Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 16:50
Behavioral task
behavioral1
Sample
4a8d092a79d250d3b7af08f2615d306c_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
4a8d092a79d250d3b7af08f2615d306c_JaffaCakes118.exe
-
Size
784KB
-
MD5
4a8d092a79d250d3b7af08f2615d306c
-
SHA1
339d214ca12e2970a5b66614ec4e2ea4cf34a9c7
-
SHA256
3bcffb49cd8b7883817b32f3e24c5ada87a9e247d57b4e01b2e7fc2c4deb78ad
-
SHA512
4dbf516fdd1c5457a87d11714679dfefd48fc8bda9e2d6ed94e4bfa92076710763843b1ce23fe6d45fb68b945ec98e8766183d0c23fe5a7494fb58bf0dc453a2
-
SSDEEP
12288:/xDV6hskecy1ZYfxYWcIpqQRcEBKbP5gj7sD5KMPG2QVHuixlEw86+4n4:76hsR3aRhcEM2gDPGJHPEm4
Malware Config
Signatures
-
XMRig Miner payload 6 IoCs
resource yara_rule behavioral1/memory/1720-14-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/1720-1-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral1/memory/2180-33-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral1/memory/2180-31-0x0000000003150000-0x00000000032E3000-memory.dmp xmrig behavioral1/memory/2180-22-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral1/memory/2180-16-0x0000000000400000-0x0000000000593000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 2180 4a8d092a79d250d3b7af08f2615d306c_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2180 4a8d092a79d250d3b7af08f2615d306c_JaffaCakes118.exe -
Loads dropped DLL 1 IoCs
pid Process 1720 4a8d092a79d250d3b7af08f2615d306c_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/1720-0-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral1/files/0x000d000000012260-8.dat upx behavioral1/memory/2180-21-0x0000000000400000-0x0000000000712000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1720 4a8d092a79d250d3b7af08f2615d306c_JaffaCakes118.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1720 4a8d092a79d250d3b7af08f2615d306c_JaffaCakes118.exe 2180 4a8d092a79d250d3b7af08f2615d306c_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1720 wrote to memory of 2180 1720 4a8d092a79d250d3b7af08f2615d306c_JaffaCakes118.exe 31 PID 1720 wrote to memory of 2180 1720 4a8d092a79d250d3b7af08f2615d306c_JaffaCakes118.exe 31 PID 1720 wrote to memory of 2180 1720 4a8d092a79d250d3b7af08f2615d306c_JaffaCakes118.exe 31 PID 1720 wrote to memory of 2180 1720 4a8d092a79d250d3b7af08f2615d306c_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a8d092a79d250d3b7af08f2615d306c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4a8d092a79d250d3b7af08f2615d306c_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\4a8d092a79d250d3b7af08f2615d306c_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\4a8d092a79d250d3b7af08f2615d306c_JaffaCakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2180
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
784KB
MD556269866804083b5c57249c252763ee4
SHA1c47adf1c12271aec58b008455591fc4e79b0b781
SHA25607d0317cf326f52df6768b9e823e4e22fb29d09fdebaff7422857a3f9ef95e3d
SHA51246558491bf393108fe722be9bf2a36840fbb4217bfe149aa4dee82fb23fb24d04fd3198e8369760e06980534aba167bc6e5c5d36c5d67874e9e9c60f1a3054d9