Overview

overview

10

Static

static

10

338ceb653b...18.exe

windows7-x64

10

338ceb653b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    338ceb653b52928b4bc90042a64f3d3e_JaffaCakes118

  • Size

    2.1MB

  • Sample

    240511-jt12sahh47

  • MD5

    338ceb653b52928b4bc90042a64f3d3e

  • SHA1

    e913879074523d9895916ecfe9a84e010cf56f29

  • SHA256

    140ae4332eddcb2ad33d3d32aa599db0bc02f80bb9ef8cd1a5edcabf0d7628ac

  • SHA512

    0ade70c211223d4eb01bacde5fa5cb40bdfaa1449eaca328d76dbd899b6f7aa3258a78e6102a3801b2613843739b488118b0199f7f3494a2c7fde2de2a433cc6

  • SSDEEP

    49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafME:NABM

Score
10/10
xmrigexecutionminerupx

Malware Config

Targets

    • Target

      338ceb653b52928b4bc90042a64f3d3e_JaffaCakes118

    • Size

      2.1MB

    • MD5

      338ceb653b52928b4bc90042a64f3d3e

    • SHA1

      e913879074523d9895916ecfe9a84e010cf56f29

    • SHA256

      140ae4332eddcb2ad33d3d32aa599db0bc02f80bb9ef8cd1a5edcabf0d7628ac

    • SHA512

      0ade70c211223d4eb01bacde5fa5cb40bdfaa1449eaca328d76dbd899b6f7aa3258a78e6102a3801b2613843739b488118b0199f7f3494a2c7fde2de2a433cc6

    • SSDEEP

      49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafME:NABM

    Score
    10/10
    xmrigexecutionminerupx

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks