Modifies security service

Phorphiex payload

Phorphiex, Phorpiex

Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

Suspicious use of NtCreateUserProcessOtherParentProcess

Windows security bypass

xmrig

XMRig is a high performance, open source, cross platform CPU/GPU miner.

XMRig Miner payload

Command and Scripting Interpreter: PowerShell

Using powershell.exe command.

Command and Scripting Interpreter: PowerShell

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

Downloads MZ/PE file

Stops running service(s)