General
- Target 7FAR - ZModeler 3.1.4 (build 1142).rar
- Size 16.0MB
- Sample260717-a16feacs3w
- SHA256 b7a7441abfa535108da257fd08d2fd0dc10ab017bdfd36835d2b969cab60ac5c
Malware Config
Targets
-
- Target 7FAR - ZModeler 3.1.4 (build 1142)/D3DCompiler_42.dll
- Size 1.9MB
- SHA256 6c976311406c23aa71018d274da0ecdef43b6e3a3b0b01e941a5e8e4e974386c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target 7FAR - ZModeler 3.1.4 (build 1142)/D3DX9_42.dll
- Size 1.8MB
- SHA256 f8b9cfab7fffbc8f98e41aa439d72921dc180634a1febca2a9d41a0df35d3472
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target 7FAR - ZModeler 3.1.4 (build 1142)/Engine/D3D9.zme
- Size 231KB
- SHA256 50c1f6c32c7642c37ad137899f8abc2703d4cae2cccef70b57dbe5ca8bf55369
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target 7FAR - ZModeler 3.1.4 (build 1142)/Filters/3ds.zmf
- Size 100KB
- SHA256 84e347397a2f47d4e4a94ae1f2a0e687a96f87e426874e6c0347e99121da9889
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target 7FAR - ZModeler 3.1.4 (build 1142)/Filters/BiovisionBVH.zmf
- Size 67KB
- SHA256 dd4a82a98be75ca58427dc1d364ac7716e44ca79d4ec5bca7f505d2e6ce17a7f
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target 7FAR - ZModeler 3.1.4 (build 1142)/Filters/ColladaDAE.zmf
- Size 166KB
- SHA256 1993f41a02e57629f112b36886a7ecbfd4565c5805b8c72cf018f3223f7cb31f
Score10/10-
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Creates new service(s)
-
Executes dropped EXE
-
Stops running service(s)
-
Drops file in System32 directory
-
Enumerates processes with tasklist
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target 7FAR - ZModeler 3.1.4 (build 1142)/Filters/Emergency.zmf
- Size 175KB
- SHA256 c92de16213502a11c86c52ada0d96c009caf9b85838c77c32e76e93f272eea36
Score3/10 -
- Target 7FAR - ZModeler 3.1.4 (build 1142)/Filters/GTARage.zmf
- Size 608KB
- SHA256 a2748dc057d54daf53bc7c66ef9809a9acfd516f69e632a06ecbfa5b6e1c5599
Score3/10 -
- Target 7FAR - ZModeler 3.1.4 (build 1142)/Filters/ISIgMotorGMT.zmf
- Size 155KB
- SHA256 aee84d02ba0b4454f9bd7a050c26bf9f2ac97af80570d85f62ead60f614b62e7
Score3/10 -
- Target 7FAR - ZModeler 3.1.4 (build 1142)/Filters/Mafia II.zmf
- Size 319KB
- SHA256 935ce444ec0b059c8ce6efb6d3115fef6f5b65a170cdb550f93c9fb98130dc2e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target 7FAR - ZModeler 3.1.4 (build 1142)/Filters/NFSMostWanted2.zmf
- Size 209KB
- SHA256 0c42c40021b3f92ca99b5b9cf04a5bd71d57394e8f2ba439bdaf3bbbef64dd6a
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target 7FAR - ZModeler 3.1.4 (build 1142)/Filters/OMSI.zmf
- Size 66KB
- SHA256 36643fec62685de7c9a46163b7e0e49795e6ef55b10232f3779a645fac32d073
Score3/10 -
- Target 7FAR - ZModeler 3.1.4 (build 1142)/Filters/SCS Soft Prism3D.zmf
- Size 355KB
- SHA256 3f83d7638a1c6fe130c4ee2aa2e77ac906a40f83a16c93f0bcb9c0dc4b629a7e
Score3/10 -
- Target 7FAR - ZModeler 3.1.4 (build 1142)/Filters/Sims3Workshop.zmf
- Size 100KB
- SHA256 1319bdb11df0bfa32ddbe4be5fc5177972da202cecd7c36b8e667b1cfaa8cfee
Score3/10 -
- Target 7FAR - ZModeler 3.1.4 (build 1142)/Filters/SlightlyMadStudios.zmf
- Size 208KB
- SHA256 8a3b000f914157deb34231dd83c7770134fe534adef29c16d4e0d741c3d9f804
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target 7FAR - ZModeler 3.1.4 (build 1142)/Filters/WatchDogs.zmf
- Size 400KB
- SHA256 d2f66b658d2adcc48024d84359aaa12b5fd999e2e7715351a29102cb4512078c
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
2Windows Service
2