmp

    Filesize

    3.1MB

  • memory/2524-1-0x0000000001AC0000-0x0000000001B84000-memory.dmp

    Filesize

    784KB

  • memory/2524-2-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/2524-12-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/4436-13-0x0000000000400000-0x0000000000712000-memory.dmp

    Filesize

    3.1MB

  • memory/4436-14-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/4436-16-0x0000000001910000-0x00000000019D4000-memory.dmp

    Filesize

    784KB

  • memory/4436-20-0x0000000000400000-0x0000000000587000-memory.dmp

    Filesize

    1.5MB

  • memory/4436-23-0x0000000005500000-0x0000000005693000-memory.dmp

    Filesize

    1.6MB

  • memory/4436-30-0x0000000000400000-0x0000000000587000-memory.dmp

    Filesize

    1.5MB