Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
14-05-2021 18:16
Static task
static1
Behavioral task
behavioral1
Sample
4c80e5212c71b86274b03c7e90df62a6.exe
Resource
win7v20210408
General
-
Target
4c80e5212c71b86274b03c7e90df62a6.exe
-
Size
100KB
-
MD5
4c80e5212c71b86274b03c7e90df62a6
-
SHA1
27fb49e915fba0537c26f2e3643c8ed079cd5e45
-
SHA256
552ac0917f936b6075b045c778da6f150cde88ebd89c8dd98ab8d0f2bf6a9e17
-
SHA512
4135fc58ae7e2b6ad2ca82d955d2028f12dcdb97ac8388811f5e7687b0fa8e1845f383862ba2afd1170c1832f47536c615c4817ead432e2773fe0d18b4684453
Malware Config
Signatures
-
Phorphiex Payload 2 IoCs
Processes:
resource yara_rule C:\235292373222976\wininet.exe family_phorphiex C:\235292373222976\wininet.exe family_phorphiex -
Executes dropped EXE 1 IoCs
Processes:
wininet.exepid process 1172 wininet.exe -
Processes:
wininet.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" wininet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" wininet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" wininet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" wininet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" wininet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" wininet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" wininet.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
4c80e5212c71b86274b03c7e90df62a6.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\235292373222976\\wininet.exe" 4c80e5212c71b86274b03c7e90df62a6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\235292373222976\\wininet.exe" 4c80e5212c71b86274b03c7e90df62a6.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
4c80e5212c71b86274b03c7e90df62a6.exedescription pid process target process PID 640 wrote to memory of 1172 640 4c80e5212c71b86274b03c7e90df62a6.exe wininet.exe PID 640 wrote to memory of 1172 640 4c80e5212c71b86274b03c7e90df62a6.exe wininet.exe PID 640 wrote to memory of 1172 640 4c80e5212c71b86274b03c7e90df62a6.exe wininet.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c80e5212c71b86274b03c7e90df62a6.exe"C:\Users\Admin\AppData\Local\Temp\4c80e5212c71b86274b03c7e90df62a6.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\235292373222976\wininet.exeC:\235292373222976\wininet.exe2⤵
- Executes dropped EXE
- Windows security modification
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\235292373222976\wininet.exeMD5
4c80e5212c71b86274b03c7e90df62a6
SHA127fb49e915fba0537c26f2e3643c8ed079cd5e45
SHA256552ac0917f936b6075b045c778da6f150cde88ebd89c8dd98ab8d0f2bf6a9e17
SHA5124135fc58ae7e2b6ad2ca82d955d2028f12dcdb97ac8388811f5e7687b0fa8e1845f383862ba2afd1170c1832f47536c615c4817ead432e2773fe0d18b4684453
-
C:\235292373222976\wininet.exeMD5
4c80e5212c71b86274b03c7e90df62a6
SHA127fb49e915fba0537c26f2e3643c8ed079cd5e45
SHA256552ac0917f936b6075b045c778da6f150cde88ebd89c8dd98ab8d0f2bf6a9e17
SHA5124135fc58ae7e2b6ad2ca82d955d2028f12dcdb97ac8388811f5e7687b0fa8e1845f383862ba2afd1170c1832f47536c615c4817ead432e2773fe0d18b4684453
-
memory/1172-114-0x0000000000000000-mapping.dmp