Overview

overview

10

Static

static

7

d01d03f493...18.exe

windows7-x64

10

d01d03f493...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/04/2024, 09:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    d01d03f4930a6347d635615eaf0e77d1_JaffaCakes118.exe

  • Size

    3.1MB

  • MD5

    d01d03f4930a6347d635615eaf0e77d1

  • SHA1

    8161d681860391610fec0eda33229e42115f1957

  • SHA256

    8ae1e2b1dd8cbdf16f5a7700d129a39749ec3c4a196b6de321e0d82710694594

  • SHA512

    b8f1bcd536dd0d5deb10f3438b8d6dda63d40f0b2964dd76fc15ae9d5a718a37c6ad198577b296a4c7210342affcfe9af5fd92fdcec27efbe72046ace96203c0

  • SSDEEP

    98304:UWsgzCw+TKsQJTaBdA9CeFVAC6bFpi+xpP:VIwgKsQJGDebP6hc+T

Score
10/10
xmrigminerupx

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 6 IoCs
    miner
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d01d03f4930a6347d635615eaf0e77d1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d01d03f4930a6347d635615eaf0e77d1_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2656
    • C:\Users\Admin\AppData\Local\Temp\d01d03f4930a6347d635615eaf0e77d1_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\d01d03f4930a6347d635615eaf0e77d1_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:3052

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\d01d03f4930a6347d635615eaf0e77d1_JaffaCakes118.exe
          Filesize

          784KB

          MD5

          2ad6af15e8351a9412bd1cb8d46fb2b0

          SHA1

          cee153dc919287cf221b926ba52ecb74f22fd24e

          SHA256

          381345d1719cb90975cc36169f923059e844202d804cace630cafa294cb980f4

          SHA512

          389f9fc2704a0c4989ef96b2f6eedaede7d7cb77cb779d42d4df38b186ab339df098fcb23884ef7f6fdbb3778ac505f9e10e68ea1c619ae9e6598b880fa66262

          Download Submit

        • memory/2656-0-0x0000000000400000-0x0000000000712000-memory.dmp

          Filesize

          3.1MB

          Download

        • memory/2656-1-0x00000000018C0000-0x0000000001984000-memory.dmp

          Filesize

          784KB

          Download

        • memory/2656-2-0x0000000000400000-0x0000000000593000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/2656-12-0x0000000000400000-0x0000000000593000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3052-13-0x0000000000400000-0x0000000000712000-memory.dmp

          Filesize

          3.1MB

          Download

        • memory/3052-14-0x0000000000400000-0x0000000000593000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3052-16-0x0000000001A60000-0x0000000001B24000-memory.dmp

          Filesize

          784KB

          Download

        • memory/3052-20-0x0000000005450000-0x00000000055E3000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/3052-21-0x0000000000400000-0x0000000000587000-memory.dmp

          Filesize

          1.5MB

          Download

        • memory/3052-31-0x0000000000400000-0x0000000000587000-memory.dmp

          Filesize

          1.5MB

          Download