xmrig | 45146eb344d5e6b2ec143f590794fa0e89547572a636812034c42f19f45f8875

Analysis

max time kernel
125s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e33ff8024f4894b35de9d35153b1f8e_JaffaCakes118.exe
Size

784KB
MD5

2e33ff8024f4894b35de9d35153b1f8e
SHA1

eba87b18440b6f2fcf066bf95e4e73c5c781b026
SHA256

45146eb344d5e6b2ec143f590794fa0e89547572a636812034c42f19f45f8875
SHA512

84d5c6c80a229c4c756b6a286a3530d56c32dfd1935b8fc8d4301afc486a95b69b2ab42659dad61f6c3bfdafe912c936cd42ba89dfc6f86dd55d94b0dd7e07bb
SSDEEP

12288:fUESicZCd5olKz0Azbkl1TVCswWNSVb1m++nnDqgZu5WS6cggsF2y8:QhZCPaungl6swWN+1m++DqrWS6cggx

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral2/memory/2580-3-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2580-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/3116-14-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/3116-20-0x0000000005300000-0x0000000005493000-memory.dmp	xmrig
behavioral2/memory/3116-21-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/3116-31-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/3116-30-0x00000000005A0000-0x000000000071F000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
3116	2e33ff8024f4894b35de9d35153b1f8e_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3116	2e33ff8024f4894b35de9d35153b1f8e_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2580-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x0009000000023685-11.dat	upx
behavioral2/memory/3116-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2580	2e33ff8024f4894b35de9d35153b1f8e_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2580	2e33ff8024f4894b35de9d35153b1f8e_JaffaCakes118.exe
3116	2e33ff8024f4894b35de9d35153b1f8e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 3116	2580	2e33ff8024f4894b35de9d35153b1f8e_JaffaCakes118.exe	91
PID 2580 wrote to memory of 3116	2580	2e33ff8024f4894b35de9d35153b1f8e_JaffaCakes118.exe	91
PID 2580 wrote to memory of 3116	2580	2e33ff8024f4894b35de9d35153b1f8e_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\2e33ff8024f4894b35de9d35153b1f8e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2e33ff8024f4894b35de9d35153b1f8e_JaffaCakes118.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Users\Admin\AppData\Local\Temp\2e33ff8024f4894b35de9d35153b1f8e_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\2e33ff8024f4894b35de9d35153b1f8e_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4212,i,17211346206607097582,14783440229797954268,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:8
1⤵
PID:3088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2e33ff8024f4894b35de9d35153b1f8e_JaffaCakes118.exe

Filesize
784KB

MD5
25ef91ab573a7323ccaf1617491b41a3

SHA1
92ebde37c239eae0c38203426dc27625fea189bf

SHA256
d2b508a3016b9078e4c625fdd88d19c1431497f34663f551397a8ddcb472b4fb

SHA512
3b3ab77ebd5bfee17fa22b93571ced21e77c5820db01259ef5348f094455a57345a2df73b5fbfce4e01328b079628e3ad681fb51577c4181ac93ad52e16f3cd0

Download Submit
memory/2580-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2580-1-0x00000000019C0000-0x0000000001A84000-memory.dmp

Filesize
784KB

Download
memory/2580-3-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2580-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3116-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/3116-14-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3116-19-0x0000000001A90000-0x0000000001B54000-memory.dmp

Filesize
784KB

Download
memory/3116-20-0x0000000005300000-0x0000000005493000-memory.dmp

Filesize
1.6MB

Download
memory/3116-21-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/3116-31-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/3116-30-0x00000000005A0000-0x000000000071F000-memory.dmp

Filesize
1.5MB

Download