Old Miner, New Tricks

MITRE Techniques

• [T1543] Create or Modify System Process – Persistence established by registering scripts as services and scheduled tasks (“…establishes persistence by registering itself as a service” and “creates a scheduled task… to ensure persistence”).
• [T1059] Command and Scripting Interpreter – Use of VBScript and PowerShell scripts to deploy miners, disable defenses, and execute payloads (“Analysis of this sample shows… relaunches itself with elevated rights using Shell.Application…”).
• [T1086] PowerShell – Deployment of XMRig miner via PowerShell script “1.ps1” (“downloads an XMRig Monero miner… to the system’s temporary directory as sysupdate”).
• [T1110] Brute Force – Attempted privilege escalation through relaunching scripts with elevated rights (“Lcrypt0rx first checks… relaunches itself with elevated rights”).
• [T1490] Inhibit System Recovery – Deletes volume shadow copies and backup catalogs to prevent recovery (“cmd.exe /c vssadmin delete shadows /all /quietcmd.exe /c wbadmin delete catalog -quiet”).
• [T1489] Disk Wipe – Overwrites the Master Boot Record rendering the system unbootable (“proceeds to overwrite the Master Boot Record (MBR)—a destructive move”).
• [T1027] Obfuscated Files or Information – Use of XOR encryption routine with generated master key and salt (“XORs each character of the file content… producing the obfuscated output”).
• [T1499] Endpoint Denial of Service – Disables system input by remapping and disabling keyboard keys and mouse buttons (“modifies the Scancode Map registry to disable… Mouse buttons are reversed”).
• [T1562] Impair Defenses – Attempts to disable antivirus software and firewalls (“attempts to disable Windows Defender real-time protection, BitDefender, and Kaspersky” and “The firewall is disabled via netsh”).
• [T1071] Application Layer Protocol – Use of HTTP and TOR network for command-and-control and ransom note delivery (“The .onion address in the ransom note… does not conform to valid TOR address specifications”).