Static

static

Photo-125-137.jpg.scr

windows7_x64

10

Photo-125-137.jpg.scr

windows10_x64

10

Analysis

  • max time kernel
    80s
  • max time network
    121s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    03-11-2020 23:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Photo-125-137.jpg.scr

Score
10/10
phorphiexevasionloaderpersistenceransomwaretrojanworm

Malware Config

Extracted

Path

C:\7129197363678\Read_Me.txt

Ransom Note
Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://25xb3kc6azicbbuo.onion/?XPQSTVXY 5. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. Alternate communication channel here: http://helpqvrg3cc5mvb3.onion/
URLs

http://25xb3kc6azicbbuo.onion/?XPQSTVXY

http://helpqvrg3cc5mvb3.onion/

Signatures

  • Phorphiex Worm

    Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex
  • Windows security bypass 2 TTPs
    evasiontrojan
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 4 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 554 IoCs
  • Suspicious behavior: EnumeratesProcesses 710 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Photo-125-137.jpg.scr
    "C:\Users\Admin\AppData\Local\Temp\Photo-125-137.jpg.scr" /S
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3968
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start C:\Users\Admin\AppData\Local\Temp\39383.jpg
      2⤵
        PID:3584
      • C:\Users\Admin\AppData\Local\Temp\16667.exe
        C:\Users\Admin\AppData\Local\Temp\16667.exe
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3920
        • C:\7129197363678\winsvcs.exe
          C:\7129197363678\winsvcs.exe
          3⤵
          • Executes dropped EXE
          • Windows security modification
          • Suspicious use of WriteProcessMemory
          PID:2148
          • C:\Users\Admin\AppData\Local\Temp\1137032943.exe
            C:\Users\Admin\AppData\Local\Temp\1137032943.exe
            4⤵
            • Executes dropped EXE
            • Drops desktop.ini file(s)
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            PID:3828

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3828-13-0x0000000005390000-0x0000000005461000-memory.dmp

      Filesize

      836KB

      Download