Overview

overview

10

Static

static

10

0f6eae8a93...18.exe

windows7-x64

10

0f6eae8a93...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f6eae8a93f85560ce2df141cc74ec62_JaffaCakes118

  • Size

    2.2MB

  • Sample

    240503-cly4wsce3v

  • MD5

    0f6eae8a93f85560ce2df141cc74ec62

  • SHA1

    811005a214c7299fec98d73d3a435b8c3db0a369

  • SHA256

    cdfb5eceef238cb0fc3e5941435bd89b333081f1b7a5bee85ce46621c12d2043

  • SHA512

    c9a7a88244e08a9ed9ce41374079fbadda51a8f2b1a7e2090e79bdf3eaaffdde31c0593b9e1ba1ef252d2bf0cbae0658f8e78d280a28129aa04c762277bb1413

  • SSDEEP

    49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfKb:NAB1

Score
10/10
xmrigexecutionminerupx

Malware Config

Targets

    • Target

      0f6eae8a93f85560ce2df141cc74ec62_JaffaCakes118

    • Size

      2.2MB

    • MD5

      0f6eae8a93f85560ce2df141cc74ec62

    • SHA1

      811005a214c7299fec98d73d3a435b8c3db0a369

    • SHA256

      cdfb5eceef238cb0fc3e5941435bd89b333081f1b7a5bee85ce46621c12d2043

    • SHA512

      c9a7a88244e08a9ed9ce41374079fbadda51a8f2b1a7e2090e79bdf3eaaffdde31c0593b9e1ba1ef252d2bf0cbae0658f8e78d280a28129aa04c762277bb1413

    • SSDEEP

      49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfKb:NAB1

    Score
    10/10
    xmrigexecutionminerupx

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks