Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
12-05-2021 01:07
Static task
static1
Behavioral task
behavioral1
Sample
0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exe
Resource
win7v20210408
General
-
Target
0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exe
-
Size
949KB
-
MD5
1daca30b2b6c0ef60e02df04e656e990
-
SHA1
c1f6f1e1a27e7be32a3f18440c05951fa7e52eb9
-
SHA256
0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184
-
SHA512
7f547f46e21ffe3c764050b081621c5df5046be118eb2765e546ce3fa3c3ed7541dbe0dc4deca85c682a1122d78a528614eac6c6684adcfae5e2f215f3651b52
Malware Config
Signatures
-
Phorphiex Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1696-115-0x0000000000400000-0x00000000004EED90-memory.dmp family_phorphiex -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 3464 svchost.exe -
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" svchost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Service Driver = "C:\\Windows\\11874895816198\\svchost.exe" 0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Service Driver = "C:\\Windows\\11874895816198\\svchost.exe" 0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exe -
Drops file in Program Files directory 3 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7zfm.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zg.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7z.exe svchost.exe -
Drops file in Windows directory 3 IoCs
Processes:
0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exedescription ioc process File created C:\Windows\11874895816198\svchost.exe 0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exe File opened for modification C:\Windows\11874895816198\svchost.exe 0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exe File opened for modification C:\Windows\11874895816198 0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2740 3464 WerFault.exe svchost.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
WerFault.exepid process 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 2740 WerFault.exe Token: SeBackupPrivilege 2740 WerFault.exe Token: SeDebugPrivilege 2740 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exedescription pid process target process PID 1696 wrote to memory of 3464 1696 0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exe svchost.exe PID 1696 wrote to memory of 3464 1696 0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exe svchost.exe PID 1696 wrote to memory of 3464 1696 0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exe"C:\Users\Admin\AppData\Local\Temp\0a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\11874895816198\svchost.exeC:\Windows\11874895816198\svchost.exe2⤵
- Executes dropped EXE
- Windows security modification
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 13803⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\11874895816198\svchost.exeMD5
1daca30b2b6c0ef60e02df04e656e990
SHA1c1f6f1e1a27e7be32a3f18440c05951fa7e52eb9
SHA2560a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184
SHA5127f547f46e21ffe3c764050b081621c5df5046be118eb2765e546ce3fa3c3ed7541dbe0dc4deca85c682a1122d78a528614eac6c6684adcfae5e2f215f3651b52
-
C:\Windows\11874895816198\svchost.exeMD5
1daca30b2b6c0ef60e02df04e656e990
SHA1c1f6f1e1a27e7be32a3f18440c05951fa7e52eb9
SHA2560a052eff71641ff91897af5bdecb4a98ed3cb32bcb6ff86c4396b1e3ceee0184
SHA5127f547f46e21ffe3c764050b081621c5df5046be118eb2765e546ce3fa3c3ed7541dbe0dc4deca85c682a1122d78a528614eac6c6684adcfae5e2f215f3651b52
-
memory/1696-115-0x0000000000400000-0x00000000004EED90-memory.dmpFilesize
955KB
-
memory/1696-114-0x0000000002EE0000-0x0000000002EFD000-memory.dmpFilesize
116KB
-
memory/3464-116-0x0000000000000000-mapping.dmp
-
memory/3464-119-0x00000000025D0000-0x00000000025ED000-memory.dmpFilesize
116KB