xmrig | 761a53d3e9f1b25c9d4205787a462ce59609fd00fbe5a9b3137df51d5677fd49 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

03c113b2dc...18.exe

windows7-x64

03c113b2dc...18.exe

windows10-2004-x64

Sharing

General

Target

03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118
Size

2.2MB
Sample

240728-awqt6axdkn
MD5

03c113b2dc2ebd2e7014fbd723bdad45
SHA1

a0524d7f3c77dd8ea6ba60f831272bd676de93b4
SHA256

761a53d3e9f1b25c9d4205787a462ce59609fd00fbe5a9b3137df51d5677fd49
SHA512

f781b4a673edc11f64446e7f56f64e89c8cd59a18dd51cd6810b195e028390d53490517c48a53806d05d3f085ba39ec44eda34f6e1c896a48539cf346b8b3ae2
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9cw+:NABF

Score

10^/10

xmrig execution miner persistence privilege_escalation upx

Static task

static1

upx miner xmrig

4 signatures

Behavioral task

behavioral1

Sample

03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe

Resource

win7-20240705-en

xmrig execution miner persistence privilege_escalation upx

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118.exe

Resource

win10v2004-20240709-en

xmrig execution miner upx

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  03c113b2dc2ebd2e7014fbd723bdad45_JaffaCakes118
- Size
  
  2.2MB
- MD5
  
  03c113b2dc2ebd2e7014fbd723bdad45
- SHA1
  
  a0524d7f3c77dd8ea6ba60f831272bd676de93b4
- SHA256
  
  761a53d3e9f1b25c9d4205787a462ce59609fd00fbe5a9b3137df51d5677fd49
- SHA512
  
  f781b4a673edc11f64446e7f56f64e89c8cd59a18dd51cd6810b195e028390d53490517c48a53806d05d3f085ba39ec44eda34f6e1c896a48539cf346b8b3ae2
- SSDEEP
  
  49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9cw+:NABF
Score

10^/10

xmrig execution miner persistence privilege_escalation upx
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Event Triggered Execution

Accessibility Features

Privilege Escalation

Event Triggered Execution

Accessibility Features

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

xmrigexecutionminerpersistenceprivilege_escalationupx

behavioral2

xmrigexecutionminerupx

© 2018-2025

Terms | Privacy