Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
23-03-2021 14:19
Static task
static1
Behavioral task
behavioral1
Sample
1470026921.bin.exe
Resource
win7v20201028
General
-
Target
1470026921.bin.exe
-
Size
34KB
-
MD5
7e1691cf656c781f65a949622ac97177
-
SHA1
6ba004c81c1c8d0d15b6870ed5e8ade812c30840
-
SHA256
36c678b6312352751cf9943e5ed413e9e670ae33fe17aae338b14f9f2c18ef75
-
SHA512
76686d9126bb2b888231204206848d36c82c4541a1d9f94a2f17e1482cf9d4df5c7b48605db66922ee0de58151121f3bbc02eeb74eb89e67ec64900af889591a
Malware Config
Signatures
-
Phorphiex Payload 3 IoCs
Processes:
resource yara_rule \16347122022814\lsass.exe family_phorphiex C:\16347122022814\lsass.exe family_phorphiex C:\16347122022814\lsass.exe family_phorphiex -
Executes dropped EXE 1 IoCs
Processes:
lsass.exepid process 1036 lsass.exe -
Loads dropped DLL 1 IoCs
Processes:
1470026921.bin.exepid process 1964 1470026921.bin.exe -
Processes:
lsass.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" lsass.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
1470026921.bin.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\16347122022814\\lsass.exe" 1470026921.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\16347122022814\\lsass.exe" 1470026921.bin.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
1470026921.bin.exedescription pid process target process PID 1964 wrote to memory of 1036 1964 1470026921.bin.exe lsass.exe PID 1964 wrote to memory of 1036 1964 1470026921.bin.exe lsass.exe PID 1964 wrote to memory of 1036 1964 1470026921.bin.exe lsass.exe PID 1964 wrote to memory of 1036 1964 1470026921.bin.exe lsass.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1470026921.bin.exe"C:\Users\Admin\AppData\Local\Temp\1470026921.bin.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\16347122022814\lsass.exeC:\16347122022814\lsass.exe2⤵
- Executes dropped EXE
- Windows security modification
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\16347122022814\lsass.exeMD5
7e1691cf656c781f65a949622ac97177
SHA16ba004c81c1c8d0d15b6870ed5e8ade812c30840
SHA25636c678b6312352751cf9943e5ed413e9e670ae33fe17aae338b14f9f2c18ef75
SHA51276686d9126bb2b888231204206848d36c82c4541a1d9f94a2f17e1482cf9d4df5c7b48605db66922ee0de58151121f3bbc02eeb74eb89e67ec64900af889591a
-
C:\16347122022814\lsass.exeMD5
7e1691cf656c781f65a949622ac97177
SHA16ba004c81c1c8d0d15b6870ed5e8ade812c30840
SHA25636c678b6312352751cf9943e5ed413e9e670ae33fe17aae338b14f9f2c18ef75
SHA51276686d9126bb2b888231204206848d36c82c4541a1d9f94a2f17e1482cf9d4df5c7b48605db66922ee0de58151121f3bbc02eeb74eb89e67ec64900af889591a
-
\16347122022814\lsass.exeMD5
7e1691cf656c781f65a949622ac97177
SHA16ba004c81c1c8d0d15b6870ed5e8ade812c30840
SHA25636c678b6312352751cf9943e5ed413e9e670ae33fe17aae338b14f9f2c18ef75
SHA51276686d9126bb2b888231204206848d36c82c4541a1d9f94a2f17e1482cf9d4df5c7b48605db66922ee0de58151121f3bbc02eeb74eb89e67ec64900af889591a
-
memory/752-3-0x000007FEF6E90000-0x000007FEF710A000-memory.dmpFilesize
2.5MB
-
memory/1036-5-0x0000000000000000-mapping.dmp
-
memory/1964-2-0x00000000750C1000-0x00000000750C3000-memory.dmpFilesize
8KB