General

  • Target

    54d94f1232629dcb2fb02519591c78c1_JaffaCakes118

  • Size

    1.9MB

  • Sample

    240518-qbqawscg6s

  • MD5

    54d94f1232629dcb2fb02519591c78c1

  • SHA1

    236eb4aab4a8528809218841f043034289d02d51

  • SHA256

    8fbfdd5086dd3ba34e1238e0f1aef915d3f1c5e47e27cc94ec3e9ee74f210536

  • SHA512

    8c67e84987dcfaa50788a8d4beb43d6fe1fc8f6a2524361194101df129e1aeee813823bd5930662a4d2c3e96f15c59029bfac531aadee68ce67a9c49854c8d9a

  • SSDEEP

    49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafsu:NAB6

Malware Config

Targets

    • Target

      54d94f1232629dcb2fb02519591c78c1_JaffaCakes118

    • Size

      1.9MB

    • MD5

      54d94f1232629dcb2fb02519591c78c1

    • SHA1

      236eb4aab4a8528809218841f043034289d02d51

    • SHA256

      8fbfdd5086dd3ba34e1238e0f1aef915d3f1c5e47e27cc94ec3e9ee74f210536

    • SHA512

      8c67e84987dcfaa50788a8d4beb43d6fe1fc8f6a2524361194101df129e1aeee813823bd5930662a4d2c3e96f15c59029bfac531aadee68ce67a9c49854c8d9a

    • SSDEEP

      49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafsu:NAB6

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks