Overview
The SonicWall Capture Labs threat research team analyzed a malware purporting to be a Java utility. It arrives as an installer for Java Access Bridge, but ultimately installs the popular open-source cryptominer, XMRig.
Infection Cycle
The sample arrives as a Windows installer package (msi) file using the following file name:
- JavaAccessBridge-64.msi
Figure 1: Malware installer’s file properties showing Java Access Bridge
Upon execution, a typical installation window pops up.
Figure 2: Fake Java Access Bridge installation window
Meanwhile, the following files are created in these directories:
- /User/Public/Music/ContentStore.bat
- /User/Public/Music/DMIDD11.tmp (certificate file)
- /User/Public/Music/DMIDD12.tmp (certificate file)
- /User/Public/Music/DMIDD13.tmp (certificate file)
- /User/Public/Music/DMIDD14.tmp (certificate file)
- /User/Public/Videos/JavaAccessBridge-64.exe (main XMRig executable)
- /User/Public/Videos/config.json (miner config file)
- /User/Public/Videos/WinRing0x64.sys (WinRing0 driver file used by XMRig)
The Windows command prompt utility is then spawned to execute the batch file name ContentStore.bat which runs the commands seen on the screenshot below.
Figure 3: Contents of the batch file ContentStore.bat
The .tmp files created are all certificate files as shown in the screenshot below.
Figure 4: DMIDD14.tmp contains a certificate
The main cryptominer file is then executed via the command line.
Figure 5: Initial execution of JavaAccessBridge-64.exe via the command line.
XMRig is ran using the configuration in the config.json file.
Figure 6: Configuration in the config.json file
Figure 7: XMRig window running in the background
We urge our users to only use official and reputable websites as their source for software downloads. Always be vigilant and cautious when installing software programs – particularly if you are not certain of the source.
SonicWall Protections
SonicWall Capture Labs provides protection against this threat via the following signatures:
- GAV: Malagent.JAV (Trojan)
- GAV: XMRig.XMR_4 (Trojan)
This threat is also detected by SonicWall Capture ATP w/RTDMI and Capture Client endpoint solutions.
Source: Original Post
MITRE TTP :
Initial Access
- T1566.001 Phishing: Spearphishing Attachment: The malware is distributed via a Windows installer package (msi) file, pretending to be a legitimate Java Access Bridge installer. This can be considered a form of spearphishing where the attacker aims to trick the user into executing the malicious installer.
Execution
- T1204.002 User Execution: Malicious File: The user initiates the infection process by executing the fake Java Access Bridge installer, leading to the installation and execution of the XMRig cryptominer.
Persistence
- T1053.005 Scheduled Task/Job: Scheduled Task: The malware creates a batch file,
ContentStore.bat, and uses scheduled tasks to ensure the persistence of the cryptominer on the infected system.
Privilege Escalation
- T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control: By spawning the Windows command prompt utility and executing commands through a batch file, the malware may attempt to bypass User Account Control (UAC) to execute with higher privileges.
Defense Evasion
- T1140 Deobfuscate/Decode Files or Information: The malware deploys certificate files (
.tmp) and uses them possibly to obfuscate its actions or to bypass security measures. - T1027 Obfuscated Files or Information: The use of a seemingly legitimate Java utility installer as a cover for the cryptominer installation.
Credential Access
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers: While not explicitly detailed in the analysis, cryptominers like XMRig can be configured or paired with additional components to steal credentials, including those stored in web browsers, to further propagate or exploit resources.
Impact
- T1496 Resource Hijacking: By installing XMRig, the malware hijacks the system’s resources, specifically the CPU/GPU power, to mine cryptocurrency without the user’s consent, leading to potential degradation of system performance and increased energy costs.
Mitigation
- M1053 Data Backup: Ensure regular backups of critical data to mitigate the impact of a compromise.
- M1047 Audit: Regularly audit installations and system processes for unexpected or unauthorized applications.
- M1031 Network Intrusion Prevention: Utilize network intrusion prevention systems to detect and prevent the execution of malicious payloads.
- M1050 User Training: Train users to recognize phishing attempts and the importance of downloading software from official and reputable sources.