Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
28/07/2024, 00:35
General
-
Target
03c8fbb34c825996de1a8c005bdeb8c7_JaffaCakes118.exe
-
Size
7.6MB
-
MD5
03c8fbb34c825996de1a8c005bdeb8c7
-
SHA1
87877a6aac7019b823971ce2f07207995538863b
-
SHA256
cd34f367985b7264f2fb8fcc2728b81ebe3455a5d933313fb39da7952e1b7dc1
-
SHA512
cd806bc41c4af8baac73f285dfa4441fdb7a6baffde888671158b73976d074b04cdf29435eb5a24cbc9ac5c4685b0a9266b8a44b2c2c3463343f9c6e836ed2e4
-
SSDEEP
98304:JGxVzrQ6viczbMAIgXSYn0UL2AzZfzpvLhpLB1uV9+S99c:JMVzs6qczbJXSYnZFZbpvbLB10n99c
Score
10/10
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 7 IoCs
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 10 IoCs
-
Modifies Internet Explorer start page 1 TTPs 2 IoCs
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\03c8fbb34c825996de1a8c005bdeb8c7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\03c8fbb34c825996de1a8c005bdeb8c7_JaffaCakes118.exe"1⤵
- Drops autorun.inf file
- Drops file in Program Files directory
- Modifies Internet Explorer start page
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.7MB
-
Filesize
64KB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
8KB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
4KB
-
Filesize
12.7MB