Analysis

  • max time kernel
    65s
  • max time network
    115s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    05-11-2020 20:58

General

  • Target

    pcnew.exe

  • Size

    20KB

  • MD5

    1f8cef7b1f327e19ec561d1b80583d2d

  • SHA1

    96795527c65711c13aef7f2cda3b5a0ff5779137

  • SHA256

    c6ee0c5549619ebf81f7878da18a6e29ff315be7d0fb3d9b79b84717405c87f6

  • SHA512

    2bdb59b8ca921b7def3547c622a4357398566c475ed1c77aad4fe91f1171ddee1b0d3524463ead12a10bba19fb5e23dcad3b00e948c8bde585d315906fd782e2

Malware Config

Extracted

Path

C:\115802396715453\Read_Me.txt

Ransom Note
Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://25xb3kc6azicbbuo.onion/?IJLMOQRT 5. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. Alternate communication channel here: http://helpqvrg3cc5mvb3.onion/
URLs

http://25xb3kc6azicbbuo.onion/?IJLMOQRT

http://helpqvrg3cc5mvb3.onion/

Signatures

  • Phorphiex Worm

    Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

  • Windows security bypass 2 TTPs
  • Executes dropped EXE 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs
  • Windows security modification 2 TTPs 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 26 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 9086 IoCs
  • Modifies Control Panel 5 IoCs
  • Modifies registry class 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 4090 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of FindShellTrayWindow 15 IoCs
  • Suspicious use of SendNotifyMessage 11 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\pcnew.exe
    "C:\Users\Admin\AppData\Local\Temp\pcnew.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:636
    • C:\115802396715453\winsvcs.exe
      C:\115802396715453\winsvcs.exe
      2⤵
      • Executes dropped EXE
      • Windows security modification
      • Suspicious use of WriteProcessMemory
      PID:192
      • C:\Users\Admin\AppData\Local\Temp\3259625056.exe
        C:\Users\Admin\AppData\Local\Temp\3259625056.exe
        3⤵
        • Executes dropped EXE
        • Drops desktop.ini file(s)
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        PID:788
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Enumerates connected drives
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3056
  • C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
    "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
    1⤵
    • Modifies Control Panel
    • Suspicious use of SetWindowsHookEx
    PID:1700
  • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
    1⤵
    • Modifies Control Panel
    • Suspicious use of SetWindowsHookEx
    PID:3804

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\115802396715453\winsvcs.exe

    MD5

    1f8cef7b1f327e19ec561d1b80583d2d

    SHA1

    96795527c65711c13aef7f2cda3b5a0ff5779137

    SHA256

    c6ee0c5549619ebf81f7878da18a6e29ff315be7d0fb3d9b79b84717405c87f6

    SHA512

    2bdb59b8ca921b7def3547c622a4357398566c475ed1c77aad4fe91f1171ddee1b0d3524463ead12a10bba19fb5e23dcad3b00e948c8bde585d315906fd782e2

  • C:\115802396715453\winsvcs.exe

    MD5

    1f8cef7b1f327e19ec561d1b80583d2d

    SHA1

    96795527c65711c13aef7f2cda3b5a0ff5779137

    SHA256

    c6ee0c5549619ebf81f7878da18a6e29ff315be7d0fb3d9b79b84717405c87f6

    SHA512

    2bdb59b8ca921b7def3547c622a4357398566c475ed1c77aad4fe91f1171ddee1b0d3524463ead12a10bba19fb5e23dcad3b00e948c8bde585d315906fd782e2

  • C:\Users\Admin\AppData\Local\Temp\3259625056.exe

    MD5

    7d52884b375ce8b6182f1c53f0f1c496

    SHA1

    6b70e90b0dada8d93c61caa678e76ce2abcbc76b

    SHA256

    9c48e8a5f83614f685249486a13a8a132660f37d11c5f55581414dbf02091021

    SHA512

    24350255bda3672cce0ff22221e5973cd69f5b8470eb642e9679c3c006716271af8f32a2d4ee5309949c746eb9cb15bba411052fd4935a2a2b436501c7b4a515

  • C:\Users\Admin\AppData\Local\Temp\3259625056.exe

    MD5

    7d52884b375ce8b6182f1c53f0f1c496

    SHA1

    6b70e90b0dada8d93c61caa678e76ce2abcbc76b

    SHA256

    9c48e8a5f83614f685249486a13a8a132660f37d11c5f55581414dbf02091021

    SHA512

    24350255bda3672cce0ff22221e5973cd69f5b8470eb642e9679c3c006716271af8f32a2d4ee5309949c746eb9cb15bba411052fd4935a2a2b436501c7b4a515

  • \??\M:\$RECYCLE.BIN\S-1-5-21-3341490333-719741536-2920803124-1000\desktop.ini

    MD5

    a526b9e7c716b3489d8cc062fbce4005

    SHA1

    2df502a944ff721241be20a9e449d2acd07e0312

    SHA256

    e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

    SHA512

    d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

  • memory/192-0-0x0000000000000000-mapping.dmp

  • memory/788-3-0x0000000000000000-mapping.dmp

  • memory/3056-6-0x0000000007F80000-0x0000000007F81000-memory.dmp

    Filesize

    4KB