Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

JaffaCakes...7b.exe

windows7-x64

10

JaffaCakes...7b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2024, 04:12 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_c10db5d9e11b8b7d653e7de0a5089f53889f91bb84573377fc13b72dfd87c67b.exe

  • Size

    6.0MB

  • MD5

    a2f60ba4659068ef7d9f0f7082a8cf9c

  • SHA1

    f1b38c4bb3b53b8bc0520075aefe6685b291be94

  • SHA256

    c10db5d9e11b8b7d653e7de0a5089f53889f91bb84573377fc13b72dfd87c67b

  • SHA512

    216ea0edafbf9954785b8a45a7acea44a06c5d3199c53e537eb7e6a6432e1ed96cf1e650c782df5a9d94d587d1f5ebfcf8531482c304c774fd1327b22a06732d

  • SSDEEP

    98304:EniLf9FdfE0pZB156utgpPFotBER/mQ32lUU:eOl56utgpPF8u/7U

Score
10/10
xmrigminerupx

Malware Config

Signatures

  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 2 IoCs
    miner
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c10db5d9e11b8b7d653e7de0a5089f53889f91bb84573377fc13b72dfd87c67b.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c10db5d9e11b8b7d653e7de0a5089f53889f91bb84573377fc13b72dfd87c67b.exe"
    1⤵
      PID:4628

    Network

    • flag-us
      DNS
      20.49.80.91.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      20.49.80.91.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      13.86.106.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.86.106.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      2.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      2.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      197.87.175.4.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      197.87.175.4.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      171.39.242.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      171.39.242.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      181.129.81.91.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      181.129.81.91.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      86.49.80.91.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      86.49.80.91.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      11.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      11.227.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      79.239.69.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      79.239.69.13.in-addr.arpa
      IN PTR
      Response
    No results found
    • 8.8.8.8:53
      20.49.80.91.in-addr.arpa
      dns
      70 B
       145 B
       1
      1

      DNS Request

      20.49.80.91.in-addr.arpa

    • 8.8.8.8:53
      13.86.106.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      13.86.106.20.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      2.159.190.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      2.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      197.87.175.4.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      197.87.175.4.in-addr.arpa

    • 8.8.8.8:53
      171.39.242.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      171.39.242.20.in-addr.arpa

    • 8.8.8.8:53
      181.129.81.91.in-addr.arpa
      dns
      72 B
       147 B
       1
      1

      DNS Request

      181.129.81.91.in-addr.arpa

    • 8.8.8.8:53
      86.49.80.91.in-addr.arpa
      dns
      70 B
       145 B
       1
      1

      DNS Request

      86.49.80.91.in-addr.arpa

    • 8.8.8.8:53
      11.227.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      11.227.111.52.in-addr.arpa

    • 8.8.8.8:53
      79.239.69.13.in-addr.arpa
      dns
      71 B
       145 B
       1
      1

      DNS Request

      79.239.69.13.in-addr.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4628-0-0x00007FF6160B0000-0x00007FF616404000-memory.dmp

      Filesize

      3.3MB

      Download

    • memory/4628-1-0x00007FF6160B0000-0x00007FF616404000-memory.dmp

      Filesize

      3.3MB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.