Resubmissions

03-02-2021 01:29

210203-m1z3hkw9jj 10

21-01-2021 07:07

210121-q1t8nw8wae 10

General

  • Target

    ca11a2960b914f9e95a38cfa78aaa6e8.exe

  • Size

    41KB

  • Sample

    210203-m1z3hkw9jj

  • MD5

    ca11a2960b914f9e95a38cfa78aaa6e8

  • SHA1

    ce2d58587cc3d36a3506a9f65bf9aaf41eb520e7

  • SHA256

    2dc0e02fcc1a56c81903905869a396f328813e63eba46f941ff3379430e12d12

  • SHA512

    8eaf1db319fd78518d653cf827881a5c303efb37a90ddd8792f99e1af092cd4666b8ef4d651323eb2fcc32d74921171c15a80f250600fb9e4aa0d77a4cac698a

Malware Config

Targets

    • Target

      ca11a2960b914f9e95a38cfa78aaa6e8.exe

    • Size

      41KB

    • MD5

      ca11a2960b914f9e95a38cfa78aaa6e8

    • SHA1

      ce2d58587cc3d36a3506a9f65bf9aaf41eb520e7

    • SHA256

      2dc0e02fcc1a56c81903905869a396f328813e63eba46f941ff3379430e12d12

    • SHA512

      8eaf1db319fd78518d653cf827881a5c303efb37a90ddd8792f99e1af092cd4666b8ef4d651323eb2fcc32d74921171c15a80f250600fb9e4aa0d77a4cac698a

    • Phorphiex Payload

    • Phorphiex Worm

      Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    • Windows security bypass

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Disabling Security Tools

2
T1089

Modify Registry

3
T1112

Tasks