Analysis
-
max time kernel
142s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
28/04/2024, 20:16
General
-
Target
05fcecbe6c310cf67acee70addfe8abc_JaffaCakes118.exe
-
Size
6.7MB
-
MD5
05fcecbe6c310cf67acee70addfe8abc
-
SHA1
7e3990605f187a855bd11c697bd4c1f69ae79c07
-
SHA256
a6077e7692ed597f9f5ad1f601aefaf98ce545961ec8310949b97e5af8c4ff96
-
SHA512
9a4f558fe5c8745fef4d80edbd75f5079c3af8d49e9bf37e53264705ee529ea46ad93ef8c91696decd4d6e6524d8c279b07a52df5c1a3362efce48fc05f26dde
-
SSDEEP
196608:P1X3KbfghFMfb2yHNSyEcM83kI+SV+ARgJ:Px6zDqejMNI4ARm
Score
10/10
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 5 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 2 IoCs
-
Modifies Internet Explorer start page 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\05fcecbe6c310cf67acee70addfe8abc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\05fcecbe6c310cf67acee70addfe8abc_JaffaCakes118.exe"1⤵
- Drops autorun.inf file
- Drops file in Program Files directory
- Modifies Internet Explorer start page
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.7MB
-
Filesize
64KB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
12.7MB
-
Filesize
12.7MB