Overview

overview

10

Static

static

7

4a9f871bdf...18.exe

windows7-x64

10

4a9f871bdf...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    100s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/07/2024, 17:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    4a9f871bdf11cb7a431ad5658ad33e41_JaffaCakes118.exe

  • Size

    784KB

  • MD5

    4a9f871bdf11cb7a431ad5658ad33e41

  • SHA1

    2fb66917e349f1a24bcc54b0589b5b7c779f834d

  • SHA256

    c6a35f5346a20738d918333bf8af5338bc78b2a6db26bc7995ec6bb23288ac17

  • SHA512

    e6b286d1e0a2f471e61f9eb94dace245a58cf6d4da3d7108a45cbeba7472c1cf3068e5c0a7a02ea093e01cb0daba1381eefc7ac2c18701dcea87c1225e5adaec

  • SSDEEP

    12288:6hN20Gv6QA4aBzBmUeoYPcaujtJ5I3v+JQa/rg8TVcw07YeFrVEYRsil6tCylB8v:6Z8vXDEFXKmJQkrrcUWsAS

Score
10/10
xmrigminerupx

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 7 IoCs
    miner
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a9f871bdf11cb7a431ad5658ad33e41_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4a9f871bdf11cb7a431ad5658ad33e41_JaffaCakes118.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:232
    • C:\Users\Admin\AppData\Local\Temp\4a9f871bdf11cb7a431ad5658ad33e41_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\4a9f871bdf11cb7a431ad5658ad33e41_JaffaCakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:4792

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\4a9f871bdf11cb7a431ad5658ad33e41_JaffaCakes118.exe
          Filesize

          784KB

          MD5

          df0ad06dc8f969249f1c252484830ad2

          SHA1

          3ebd6dbf67d9a3fa55917b03fcfd8eee61a88047

          SHA256

          9cce7522e8f4d2efbcf182bdf2685dd5e742872513a94dfb60b1a41ca4d86346

          SHA512

          9f85f2faef57617114f97438a1a588bb81f9ef363d0e431f26c175b9a8279b2a671e62dfffc74625e1a5e4e40e151475e68dcda934976fe56b1bc320b174f856

          Download Submit

        • memory/232-0-0x0000000000400000-0x0000000000712000-memory.dmp

          Filesize

          3.1MB

          Download

        • memory/232-1-0x0000000001720000-0x00000000017E4000-memory.dmp

          Filesize

          784KB

          Download

        • memory/232-2-0x0000000000400000-0x0000000000593000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/232-12-0x0000000000400000-0x0000000000593000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/4792-13-0x0000000000400000-0x0000000000712000-memory.dmp

          Filesize

          3.1MB

          Download

        • memory/4792-14-0x0000000001AE0000-0x0000000001BA4000-memory.dmp

          Filesize

          784KB

          Download

        • memory/4792-15-0x0000000000400000-0x0000000000593000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/4792-20-0x0000000005350000-0x00000000054E3000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/4792-21-0x0000000000400000-0x0000000000587000-memory.dmp

          Filesize

          1.5MB

          Download

        • memory/4792-30-0x00000000005A0000-0x000000000071F000-memory.dmp

          Filesize

          1.5MB

          Download

        • memory/4792-31-0x0000000000400000-0x0000000000587000-memory.dmp

          Filesize

          1.5MB

          Download