Overview

overview

10

Static

static

a.scr

windows7_x64

10

a.scr

windows10_x64

10

Analysis

  • max time kernel
    53s
  • max time network
    130s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    05-11-2020 16:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a.scr

  • Size

    15KB

  • MD5

    ba74a7cb5a12d713229105df94a9e418

  • SHA1

    c128af146a1f7ed27d702aa6ad7600d7ca3510cb

  • SHA256

    1589137eea1bc46db43c9b9229402646773876d527585f68fd58d37add5d8402

  • SHA512

    897c3906884ec1c836831308d023fc06e3b9aa92e8ef0fe8692d66f2965fce45d63eca2a936e5a6672a28fefa4b52ae0812eacfe3b27526509a19d105aba6eee

Score
10/10
phorphiexevasionloaderpersistenceransomwaretrojanworm

Malware Config

Extracted

Path

C:\221622968119831\Read_Me.txt

Ransom Note
Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://25xb3kc6azicbbuo.onion/?DUWYZBCE 5. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. Alternate communication channel here: http://helpqvrg3cc5mvb3.onion/
URLs

http://25xb3kc6azicbbuo.onion/?DUWYZBCE

http://helpqvrg3cc5mvb3.onion/

Signatures

  • Phorphiex Worm

    Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex
  • Windows security bypass 2 TTPs
    evasiontrojan
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 4 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 876 IoCs
  • Suspicious behavior: EnumeratesProcesses 802 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a.scr
    "C:\Users\Admin\AppData\Local\Temp\a.scr" /S
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1112
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start C:\Users\Admin\AppData\Local\Temp\33137.jpg
      2⤵
        PID:3892
      • C:\Users\Admin\AppData\Local\Temp\21292.exe
        C:\Users\Admin\AppData\Local\Temp\21292.exe
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3628
        • C:\221622968119831\winsvcs.exe
          C:\221622968119831\winsvcs.exe
          3⤵
          • Executes dropped EXE
          • Windows security modification
          • Suspicious use of WriteProcessMemory
          PID:576
          • C:\Users\Admin\AppData\Local\Temp\2465529280.exe
            C:\Users\Admin\AppData\Local\Temp\2465529280.exe
            4⤵
            • Executes dropped EXE
            • Drops desktop.ini file(s)
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            PID:2072

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2072-11-0x0000000004C00000-0x0000000004CC3000-memory.dmp

      Filesize

      780KB

      Download

    • memory/2072-26-0x0000000004C00000-0x0000000004CC8000-memory.dmp

      Filesize

      800KB

      Download