Overview

overview

10

Static

static

10

JaffaCakes...4c.exe

windows7-x64

10

JaffaCakes...4c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2024 11:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_51e4856e80cf0690987cb95887169488c1533fb381795a0013e56d89aa91134c.exe

  • Size

    658KB

  • MD5

    dd2415171ce9efc6649dc685b522911e

  • SHA1

    705c73ece90ac6546148097704a4c69dbaa49432

  • SHA256

    51e4856e80cf0690987cb95887169488c1533fb381795a0013e56d89aa91134c

  • SHA512

    6ba2b38d3c4f00f795f799b90f3891be885a50f635d3c09814759722184d732eda40fb14b8cae453d4b1f296dac9f0be52db6347092d651b9817aefc7f289c01

  • SSDEEP

    12288:uIQqoPBWMROjD5EG++L2SColQf0VkXRDuGRl9eJm5Qk8iCVwV0DujIDL3/6GaCOG:uIQqoPBVROjD5EG++2gyakBD//9eJ+Cb

Score
10/10
xmrigdiscoveryminerpersistence

Malware Config

Signatures

  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 1 IoCs
    miner
  • Cryptocurrency Miner

    Makes network request to known mining pool URL.

    miner
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51e4856e80cf0690987cb95887169488c1533fb381795a0013e56d89aa91134c.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51e4856e80cf0690987cb95887169488c1533fb381795a0013e56d89aa91134c.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4460
    • C:\Users\Admin\AppData\Roaming\Microsoft\Security\mcrservice.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Security\mcrservice.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51e4856e80cf0690987cb95887169488c1533fb381795a0013e56d89aa91134c.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Security\mcrservice.exe
    Filesize

    658KB

    MD5

    dd2415171ce9efc6649dc685b522911e

    SHA1

    705c73ece90ac6546148097704a4c69dbaa49432

    SHA256

    51e4856e80cf0690987cb95887169488c1533fb381795a0013e56d89aa91134c

    SHA512

    6ba2b38d3c4f00f795f799b90f3891be885a50f635d3c09814759722184d732eda40fb14b8cae453d4b1f296dac9f0be52db6347092d651b9817aefc7f289c01

    Download Submit