phorphiex | 2dc0e02fcc1a56c81903905869a396f328813e63eba46f941ff3379430e12d12

Resubmissions

03-02-2021 01:29

210203-m1z3hkw9jj 10

21-01-2021 07:07

210121-q1t8nw8wae 10

Analysis

max time kernel
150s
max time network
152s
platform
windows10_x64
resource
win10v20201028
submitted
03-02-2021 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ca11a2960b914f9e95a38cfa78aaa6e8.exe
Size

41KB
MD5

ca11a2960b914f9e95a38cfa78aaa6e8
SHA1

ce2d58587cc3d36a3506a9f65bf9aaf41eb520e7
SHA256

2dc0e02fcc1a56c81903905869a396f328813e63eba46f941ff3379430e12d12
SHA512

8eaf1db319fd78518d653cf827881a5c303efb37a90ddd8792f99e1af092cd4666b8ef4d651323eb2fcc32d74921171c15a80f250600fb9e4aa0d77a4cac698a

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Signatures

Phorphiex Payload 2 IoCs

Processes:

resource	yara_rule
C:\276982033027597\svchost.exe	family_phorphiex
C:\276982033027597\svchost.exe	family_phorphiex

Phorphiex Worm
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

2288 svchost.exe

pid	process
2288	svchost.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ca11a2960b914f9e95a38cfa78aaa6e8.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\276982033027597\\svchost.exe"	ca11a2960b914f9e95a38cfa78aaa6e8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\276982033027597\\svchost.exe"	ca11a2960b914f9e95a38cfa78aaa6e8.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ca11a2960b914f9e95a38cfa78aaa6e8.exe

description	pid	process	target process
PID 3116 wrote to memory of 2288	3116	ca11a2960b914f9e95a38cfa78aaa6e8.exe	svchost.exe
PID 3116 wrote to memory of 2288	3116	ca11a2960b914f9e95a38cfa78aaa6e8.exe	svchost.exe
PID 3116 wrote to memory of 2288	3116	ca11a2960b914f9e95a38cfa78aaa6e8.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\ca11a2960b914f9e95a38cfa78aaa6e8.exe
"C:\Users\Admin\AppData\Local\Temp\ca11a2960b914f9e95a38cfa78aaa6e8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3116

C:\276982033027597\svchost.exe
C:\276982033027597\svchost.exe
2⤵
- Executes dropped EXE
- Windows security modification
PID:2288

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\276982033027597\svchost.exe
MD5
ca11a2960b914f9e95a38cfa78aaa6e8

SHA1
ce2d58587cc3d36a3506a9f65bf9aaf41eb520e7

SHA256
2dc0e02fcc1a56c81903905869a396f328813e63eba46f941ff3379430e12d12

SHA512
8eaf1db319fd78518d653cf827881a5c303efb37a90ddd8792f99e1af092cd4666b8ef4d651323eb2fcc32d74921171c15a80f250600fb9e4aa0d77a4cac698a

Download Submit
C:\276982033027597\svchost.exe
MD5
ca11a2960b914f9e95a38cfa78aaa6e8

SHA1
ce2d58587cc3d36a3506a9f65bf9aaf41eb520e7

SHA256
2dc0e02fcc1a56c81903905869a396f328813e63eba46f941ff3379430e12d12

SHA512
8eaf1db319fd78518d653cf827881a5c303efb37a90ddd8792f99e1af092cd4666b8ef4d651323eb2fcc32d74921171c15a80f250600fb9e4aa0d77a4cac698a

Download Submit
memory/2288-2-0x0000000000000000-mapping.dmp

Download