General
- Target explorer.exe
- Size 2.5MB
- Sample260621-q6ms9aev31
- SHA256 24ea18932e24a2d80b54cc73cfe84fa75790f011b095b46fdb8eec80fa66ec5f
Score
10/10
Malware Config
Targets
-
- Target explorer.exe
- Size 2.5MB
- SHA256 24ea18932e24a2d80b54cc73cfe84fa75790f011b095b46fdb8eec80fa66ec5f
Score10/10-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Creates new service(s)
-
Executes dropped EXE
-
Stops running service(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
2Windows Service
2Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
2Windows Service
2