Analysis
-
max time kernel
113s -
max time network
111s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
12-05-2021 01:07
Static task
static1
Behavioral task
behavioral1
Sample
0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exe
Resource
win7v20210408
General
-
Target
0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exe
-
Size
949KB
-
MD5
1daca30b2b6c0ef60e02df04e656e990
-
SHA1
c1f6f1e1a27e7be32a3f18440c05951fa7e52eb9
-
SHA256
0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184
-
SHA512
7f547f46e21ffe3c764050b081621c5df5046be118eb2765e546ce3fa3c3ed7541dbe0dc4deca85c682a1122d78a528614eac6c6684adcfae5e2f215f3651b52
Malware Config
Signatures
-
Phorphiex Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1824-62-0x0000000000400000-0x00000000004EED90-memory.dmp family_phorphiex -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 1176 svchost.exe -
Loads dropped DLL 4 IoCs
Processes:
0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exeWerFault.exepid process 1824 0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exe 628 WerFault.exe 628 WerFault.exe 628 WerFault.exe -
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" svchost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Service Driver = "C:\\Windows\\20572149116002\\svchost.exe" 0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Service Driver = "C:\\Windows\\20572149116002\\svchost.exe" 0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exe -
Drops file in Program Files directory 3 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7zfm.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zg.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7z.exe svchost.exe -
Drops file in Windows directory 3 IoCs
Processes:
0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exedescription ioc process File opened for modification C:\Windows\20572149116002 0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exe File created C:\Windows\20572149116002\svchost.exe 0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exe File opened for modification C:\Windows\20572149116002\svchost.exe 0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 628 1176 WerFault.exe svchost.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
WerFault.exepid process 628 WerFault.exe 628 WerFault.exe 628 WerFault.exe 628 WerFault.exe 628 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 628 WerFault.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exesvchost.exedescription pid process target process PID 1824 wrote to memory of 1176 1824 0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exe svchost.exe PID 1824 wrote to memory of 1176 1824 0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exe svchost.exe PID 1824 wrote to memory of 1176 1824 0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exe svchost.exe PID 1824 wrote to memory of 1176 1824 0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exe svchost.exe PID 1176 wrote to memory of 628 1176 svchost.exe WerFault.exe PID 1176 wrote to memory of 628 1176 svchost.exe WerFault.exe PID 1176 wrote to memory of 628 1176 svchost.exe WerFault.exe PID 1176 wrote to memory of 628 1176 svchost.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exe"C:\Users\Admin\AppData\Local\Temp\0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\20572149116002\svchost.exeC:\Windows\20572149116002\svchost.exe2⤵
- Executes dropped EXE
- Windows security modification
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 8483⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\20572149116002\svchost.exeMD5
1daca30b2b6c0ef60e02df04e656e990
SHA1c1f6f1e1a27e7be32a3f18440c05951fa7e52eb9
SHA2560a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184
SHA5127f547f46e21ffe3c764050b081621c5df5046be118eb2765e546ce3fa3c3ed7541dbe0dc4deca85c682a1122d78a528614eac6c6684adcfae5e2f215f3651b52
-
C:\Windows\20572149116002\svchost.exeMD5
1daca30b2b6c0ef60e02df04e656e990
SHA1c1f6f1e1a27e7be32a3f18440c05951fa7e52eb9
SHA2560a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184
SHA5127f547f46e21ffe3c764050b081621c5df5046be118eb2765e546ce3fa3c3ed7541dbe0dc4deca85c682a1122d78a528614eac6c6684adcfae5e2f215f3651b52
-
\Windows\20572149116002\svchost.exeMD5
1daca30b2b6c0ef60e02df04e656e990
SHA1c1f6f1e1a27e7be32a3f18440c05951fa7e52eb9
SHA2560a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184
SHA5127f547f46e21ffe3c764050b081621c5df5046be118eb2765e546ce3fa3c3ed7541dbe0dc4deca85c682a1122d78a528614eac6c6684adcfae5e2f215f3651b52
-
\Windows\20572149116002\svchost.exeMD5
1daca30b2b6c0ef60e02df04e656e990
SHA1c1f6f1e1a27e7be32a3f18440c05951fa7e52eb9
SHA2560a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184
SHA5127f547f46e21ffe3c764050b081621c5df5046be118eb2765e546ce3fa3c3ed7541dbe0dc4deca85c682a1122d78a528614eac6c6684adcfae5e2f215f3651b52
-
\Windows\20572149116002\svchost.exeMD5
1daca30b2b6c0ef60e02df04e656e990
SHA1c1f6f1e1a27e7be32a3f18440c05951fa7e52eb9
SHA2560a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184
SHA5127f547f46e21ffe3c764050b081621c5df5046be118eb2765e546ce3fa3c3ed7541dbe0dc4deca85c682a1122d78a528614eac6c6684adcfae5e2f215f3651b52
-
\Windows\20572149116002\svchost.exeMD5
1daca30b2b6c0ef60e02df04e656e990
SHA1c1f6f1e1a27e7be32a3f18440c05951fa7e52eb9
SHA2560a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184
SHA5127f547f46e21ffe3c764050b081621c5df5046be118eb2765e546ce3fa3c3ed7541dbe0dc4deca85c682a1122d78a528614eac6c6684adcfae5e2f215f3651b52
-
memory/628-70-0x0000000000000000-mapping.dmp
-
memory/628-74-0x0000000000240000-0x00000000002A0000-memory.dmpFilesize
384KB
-
memory/1176-64-0x0000000000000000-mapping.dmp
-
memory/1176-67-0x0000000002110000-0x000000000212D000-memory.dmpFilesize
116KB
-
memory/1824-62-0x0000000000400000-0x00000000004EED90-memory.dmpFilesize
955KB
-
memory/1824-60-0x0000000075D51000-0x0000000075D53000-memory.dmpFilesize
8KB
-
memory/1824-61-0x0000000001EC0000-0x0000000001EDD000-memory.dmpFilesize
116KB