General
-
Target
a6f14fa7448438b1d2b9889a80083482_JaffaCakes118
-
Size
1.5MB
-
Sample
240818-rdhjhazcpm
-
MD5
a6f14fa7448438b1d2b9889a80083482
-
SHA1
36630b6e5409f537370fa3b372207fdb309b171e
-
SHA256
278a58bb465d2be7b99ecd5dbd5e47d7c185351f7c125401f2d5f95e220f791c
-
SHA512
1183f21255ac3dd1fe21b7dd820e42b352dc412b36aa910921f1bf10f54d76dabac27a4e46f8977cbc8078d81146ffca9fa5870b8bf28e8b4c2171b706aa921e
-
SSDEEP
24576:JanwhSe11QSONCpGJCjETPlGC78XIO6zRIhRmuSOVehqHpYlTdNnS:knw9oUUEEDlGUh+hNg7T/S
Malware Config
Targets
-
-
Target
a6f14fa7448438b1d2b9889a80083482_JaffaCakes118
-
Size
1.5MB
-
MD5
a6f14fa7448438b1d2b9889a80083482
-
SHA1
36630b6e5409f537370fa3b372207fdb309b171e
-
SHA256
278a58bb465d2be7b99ecd5dbd5e47d7c185351f7c125401f2d5f95e220f791c
-
SHA512
1183f21255ac3dd1fe21b7dd820e42b352dc412b36aa910921f1bf10f54d76dabac27a4e46f8977cbc8078d81146ffca9fa5870b8bf28e8b4c2171b706aa921e
-
SSDEEP
24576:JanwhSe11QSONCpGJCjETPlGC78XIO6zRIhRmuSOVehqHpYlTdNnS:knw9oUUEEDlGUh+hNg7T/S
Score10/10-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Loads dropped DLL
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Accessibility Features
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Accessibility Features
1