18f150bc5cab780a4eaf35e198bb343497528b4095613ab48a8585c5caa937b5

General

Target

sphinx_1.0.0.0.vir.exe
Size

1.6MB
MD5

9f6d20d788c7cc43f05c30249cb743fa
SHA1

f94698dd370ff396d2203b0ce4f6c91c234d11ff
SHA256

18f150bc5cab780a4eaf35e198bb343497528b4095613ab48a8585c5caa937b5
SHA512

769a8fb1ceb96f52b73667093910f84d738155dbfe60abd90184cad8b3cd6b449f7040f7b3bf3fd825e5ddfacfb93590bb1fb98c03fb687da0d91283fb08df68

Score

8^/10

persistence

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 22 IoCs

Processes:

sphinx_1.0.0.0.vir.exeWerFault.execmd.exe

description	pid	process
Token: SeDebugPrivilege	2812	sphinx_1.0.0.0.vir.exe
Token: SeDebugPrivilege	2812	sphinx_1.0.0.0.vir.exe
Token: SeDebugPrivilege	2812	sphinx_1.0.0.0.vir.exe
Token: SeDebugPrivilege	2812	sphinx_1.0.0.0.vir.exe
Token: SeDebugPrivilege	2812	sphinx_1.0.0.0.vir.exe
Token: SeDebugPrivilege	2812	sphinx_1.0.0.0.vir.exe
Token: SeDebugPrivilege	2812	sphinx_1.0.0.0.vir.exe
Token: SeDebugPrivilege	2812	sphinx_1.0.0.0.vir.exe
Token: SeDebugPrivilege	2812	sphinx_1.0.0.0.vir.exe
Token: SeSecurityPrivilege	2812	sphinx_1.0.0.0.vir.exe
Token: SeRestorePrivilege	4004	WerFault.exe
Token: SeBackupPrivilege	4004	WerFault.exe
Token: SeDebugPrivilege	4004	WerFault.exe
Token: SeDebugPrivilege	1304	cmd.exe
Token: SeDebugPrivilege	1304	cmd.exe
Token: SeDebugPrivilege	1304	cmd.exe
Token: SeDebugPrivilege	1304	cmd.exe
Token: SeDebugPrivilege	1304	cmd.exe
Token: SeDebugPrivilege	1304	cmd.exe
Token: SeDebugPrivilege	1304	cmd.exe
Token: SeDebugPrivilege	1304	cmd.exe
Token: SeDebugPrivilege	1304	cmd.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

sphinx_1.0.0.0.vir.exe

description	pid	process	target process
PID 2812 set thread context of 3616	2812	sphinx_1.0.0.0.vir.exe	explorer.exe
PID 2812 set thread context of 1304	2812	sphinx_1.0.0.0.vir.exe	cmd.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

sphinx_1.0.0.0.vir.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Privacy	sphinx_1.0.0.0.vir.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	sphinx_1.0.0.0.vir.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

Processes:

sphinx_1.0.0.0.vir.exesphinx_1.0.0.0.vir.exeywok.exeywok.exeWerFault.execmd.exe

pid	process
2532	sphinx_1.0.0.0.vir.exe
2532	sphinx_1.0.0.0.vir.exe
2532	sphinx_1.0.0.0.vir.exe
2532	sphinx_1.0.0.0.vir.exe
2532	sphinx_1.0.0.0.vir.exe
2532	sphinx_1.0.0.0.vir.exe
2812	sphinx_1.0.0.0.vir.exe
2812	sphinx_1.0.0.0.vir.exe
3656	ywok.exe
3656	ywok.exe
3656	ywok.exe
3656	ywok.exe
3656	ywok.exe
3656	ywok.exe
2252	ywok.exe
2252	ywok.exe
4004	WerFault.exe
4004	WerFault.exe
4004	WerFault.exe
4004	WerFault.exe
4004	WerFault.exe
4004	WerFault.exe
4004	WerFault.exe
4004	WerFault.exe
4004	WerFault.exe
4004	WerFault.exe
4004	WerFault.exe
4004	WerFault.exe
4004	WerFault.exe
4004	WerFault.exe
2252	ywok.exe
2252	ywok.exe
1304	cmd.exe
1304	cmd.exe
2252	ywok.exe
2252	ywok.exe
2252	ywok.exe
2252	ywok.exe
2252	ywok.exe
2252	ywok.exe
2252	ywok.exe
2252	ywok.exe
2252	ywok.exe
2252	ywok.exe
2252	ywok.exe
2252	ywok.exe
2252	ywok.exe
2252	ywok.exe
2252	ywok.exe
2252	ywok.exe
2252	ywok.exe
2252	ywok.exe

Suspicious use of WriteProcessMemory 128 IoCs

Processes:

sphinx_1.0.0.0.vir.exesphinx_1.0.0.0.vir.exeywok.exeywok.exe

description	pid	process	target process
PID 2532 wrote to memory of 2812	2532	sphinx_1.0.0.0.vir.exe	sphinx_1.0.0.0.vir.exe
PID 2532 wrote to memory of 2812	2532	sphinx_1.0.0.0.vir.exe	sphinx_1.0.0.0.vir.exe
PID 2532 wrote to memory of 2812	2532	sphinx_1.0.0.0.vir.exe	sphinx_1.0.0.0.vir.exe
PID 2532 wrote to memory of 2812	2532	sphinx_1.0.0.0.vir.exe	sphinx_1.0.0.0.vir.exe
PID 2532 wrote to memory of 2812	2532	sphinx_1.0.0.0.vir.exe	sphinx_1.0.0.0.vir.exe
PID 2532 wrote to memory of 2812	2532	sphinx_1.0.0.0.vir.exe	sphinx_1.0.0.0.vir.exe
PID 2532 wrote to memory of 2812	2532	sphinx_1.0.0.0.vir.exe	sphinx_1.0.0.0.vir.exe
PID 2532 wrote to memory of 2812	2532	sphinx_1.0.0.0.vir.exe	sphinx_1.0.0.0.vir.exe
PID 2532 wrote to memory of 2812	2532	sphinx_1.0.0.0.vir.exe	sphinx_1.0.0.0.vir.exe
PID 2532 wrote to memory of 2812	2532	sphinx_1.0.0.0.vir.exe	sphinx_1.0.0.0.vir.exe
PID 2812 wrote to memory of 3196	2812	sphinx_1.0.0.0.vir.exe	explorer.exe
PID 2812 wrote to memory of 3196	2812	sphinx_1.0.0.0.vir.exe	explorer.exe
PID 2812 wrote to memory of 3196	2812	sphinx_1.0.0.0.vir.exe	explorer.exe
PID 2812 wrote to memory of 3616	2812	sphinx_1.0.0.0.vir.exe	explorer.exe
PID 2812 wrote to memory of 3616	2812	sphinx_1.0.0.0.vir.exe	explorer.exe
PID 2812 wrote to memory of 3616	2812	sphinx_1.0.0.0.vir.exe	explorer.exe
PID 2812 wrote to memory of 3616	2812	sphinx_1.0.0.0.vir.exe	explorer.exe
PID 2812 wrote to memory of 3616	2812	sphinx_1.0.0.0.vir.exe	explorer.exe
PID 2812 wrote to memory of 3616	2812	sphinx_1.0.0.0.vir.exe	explorer.exe
PID 2812 wrote to memory of 3616	2812	sphinx_1.0.0.0.vir.exe	explorer.exe
PID 2812 wrote to memory of 3616	2812	sphinx_1.0.0.0.vir.exe	explorer.exe
PID 2812 wrote to memory of 3616	2812	sphinx_1.0.0.0.vir.exe	explorer.exe
PID 2812 wrote to memory of 3616	2812	sphinx_1.0.0.0.vir.exe	explorer.exe
PID 2812 wrote to memory of 3616	2812	sphinx_1.0.0.0.vir.exe	explorer.exe
PID 2812 wrote to memory of 3616	2812	sphinx_1.0.0.0.vir.exe	explorer.exe
PID 2812 wrote to memory of 3616	2812	sphinx_1.0.0.0.vir.exe	explorer.exe
PID 2812 wrote to memory of 3616	2812	sphinx_1.0.0.0.vir.exe	explorer.exe
PID 2812 wrote to memory of 3616	2812	sphinx_1.0.0.0.vir.exe	explorer.exe
PID 2812 wrote to memory of 3616	2812	sphinx_1.0.0.0.vir.exe	explorer.exe
PID 2812 wrote to memory of 3616	2812	sphinx_1.0.0.0.vir.exe	explorer.exe
PID 2812 wrote to memory of 3616	2812	sphinx_1.0.0.0.vir.exe	explorer.exe
PID 2812 wrote to memory of 3616	2812	sphinx_1.0.0.0.vir.exe	explorer.exe
PID 2812 wrote to memory of 3656	2812	sphinx_1.0.0.0.vir.exe	ywok.exe
PID 2812 wrote to memory of 3656	2812	sphinx_1.0.0.0.vir.exe	ywok.exe
PID 2812 wrote to memory of 3656	2812	sphinx_1.0.0.0.vir.exe	ywok.exe
PID 3656 wrote to memory of 2252	3656	ywok.exe	ywok.exe
PID 3656 wrote to memory of 2252	3656	ywok.exe	ywok.exe
PID 3656 wrote to memory of 2252	3656	ywok.exe	ywok.exe
PID 3656 wrote to memory of 2252	3656	ywok.exe	ywok.exe
PID 3656 wrote to memory of 2252	3656	ywok.exe	ywok.exe
PID 3656 wrote to memory of 2252	3656	ywok.exe	ywok.exe
PID 3656 wrote to memory of 2252	3656	ywok.exe	ywok.exe
PID 3656 wrote to memory of 2252	3656	ywok.exe	ywok.exe
PID 3656 wrote to memory of 2252	3656	ywok.exe	ywok.exe
PID 3656 wrote to memory of 2252	3656	ywok.exe	ywok.exe
PID 2252 wrote to memory of 2792	2252	ywok.exe	sihost.exe
PID 2252 wrote to memory of 2792	2252	ywok.exe	sihost.exe
PID 2252 wrote to memory of 2792	2252	ywok.exe	sihost.exe
PID 2252 wrote to memory of 2792	2252	ywok.exe	sihost.exe
PID 2252 wrote to memory of 2792	2252	ywok.exe	sihost.exe
PID 2252 wrote to memory of 2800	2252	ywok.exe	svchost.exe
PID 2252 wrote to memory of 2800	2252	ywok.exe	svchost.exe
PID 2252 wrote to memory of 2800	2252	ywok.exe	svchost.exe
PID 2252 wrote to memory of 2800	2252	ywok.exe	svchost.exe
PID 2252 wrote to memory of 2800	2252	ywok.exe	svchost.exe
PID 2252 wrote to memory of 2852	2252	ywok.exe	taskhostw.exe
PID 2252 wrote to memory of 2852	2252	ywok.exe	taskhostw.exe
PID 2252 wrote to memory of 2852	2252	ywok.exe	taskhostw.exe
PID 2252 wrote to memory of 2852	2252	ywok.exe	taskhostw.exe
PID 2252 wrote to memory of 2852	2252	ywok.exe	taskhostw.exe
PID 2252 wrote to memory of 3008	2252	ywok.exe	Explorer.EXE
PID 2252 wrote to memory of 3008	2252	ywok.exe	Explorer.EXE
PID 2252 wrote to memory of 3008	2252	ywok.exe	Explorer.EXE
PID 2252 wrote to memory of 3008	2252	ywok.exe	Explorer.EXE

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4004 3656 WerFault.exe ywok.exe

pid	pid_target	process	target process
4004	3656	WerFault.exe	ywok.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ywok.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\Currentversion\Run	ywok.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\{348770B0-F6B7-8412-B6BB-AE4EF91B6C4C} = "C:\\Users\\Admin\\AppData\\Roaming\\Yldyi\\ywok.exe"	ywok.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

sphinx_1.0.0.0.vir.exeywok.exe

pid process

2532 sphinx_1.0.0.0.vir.exe
2532 sphinx_1.0.0.0.vir.exe
3656 ywok.exe
3656 ywok.exe
Executes dropped EXE 2 IoCs

Processes:

ywok.exeywok.exe

pid process

3656 ywok.exe
2252 ywok.exe

pid	process
3656	ywok.exe
2252	ywok.exe

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2792

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2800

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2852

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3008

C:\Users\Admin\AppData\Local\Temp\sphinx_1.0.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\sphinx_1.0.0.0.vir.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
PID:2532

C:\Users\Admin\AppData\Local\Temp\sphinx_1.0.0.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\sphinx_1.0.0.0.vir.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2812

C:\Windows\SysWOw64\explorer.exe
"C:\Windows\SysWOw64\explorer.exe"
4⤵
PID:3196

C:\Windows\SysWOw64\explorer.exe
"C:\Windows\SysWOw64\explorer.exe" socksParentProxy=localhost:9050
4⤵
PID:3616

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:3744

C:\Users\Admin\AppData\Roaming\Yldyi\ywok.exe
"C:\Users\Admin\AppData\Roaming\Yldyi\ywok.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
PID:3656

C:\Users\Admin\AppData\Roaming\Yldyi\ywok.exe
"C:\Users\Admin\AppData\Roaming\Yldyi\ywok.exe"
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Adds Run key to start application
- Executes dropped EXE
PID:2252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 276
5⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Program crash
PID:4004

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp5c8d58a4.bat"
4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1304

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
1⤵
PID:3156

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
PID:3168

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3408

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3736

C:\Program Files\Windows Mail\WinMail.exe
"C:\Program Files\Windows Mail\WinMail.exe" -Embedding
1⤵
PID:756

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5c8d58a4.bat

Download Submit
C:\Users\Admin\AppData\Roaming\Yldyi\ywok.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Yldyi\ywok.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Yldyi\ywok.exe

Download Submit
memory/1304-24-0x0000000002B1DEF3-mapping.dmp

Download
memory/1304-23-0x0000000002B00000-0x0000000002C85000-memory.dmp

Filesize
1.5MB

Download
memory/2812-1-0x0000000000400000-0x0000000000585000-memory.dmp

Filesize
1.5MB

Download
memory/2812-0-0x0000000000400000-0x0000000000585000-memory.dmp

Filesize
1.5MB

Download
memory/2812-11-0x0000000000000000-mapping.dmp

Download
memory/3196-21-0x0000000000000000-mapping.dmp

Download
memory/3616-4-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3616-22-0x0000000000401130-mapping.dmp

Download
memory/3616-3-0x0000000000401130-mapping.dmp

Download
memory/3616-2-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3656-15-0x0000000000000000-mapping.dmp

Download
memory/3656-5-0x0000000000000000-mapping.dmp

Download
memory/4004-13-0x0000000004820000-0x0000000004821000-memory.dmp

Filesize
4KB

Download
memory/4004-16-0x0000000004C60000-0x0000000004C61000-memory.dmp

Filesize
4KB

Download
memory/4004-12-0x0000000004820000-0x0000000004821000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads