Analysis

  • max time kernel
    141s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    30/04/2024, 18:19

General

  • Target

    0a4f561363f0bae19ade6bf4c2703eb0_JaffaCakes118.exe

  • Size

    7.3MB

  • MD5

    0a4f561363f0bae19ade6bf4c2703eb0

  • SHA1

    01b3c08dbde0e7812eec213a4a3516c5e488808c

  • SHA256

    48a5dd4f19318e47e5316e29629a6bb3f4d0613fb0f54ce58a409f8a46d0d548

  • SHA512

    15c768c0cb2190c62cba93a32104e30e690189adafc88b69a7f6e264e66693d7939499af5f29314811ba80c5dde93a27ba495a2187ffbef2b2f6e676b7d46526

  • SSDEEP

    98304:JGxVzrQ6viczbMAIgXSYn0UL2AzZfzpvLhpLB1uV9+S99U:JMVzs6qczbJXSYnZFZbpvbLB10n99U

Score
10/10

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 6 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 40 IoCs
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a4f561363f0bae19ade6bf4c2703eb0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0a4f561363f0bae19ade6bf4c2703eb0_JaffaCakes118.exe"
    1⤵
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Modifies Internet Explorer start page
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:1724

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

    Filesize

    1KB

    MD5

    55540a230bdab55187a841cfe1aa1545

    SHA1

    363e4734f757bdeb89868efe94907774a327695e

    SHA256

    d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

    SHA512

    c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

    Filesize

    230B

    MD5

    34363bdf3e9442a682ba9b87ef971e47

    SHA1

    7d3f73405550fc94feeae74a5f6af621ceb5ef1a

    SHA256

    3e67d3eb2b5825c2a6f004d33d905c1ca078b51f6a2d9694828f8d60fab9685d

    SHA512

    6161150b802aa2113685d0d537bac1db9b047442be4b8e9fee61739098d5def6ef23d7abfad73bfcfa9ebd12f7a6f7d5756368470f11d6e05e81ea5e8497d6e1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    0be296d5f830ab5b83c90b72ac6793eb

    SHA1

    5a1386a37416a8d2c355ffe9a0bdbe8fb981bbb2

    SHA256

    eac715e5c499ac674781a3cca045e1ea9a5567bb6d1e02980079a45bae616e40

    SHA512

    26657cb527c58c06b09756c620112f696b58bbf97d792d0dba147a7408215b6632426db2080cb866ef45361cba3eaf96a2a0bd9b380742923f0dcba2fdacd9d0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ce85348774fc7c7a06f29bffcbdbaf22

    SHA1

    0e637a744c06292fce3bb099967e8148da87b812

    SHA256

    2a6046d3f5926be38af6f9d4c4584c28eed6e803625ac27c766f1e614ad9b435

    SHA512

    486d16acf7498162506fec25dd0f7f7f5550fbf43b5e759b40c3780e6269ea4d533a55f514a2e48e226b34f38973a32a0636e6e4b9d1c2ee556d1a0646f6a40a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c9e81b44ddf8e40f0e6b430de64693f2

    SHA1

    565677d1030e2169e6796d3c7745dc869efa7c25

    SHA256

    a6ec3751bc1f77ed02e3e9766470529de2517b96a2f325d35ef1a24854655f01

    SHA512

    9c2b6e8c784b55e42216cd329d27fccae871f07e68cc653975864cb9c47c88d7706f5d9992a8d36fdc7a9ab184e984649c25e17017810364171ff847ee922232

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    7e99a2d47eb8c069061494aad2caa906

    SHA1

    142e47f4bb71ad7c91ea81662a0fc965f679a256

    SHA256

    c438bf5ccccc2185e466bff1617236ed1284f1d83b71178bdeb9f923ddd579dd

    SHA512

    7a78cc3a88088f31bcab6ab189a0a9832e2ed518f380d67179c839be9ffec751a2bbfb3f8a37c44407bbf89e9c545e1a390f786d0f4326f3288b9e44934d762a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    e1e2eb737603f81f36197691f1c8a9b8

    SHA1

    bde90eb3c4fd1bf20c4e94c462c05f0143987b2a

    SHA256

    c6bbf749dfdad83f75ec92fd37a069624113b3d854a9468c2e32f4bc41b8afc3

    SHA512

    2fd095b8fe43af8de436e70d35b12f6e506c5bc628e68d417e2512453b9ad14793a391f25071de8b458a584663ace17eb31ec9257efbb6534709e477c182d5b9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    bf29240d0b05b6ab19414f91937e9b2d

    SHA1

    ab4611a8956c147fb550d083bd0e1dc62fe2a348

    SHA256

    3d36daba1ba100eea113153a1ddcec425c8dd602ce2ca875cafc4df2900c5f12

    SHA512

    30cc1e806dfb858fb177afccd74625f91c8b68ad8b15b6545f1fe53bff5e2e43e39627c515baeeb14bd65e548ae0a9ceae983a31c8cf76cd809ea5a5edb37e56

  • C:\Users\Admin\AppData\Local\Temp\Cab1AB5.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar1AB7.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • C:\Users\Admin\AppData\Local\Temp\Tar1B87.tmp

    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

  • memory/1724-863-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/1724-1054-0x00000000002D0000-0x00000000002D1000-memory.dmp

    Filesize

    4KB

  • memory/1724-381-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/1724-862-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/1724-0-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/1724-864-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/1724-927-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/1724-1052-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/1724-1053-0x00000000002C0000-0x00000000002C1000-memory.dmp

    Filesize

    4KB

  • memory/1724-1-0x00000000002E0000-0x00000000002F0000-memory.dmp

    Filesize

    64KB

  • memory/1724-1055-0x00000000002F0000-0x0000000000330000-memory.dmp

    Filesize

    256KB

  • memory/1724-1056-0x0000000000330000-0x0000000000352000-memory.dmp

    Filesize

    136KB

  • memory/1724-1057-0x0000000000360000-0x0000000000370000-memory.dmp

    Filesize

    64KB

  • memory/1724-1058-0x0000000000370000-0x0000000000380000-memory.dmp

    Filesize

    64KB

  • memory/1724-1059-0x0000000000380000-0x0000000000390000-memory.dmp

    Filesize

    64KB

  • memory/1724-1060-0x00000000003B0000-0x00000000003F0000-memory.dmp

    Filesize

    256KB

  • memory/1724-1061-0x00000000003F0000-0x0000000000400000-memory.dmp

    Filesize

    64KB

  • memory/1724-1063-0x0000000004680000-0x0000000004681000-memory.dmp

    Filesize

    4KB

  • memory/1724-1062-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/1724-1064-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB