xmrig | 6349937fc0072ddd643a89cc6345a2c46aaf15f6ff9a1d8a6ec4bd2528c79c53

Reason

Machine shutdown

General

Target

0074b82920250cae7e82c473cdf2b157_JaffaCakes118.exe
Size

1.9MB
MD5

0074b82920250cae7e82c473cdf2b157
SHA1

8e96e525e014dfbd698d08eb680a04b05b8f4e7a
SHA256

6349937fc0072ddd643a89cc6345a2c46aaf15f6ff9a1d8a6ec4bd2528c79c53
SHA512

b91ae8cc90eb65972546c05b0bfc8e2da27caf7b5a3ba8cb14b199a7640ee1a14a582f31cc19024c7ff3ad8a5620d893addf16513cc1e97b8d670dc3eaba26f1
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UNk:NABN

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/memory/1040-75-0x00007FF6732F0000-0x00007FF6736E2000-memory.dmp	xmrig
behavioral2/memory/5064-187-0x00007FF6EE3B0000-0x00007FF6EE7A2000-memory.dmp	xmrig

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4228-0-0x00007FF652620000-0x00007FF652A12000-memory.dmp	upx
behavioral2/files/0x000600000002326f-13.dat	upx
behavioral2/files/0x00070000000233ed-52.dat	upx
behavioral2/memory/1040-75-0x00007FF6732F0000-0x00007FF6736E2000-memory.dmp	upx
behavioral2/files/0x0007000000023400-144.dat	upx
behavioral2/memory/5064-187-0x00007FF6EE3B0000-0x00007FF6EE7A2000-memory.dmp	upx
behavioral2/files/0x000700000002340f-186.dat	upx
behavioral2/files/0x000700000002340e-185.dat	upx
behavioral2/files/0x000700000002340d-184.dat	upx
behavioral2/files/0x0007000000023416-196.dat	upx

C:\Users\Admin\AppData\Local\Temp\0074b82920250cae7e82c473cdf2b157_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0074b82920250cae7e82c473cdf2b157_JaffaCakes118.exe"
1⤵
PID:4228
- C:\Windows\System\nXSUUFW.exe
  C:\Windows\System\nXSUUFW.exe
  2⤵
  PID:1040
- C:\Windows\System\eiOihiv.exe
  C:\Windows\System\eiOihiv.exe
  2⤵
  PID:5064
- C:\Windows\System\fQzsjUv.exe
  C:\Windows\System\fQzsjUv.exe
  2⤵
  PID:4388
- C:\Windows\System\gpWjzjm.exe
  C:\Windows\System\gpWjzjm.exe
  2⤵
  PID:856
- C:\Windows\System\fOOHkXR.exe
  C:\Windows\System\fOOHkXR.exe
  2⤵
  PID:1504
- C:\Windows\System\qACVxlF.exe
  C:\Windows\System\qACVxlF.exe
  2⤵
  PID:5464
- C:\Windows\System\RdJYDnW.exe
  C:\Windows\System\RdJYDnW.exe
  2⤵
  PID:5860
- C:\Windows\System\vJQgaVF.exe
  C:\Windows\System\vJQgaVF.exe
  2⤵
  PID:6980
- C:\Windows\System\crreTBN.exe
  C:\Windows\System\crreTBN.exe
  2⤵
  PID:8020
- C:\Windows\System\jxRFMAZ.exe
  C:\Windows\System\jxRFMAZ.exe
  2⤵
  PID:6792
- C:\Windows\System\iambWaf.exe
  C:\Windows\System\iambWaf.exe
  2⤵
  PID:11044
- C:\Windows\System\OzErQDc.exe
  C:\Windows\System\OzErQDc.exe
  2⤵
  PID:11064
- C:\Windows\System\tqxOugW.exe
  C:\Windows\System\tqxOugW.exe
  2⤵
  PID:11080
- C:\Windows\System\RJvTTMr.exe
  C:\Windows\System\RJvTTMr.exe
  2⤵
  PID:11104
- C:\Windows\System\qpnCCmD.exe
  C:\Windows\System\qpnCCmD.exe
  2⤵
  PID:11124
- C:\Windows\System\WheflJW.exe
  C:\Windows\System\WheflJW.exe
  2⤵
  PID:11144
- C:\Windows\System\SwqOrOc.exe
  C:\Windows\System\SwqOrOc.exe
  2⤵
  PID:11160
- C:\Windows\System\REpzDYF.exe
  C:\Windows\System\REpzDYF.exe
  2⤵
  PID:11184
- C:\Windows\System\oCcRwuv.exe
  C:\Windows\System\oCcRwuv.exe
  2⤵
  PID:11204
- C:\Windows\System\cxoRtYq.exe
  C:\Windows\System\cxoRtYq.exe
  2⤵
  PID:11220
- C:\Windows\System\EGpYlVR.exe
  C:\Windows\System\EGpYlVR.exe
  2⤵
  PID:8700
- C:\Windows\System\FdjVhRN.exe
  C:\Windows\System\FdjVhRN.exe
  2⤵
  PID:12556
- C:\Windows\System\VjTNCBG.exe
  C:\Windows\System\VjTNCBG.exe
  2⤵
  PID:8684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\LsWejXe.exe

Filesize
1.9MB

MD5
a4cea188b1005aaa59cf66c3adeb8110

SHA1
4acdde3abb9488f83a14b6b37321d23e2e883205

SHA256
9bbf47f947a96c08cff37e07c2b496a75f0239abff5dc34ea0f1ca988bd1db6c

SHA512
4913672855dc7da0bed5c41cf3c438ea38b85c33e40e4655943d48c90441dfa18f4166d26b188a2d5ac17268cfffa660b35205d2879f7fa653475b6008c92d6f

Download Submit
C:\Windows\System\OpOZUNh.exe

Filesize
1.8MB

MD5
f4f83bdf29e8f085aa3ca87a9b6ccf0b

SHA1
686357596c9d790625c707e8970e0a97ea0acda7

SHA256
31a60e32944ff7983dd5808fe130ef57cb3299260c7a3b60a770f68b9c526fb6

SHA512
7c7bcfb7425f77e9047d5a7e8071c36f2bbfebd5e5ffab042e5288162da6361898d91319ce228b2af4e96562332f84e2d86aee81543b196bb9838f6c27961266

Download Submit
C:\Windows\System\QVZWvZy.exe

Filesize
1.7MB

MD5
93daf13d805a1ed2822265430d9a42f2

SHA1
4504030cb5f6b043b732e93afbe38699499da3bc

SHA256
e06bb88957294279be00efced85fab4fcb0a18035eefc53611b839c4d100dc1a

SHA512
ba2f183db1d61908edec9292db0f836cbff412cc27fd52f98461815d7379702428368a4a466d2352dff8bb4527b383ab7299928f90f2978403b0cea2594482f5

Download Submit
C:\Windows\System\ROvWKYA.exe

Filesize
1.9MB

MD5
8c7e5074ed6446e53e906815b2cbe48c

SHA1
7b607b91f499e614fde99e576a90dad72b4ef6d9

SHA256
a7e45d7ed24acd7542320aa414b6c8b2e49b8b92ded76b831eaeb76649ed67fc

SHA512
5157727a5356051bf5c22c3a4d762e03532ea9a3abdab67b1e6884c530c8bfc70881532a67d49052f65dc439e864488a9c40f23d6baf6268299db9f15ee39109

Download Submit
C:\Windows\System\cCrqkbS.exe

Filesize
704KB

MD5
c1338744ec91ebb7d9d41ee6b8aacedd

SHA1
6107c71f5306610d6fb1c8f74dde2c5f8670bcc7

SHA256
531a2d4c407c506cfec82a7e9a42c8e4cb1280e4bb5d6ab99a321495dc4c21ff

SHA512
820bce9297f842c0676888becf83d670baa9c12e1b7801e1b822e25306db0ae0f1adcfa8d064c76f11282e567be5d9595e7d19df4dedef26004d6e38a83d9e7a

Download Submit
C:\Windows\System\hOBvmsO.exe

Filesize
1.4MB

MD5
fda713ddf51a67d050a29f3d336b913d

SHA1
445d30089407b368cffa16e8f57d41e2e454ae10

SHA256
faa694811476809c0d15f0b3b7b5fc5d2c2152f54142695d463fa69a53d84a94

SHA512
a571bf6c9fb5e781e3b40ec9b2c31c9aa201c6f1268e72b3ec2b81c7b4f167e988bcd2e788a9a4c1fafb4acc02ba562d6dac9ec4ae0c9c6a2935211c2892a6c0

Download Submit
C:\Windows\System\nXSUUFW.exe

Filesize
1.2MB

MD5
c815f7a3aa717f6590445d6e8a76e600

SHA1
a015aa1f37bd195f2dba6e123b9562c78223dd13

SHA256
d6c070762b85dab5fc02ef1716fbdaff5b2943469b6cf2f33c70a674c23bb7dc

SHA512
11a71a6c8540b32499b41c8a14dcbee70090df61f043a10155691c97e4b2bdafe8e4af78217953316cc90a3c4887e00547780f348f52a0aec8cb29ce6cbf1806

Download Submit
memory/208-63-0x0000026DBA070000-0x0000026DBA080000-memory.dmp

Filesize
64KB

Download
memory/1040-75-0x00007FF6732F0000-0x00007FF6736E2000-memory.dmp

Filesize
3.9MB

Download
memory/4228-0-0x00007FF652620000-0x00007FF652A12000-memory.dmp

Filesize
3.9MB

Download
memory/5064-187-0x00007FF6EE3B0000-0x00007FF6EE7A2000-memory.dmp

Filesize
3.9MB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads