Analysis

  • max time kernel
    91s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/04/2024, 10:23

General

  • Target

    f58dbdbf39f28d4b430c2a70a3e908c1_JaffaCakes118.exe

  • Size

    784KB

  • MD5

    f58dbdbf39f28d4b430c2a70a3e908c1

  • SHA1

    4e580aba388116064d2f5fbb0cbb9164b5ea8e41

  • SHA256

    8a69ed50dbe22d168c600048d6b03d8989d9481814e30f720e77d7b55297c3a2

  • SHA512

    7059a4cf63274088193e03558ccecd36d3610c8ef26357ae4568b3841490eb26c4fa20fbd099fb8762e45fa36d59edd3690b5503debfc0da5f63c6d81e62be5f

  • SSDEEP

    12288:mfdjCj6+hyLmFUJ8JvWk+L4XJsrd8ND+I9+8rNNKYt1UqUYg+wVzMqSYyK:mNChyLH8s3L4ZsU+8rNNKw1lHgPdMqN

Score
10/10

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 6 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f58dbdbf39f28d4b430c2a70a3e908c1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f58dbdbf39f28d4b430c2a70a3e908c1_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1344
    • C:\Users\Admin\AppData\Local\Temp\f58dbdbf39f28d4b430c2a70a3e908c1_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\f58dbdbf39f28d4b430c2a70a3e908c1_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:1392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\f58dbdbf39f28d4b430c2a70a3e908c1_JaffaCakes118.exe

    Filesize

    784KB

    MD5

    a452da3a120e5a44d8865402654f9f2c

    SHA1

    661328aea8fc8a99fae92244fd39ba086e0d272d

    SHA256

    322513d5a96707363adefe0bc12d2435d47f3ba7d2c44cd74e0466df3533f57c

    SHA512

    8fb87122fac0ec07c7cd0d6c51d5afd8044f635ec06468f08f5b92f94a4a1479b7230c625cb31ecb165128c138e6297a823a14e28637507fc2e70e07f5348503

  • memory/1344-0-0x0000000000400000-0x0000000000712000-memory.dmp

    Filesize

    3.1MB

  • memory/1344-1-0x00000000018C0000-0x0000000001984000-memory.dmp

    Filesize

    784KB

  • memory/1344-2-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/1344-12-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/1392-13-0x0000000000400000-0x0000000000712000-memory.dmp

    Filesize

    3.1MB

  • memory/1392-15-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/1392-14-0x0000000001910000-0x00000000019D4000-memory.dmp

    Filesize

    784KB

  • memory/1392-21-0x00000000054C0000-0x0000000005653000-memory.dmp

    Filesize

    1.6MB

  • memory/1392-20-0x0000000000400000-0x0000000000587000-memory.dmp

    Filesize

    1.5MB

  • memory/1392-30-0x0000000000400000-0x0000000000587000-memory.dmp

    Filesize

    1.5MB