xmrig | f18d36bb289aa0eadf91295fa3c3a1733525a8e715909ff76a00140351d77d5c

Analysis

max time kernel
100s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-08-2024 10:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aed1b4b03691dc7d76cba0eea5d67d7a_JaffaCakes118.exe
Size

784KB
MD5

aed1b4b03691dc7d76cba0eea5d67d7a
SHA1

4f4bc868147be01c2ef1ba734c048ad88427034b
SHA256

f18d36bb289aa0eadf91295fa3c3a1733525a8e715909ff76a00140351d77d5c
SHA512

fc4de255d6fd37736f5ed27d229e6a668c3081038b78f18814618521baa44707bfeb967bd0f181cce1c43bfd481a1af8d42f76266add20b0089a157f7e698b18
SSDEEP

24576:sM/aJ1Bh5K+EaWPrC3pqeY9WUT21yI9Szs3jXtYAO3:sM/oksWWDYYUT21Ys3jtO

Score

10^/10

xmrig discovery miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral2/memory/3048-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/3048-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2060-15-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/2060-29-0x0000000005330000-0x00000000054C3000-memory.dmp	xmrig
behavioral2/memory/2060-30-0x00000000005A0000-0x000000000071F000-memory.dmp	xmrig
behavioral2/memory/2060-31-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/2060-20-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
2060	aed1b4b03691dc7d76cba0eea5d67d7a_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2060	aed1b4b03691dc7d76cba0eea5d67d7a_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3048-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x00080000000234fc-11.dat	upx
behavioral2/memory/2060-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aed1b4b03691dc7d76cba0eea5d67d7a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aed1b4b03691dc7d76cba0eea5d67d7a_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3048	aed1b4b03691dc7d76cba0eea5d67d7a_JaffaCakes118.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3048	aed1b4b03691dc7d76cba0eea5d67d7a_JaffaCakes118.exe
2060	aed1b4b03691dc7d76cba0eea5d67d7a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2060	3048	aed1b4b03691dc7d76cba0eea5d67d7a_JaffaCakes118.exe	87
PID 3048 wrote to memory of 2060	3048	aed1b4b03691dc7d76cba0eea5d67d7a_JaffaCakes118.exe	87
PID 3048 wrote to memory of 2060	3048	aed1b4b03691dc7d76cba0eea5d67d7a_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\aed1b4b03691dc7d76cba0eea5d67d7a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aed1b4b03691dc7d76cba0eea5d67d7a_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Users\Admin\AppData\Local\Temp\aed1b4b03691dc7d76cba0eea5d67d7a_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\aed1b4b03691dc7d76cba0eea5d67d7a_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aed1b4b03691dc7d76cba0eea5d67d7a_JaffaCakes118.exe

Filesize
784KB

MD5
bcc8ef49ba2f4b323eeda99b3014ca33

SHA1
af63ba38e4f9a36c6cfe3741e44a78828b5f769d

SHA256
53be36dcdaaacd8927baa8f949d82ea1f46901bb978b5565518e5386076befa8

SHA512
cf1326a91918c1a3e28eb869cc0d29f8ee1f836bcc47564ece358a6d5f9b572a61511dee53943133f245caeffbb305146c7e0345838f2cef295186a55a787fb0

Download Submit
memory/2060-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/2060-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2060-14-0x0000000001AC0000-0x0000000001B84000-memory.dmp

Filesize
784KB

Download
memory/2060-29-0x0000000005330000-0x00000000054C3000-memory.dmp

Filesize
1.6MB

Download
memory/2060-30-0x00000000005A0000-0x000000000071F000-memory.dmp

Filesize
1.5MB

Download
memory/2060-31-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/2060-20-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/3048-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/3048-1-0x0000000001720000-0x00000000017E4000-memory.dmp

Filesize
784KB

Download
memory/3048-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/3048-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download