xmrig | e8318951c19fec622a0aaf8a4d1ae04e2d2bbb45613a10b1e59ba727f9ffa557

Reason

Machine shutdown

General

Target

0b199f8a76cb31a7386a9b6f72d08708_JaffaCakes118.exe
Size

2.2MB
MD5

0b199f8a76cb31a7386a9b6f72d08708
SHA1

def2dd7ae74212dc9db383479f97e7fe4337a9d3
SHA256

e8318951c19fec622a0aaf8a4d1ae04e2d2bbb45613a10b1e59ba727f9ffa557
SHA512

1d23d2f0db922d5bd088971d748d4c2607a9387aac137ef3d891b0444b39fa94032fab094cc7b865ffdb50129558122893a525a605d0a2992c10c7c46e0ef72c
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrjx:NABo

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 5 IoCs

miner

resource	yara_rule
behavioral2/memory/884-99-0x00007FF609FD0000-0x00007FF60A3C2000-memory.dmp	xmrig
behavioral2/memory/1968-156-0x00007FF721DB0000-0x00007FF7221A2000-memory.dmp	xmrig
behavioral2/memory/2652-228-0x00007FF600520000-0x00007FF600912000-memory.dmp	xmrig
behavioral2/memory/3084-308-0x00007FF780490000-0x00007FF780882000-memory.dmp	xmrig
behavioral2/memory/1696-339-0x00007FF7B1A90000-0x00007FF7B1E82000-memory.dmp	xmrig

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4164-0-0x00007FF78FF50000-0x00007FF790342000-memory.dmp	upx
behavioral2/files/0x000d0000000233cb-6.dat	upx
behavioral2/files/0x000700000002341e-8.dat	upx
behavioral2/files/0x0007000000023421-31.dat	upx
behavioral2/memory/884-99-0x00007FF609FD0000-0x00007FF60A3C2000-memory.dmp	upx
behavioral2/memory/1968-156-0x00007FF721DB0000-0x00007FF7221A2000-memory.dmp	upx
behavioral2/files/0x0007000000023425-159.dat	upx
behavioral2/memory/2652-228-0x00007FF600520000-0x00007FF600912000-memory.dmp	upx
behavioral2/memory/3084-308-0x00007FF780490000-0x00007FF780882000-memory.dmp	upx
behavioral2/memory/1696-339-0x00007FF7B1A90000-0x00007FF7B1E82000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
1⤵
PID:4648

C:\Windows\System\LcHoFnM.exe
C:\Windows\System\LcHoFnM.exe
1⤵
PID:1412

C:\Windows\System\XmJAxNP.exe
C:\Windows\System\XmJAxNP.exe
1⤵
PID:884

C:\Windows\System\lCNIumi.exe
C:\Windows\System\lCNIumi.exe
1⤵
PID:3788

C:\Windows\System\pQKyJIi.exe
C:\Windows\System\pQKyJIi.exe
1⤵
PID:1968

C:\Windows\System\kzhdxMZ.exe
C:\Windows\System\kzhdxMZ.exe
1⤵
PID:4692

C:\Windows\System\ZqhTLKq.exe
C:\Windows\System\ZqhTLKq.exe
1⤵
PID:60

C:\Windows\System\UzYZStK.exe
C:\Windows\System\UzYZStK.exe
1⤵
PID:3496

C:\Windows\System\tAiRhnx.exe
C:\Windows\System\tAiRhnx.exe
1⤵
PID:5248

C:\Windows\System\bQShyEd.exe
C:\Windows\System\bQShyEd.exe
1⤵
PID:5352

C:\Windows\System\bQPROjD.exe
C:\Windows\System\bQPROjD.exe
1⤵
PID:5848

C:\Windows\System\KMDQCCF.exe
C:\Windows\System\KMDQCCF.exe
1⤵
PID:6048

C:\Windows\System\tVLgDJR.exe
C:\Windows\System\tVLgDJR.exe
1⤵
PID:6068

C:\Windows\System\TGdbEeE.exe
C:\Windows\System\TGdbEeE.exe
1⤵
PID:2176

C:\Windows\System\asvqaVT.exe
C:\Windows\System\asvqaVT.exe
1⤵
PID:5164

C:\Windows\System\JcDpnTd.exe
C:\Windows\System\JcDpnTd.exe
1⤵
PID:5320

C:\Windows\System\kcHzAeW.exe
C:\Windows\System\kcHzAeW.exe
1⤵
PID:5696

C:\Windows\System\gVEIGJz.exe
C:\Windows\System\gVEIGJz.exe
1⤵
PID:5752

C:\Windows\System\GGKwADs.exe
C:\Windows\System\GGKwADs.exe
1⤵
PID:5792

C:\Windows\System\VnCBvKc.exe
C:\Windows\System\VnCBvKc.exe
1⤵
PID:5840

C:\Windows\System\fAIahax.exe
C:\Windows\System\fAIahax.exe
1⤵
PID:6140

C:\Windows\System\rmnKBHh.exe
C:\Windows\System\rmnKBHh.exe
1⤵
PID:5576

C:\Windows\System\WsGfIJc.exe
C:\Windows\System\WsGfIJc.exe
1⤵
PID:5524

C:\Windows\System\MHyTuch.exe
C:\Windows\System\MHyTuch.exe
1⤵
PID:6268

C:\Windows\System\SDSLBfS.exe
C:\Windows\System\SDSLBfS.exe
1⤵
PID:6536

C:\Windows\System\wcrMcUw.exe
C:\Windows\System\wcrMcUw.exe
1⤵
PID:6552

C:\Windows\System\hIWdCLO.exe
C:\Windows\System\hIWdCLO.exe
1⤵
PID:6792

C:\Windows\System\jfWwoix.exe
C:\Windows\System\jfWwoix.exe
1⤵
PID:7048

C:\Windows\System\LYQHzWF.exe
C:\Windows\System\LYQHzWF.exe
1⤵
PID:7064

C:\Windows\System\xdVBnMB.exe
C:\Windows\System\xdVBnMB.exe
1⤵
PID:5748

C:\Windows\System\dUADNWJ.exe
C:\Windows\System\dUADNWJ.exe
1⤵
PID:6804

C:\Windows\System\vFzcJan.exe
C:\Windows\System\vFzcJan.exe
1⤵
PID:6628

C:\Windows\System\sZxHkcD.exe
C:\Windows\System\sZxHkcD.exe
1⤵
PID:6956

C:\Windows\System\aLzNhpW.exe
C:\Windows\System\aLzNhpW.exe
1⤵
PID:7128

C:\Windows\System\qWdAtGH.exe
C:\Windows\System\qWdAtGH.exe
1⤵
PID:6456

C:\Windows\System\OxPtJyD.exe
C:\Windows\System\OxPtJyD.exe
1⤵
PID:6472

C:\Windows\System\AjypFcQ.exe
C:\Windows\System\AjypFcQ.exe
1⤵
PID:6452

C:\Windows\System\oRDFzXE.exe
C:\Windows\System\oRDFzXE.exe
1⤵
PID:6720

C:\Windows\System\BolTKFb.exe
C:\Windows\System\BolTKFb.exe
1⤵
PID:4632

C:\Windows\System\iHTlKjJ.exe
C:\Windows\System\iHTlKjJ.exe
1⤵
PID:6500

C:\Windows\System\GvlrbIc.exe
C:\Windows\System\GvlrbIc.exe
1⤵
PID:3116

C:\Windows\System\BrXOsJG.exe
C:\Windows\System\BrXOsJG.exe
1⤵
PID:6528

C:\Windows\System\fOEvfNi.exe
C:\Windows\System\fOEvfNi.exe
1⤵
PID:428

C:\Windows\System\YSfLflY.exe
C:\Windows\System\YSfLflY.exe
1⤵
PID:7216

C:\Windows\System\SwGKCbG.exe
C:\Windows\System\SwGKCbG.exe
1⤵
PID:7268

C:\Windows\System\rFhSpge.exe
C:\Windows\System\rFhSpge.exe
1⤵
PID:7352

C:\Windows\System\cXHKSEV.exe
C:\Windows\System\cXHKSEV.exe
1⤵
PID:7540

C:\Windows\System\NHFzTaL.exe
C:\Windows\System\NHFzTaL.exe
1⤵
PID:7768

C:\Windows\System\UBONvNs.exe
C:\Windows\System\UBONvNs.exe
1⤵
PID:8008

C:\Windows\System\HuVjRIn.exe
C:\Windows\System\HuVjRIn.exe
1⤵
PID:5116

C:\Windows\System\CQuHPVD.exe
C:\Windows\System\CQuHPVD.exe
1⤵
PID:7796

C:\Windows\System\ikGiyno.exe
C:\Windows\System\ikGiyno.exe
1⤵
PID:7700

C:\Windows\System\dRzRRiR.exe
C:\Windows\System\dRzRRiR.exe
1⤵
PID:8596

C:\Windows\System\CJQAPgq.exe
C:\Windows\System\CJQAPgq.exe
1⤵
PID:8616

C:\Windows\System\TocwPnL.exe
C:\Windows\System\TocwPnL.exe
1⤵
PID:9040

C:\Windows\System\bgxxBDc.exe
C:\Windows\System\bgxxBDc.exe
1⤵
PID:9064

C:\Windows\System\yVSRFlX.exe
C:\Windows\System\yVSRFlX.exe
1⤵
PID:9624

C:\Windows\System\NfHbQIl.exe
C:\Windows\System\NfHbQIl.exe
1⤵
PID:10100

C:\Windows\System\DURddwJ.exe
C:\Windows\System\DURddwJ.exe
1⤵
PID:9500

C:\Windows\System\eHUUerS.exe
C:\Windows\System\eHUUerS.exe
1⤵
PID:9592

C:\Windows\System\envGYKN.exe
C:\Windows\System\envGYKN.exe
1⤵
PID:11136

C:\Windows\System\RqCzORQ.exe
C:\Windows\System\RqCzORQ.exe
1⤵
PID:10232

C:\Windows\System\wpAMxLr.exe
C:\Windows\System\wpAMxLr.exe
1⤵
PID:9136

C:\Windows\System\lmBwTmP.exe
C:\Windows\System\lmBwTmP.exe
1⤵
PID:12072

C:\Windows\System\ulYcxZz.exe
C:\Windows\System\ulYcxZz.exe
1⤵
PID:12932

C:\Windows\System\PNwGNwA.exe
C:\Windows\System\PNwGNwA.exe
1⤵
PID:11940

C:\Windows\System\QVxPcYm.exe
C:\Windows\System\QVxPcYm.exe
1⤵
PID:3264

C:\Windows\System\HtdYGTV.exe
C:\Windows\System\HtdYGTV.exe
1⤵
PID:10220

C:\Windows\System\OLzQjxX.exe
C:\Windows\System\OLzQjxX.exe
1⤵
PID:9716

C:\Windows\System\IjxQUhv.exe
C:\Windows\System\IjxQUhv.exe
1⤵
PID:10588

C:\Windows\System\swaQNla.exe
C:\Windows\System\swaQNla.exe
1⤵
PID:13220

C:\Windows\System\YAByOkR.exe
C:\Windows\System\YAByOkR.exe
1⤵
PID:3252

C:\Windows\System\FkRSBJz.exe
C:\Windows\System\FkRSBJz.exe
1⤵
PID:9632

C:\Windows\System\DcCvzzU.exe
C:\Windows\System\DcCvzzU.exe
1⤵
PID:11932

C:\Windows\System\zXBZizh.exe
C:\Windows\System\zXBZizh.exe
1⤵
PID:12688

C:\Windows\System\zeRnbuj.exe
C:\Windows\System\zeRnbuj.exe
1⤵
PID:12428

C:\Windows\System\DYNOgOW.exe
C:\Windows\System\DYNOgOW.exe
1⤵
PID:11488

C:\Windows\System\XdoYyCP.exe
C:\Windows\System\XdoYyCP.exe
1⤵
PID:10020

C:\Windows\System\KqQjkep.exe
C:\Windows\System\KqQjkep.exe
1⤵
PID:12764

C:\Windows\System\CNWzlnj.exe
C:\Windows\System\CNWzlnj.exe
1⤵
PID:11328

C:\Windows\System\lwcZgDv.exe
C:\Windows\System\lwcZgDv.exe
1⤵
PID:3596

C:\Windows\System\VkQwwdC.exe
C:\Windows\System\VkQwwdC.exe
1⤵
PID:5444

C:\Windows\System\apqGiCq.exe
C:\Windows\System\apqGiCq.exe
1⤵
PID:3620

C:\Windows\System\ZptWtkp.exe
C:\Windows\System\ZptWtkp.exe
1⤵
PID:2812

C:\Windows\System\GXuPPks.exe
C:\Windows\System\GXuPPks.exe
1⤵
PID:11324

C:\Windows\System\gFQYoUk.exe
C:\Windows\System\gFQYoUk.exe
1⤵
PID:12240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bohyavvo.ljq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ZSOHBvT.exe

Filesize
2.2MB

MD5
1e56931a5adbd8aa9e5fafe36063c0bf

SHA1
88feca5a32be2781e8e78115f578c9159e05df67

SHA256
e15143cc381c0f5d05e84bd34bfc7a4d05fe71a4461ddcc60646c9136d29d8d5

SHA512
6a7c0994f98d9535bf025368fb9239260da15307889772202fb069fe5b9ece124cf151fdf62ee74715e1a9e5e1d0b60223720e2d4b1ec022fcfc3b4ad77fe7db

Download Submit
C:\Windows\System\aNDCkVh.exe

Filesize
2.2MB

MD5
e6efe60eda9b8eb570e488ff0f697c9b

SHA1
dcdd2d619ad6bf28ee94e9185c71a0d439e830bd

SHA256
e16b1de36060f8876366838839868a9f4fc1c84cc46a12ef684dd19307974530

SHA512
d41e9763c45411b3d030d5be834a11326d3e1b49f9a5ebb6d1ab856981db11ef63824297d166ee311488fd7558e5ea10ee6f33de8091d12f3f8faef1d01067f3

Download Submit
C:\Windows\System\bMfPsXq.exe

Filesize
2.2MB

MD5
f2ddbcc9e7d4d31c95053c090bcea573

SHA1
950ac47411a08d6f5861434bd0dacf942e9a416a

SHA256
c193568cc5d62e71762a00fe9f89c783f8ea05b35f986abf08fc38e093ed4282

SHA512
374b94c49d353c20f70c557c5935269aeca34b847cfc6642e43b5825856db62fe1cdeb4e7f2fee1c39a2767c1839ab98fe994abf3ae1ca903a107d5038db4131

Download Submit
C:\Windows\System\lCNIumi.exe

Filesize
2.2MB

MD5
bfc7dd4f377eba6326584f21c70228a8

SHA1
8c083fc4e73bc7d9f53f833814c51b29c6cd7963

SHA256
a90e0e2997ee0574457fd17e4882ee2c3652618a15b7ad9f69fa2796ea109829

SHA512
48ede10c6c32f845adaea9b3b8d513e6101fb99483ea927b7de4be3e65cb70412cc0d5a850802e44ad86aac850ec15f6fd905396b5158a09f922198627bf7fd8

Download Submit
memory/884-99-0x00007FF609FD0000-0x00007FF60A3C2000-memory.dmp

Filesize
3.9MB

Download
memory/1696-339-0x00007FF7B1A90000-0x00007FF7B1E82000-memory.dmp

Filesize
3.9MB

Download
memory/1968-156-0x00007FF721DB0000-0x00007FF7221A2000-memory.dmp

Filesize
3.9MB

Download
memory/2652-228-0x00007FF600520000-0x00007FF600912000-memory.dmp

Filesize
3.9MB

Download
memory/3084-308-0x00007FF780490000-0x00007FF780882000-memory.dmp

Filesize
3.9MB

Download
memory/4164-0-0x00007FF78FF50000-0x00007FF790342000-memory.dmp

Filesize
3.9MB

Download

Analysis

Sharing

Errors