General
- Target file.exe
- Size 8.9MB
- Sample260623-rb2jladv4w
- SHA256 f8caf4ff7737a95efeafb2ca3b219a79afd39736b02289c38eca6f46860bc181
Malware Config
Targets
-
- Target file.exe
- Size 8.9MB
- SHA256 f8caf4ff7737a95efeafb2ca3b219a79afd39736b02289c38eca6f46860bc181
Score10/10-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Creates new service(s)
-
Executes dropped EXE
-
Stops running service(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
2Windows Service
2Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
2Windows Service
2Defense Evasion
Impair Defenses
1Modify Registry
3Subvert Trust Controls
2Install Root Certificate
2