phorphiex | 43ce59f24af9a723eac0c833352ee4c06722004dbd0e2b74ead114eaf4cd1297

General

Target

DS_Store.exe
Size

81KB
MD5

820c6d166bc9dd13d3bedec142d8306a
SHA1

7ad5636414b0b56de62fcdc7491c665af79e094c
SHA256

43ce59f24af9a723eac0c833352ee4c06722004dbd0e2b74ead114eaf4cd1297
SHA512

70d7e65220703925477b57ef5a1841a926ad16155fcc80adb10cbca1fdca1373c2683dda4833230a7813f48cf1be023473ab77bda886c4ba73984843ef06fff0

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Signatures

Phorphiex Payload 2 IoCs

Processes:

resource	yara_rule
C:\287931393624834\svchost.exe	family_phorphiex
C:\287931393624834\svchost.exe	family_phorphiex

Phorphiex Worm
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

2940 svchost.exe

pid	process
2940	svchost.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

DS_Store.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\287931393624834\\svchost.exe"	DS_Store.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\287931393624834\\svchost.exe"	DS_Store.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

DS_Store.exe

description	pid	process	target process
PID 632 wrote to memory of 2940	632	DS_Store.exe	svchost.exe
PID 632 wrote to memory of 2940	632	DS_Store.exe	svchost.exe
PID 632 wrote to memory of 2940	632	DS_Store.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\DS_Store.exe
"C:\Users\Admin\AppData\Local\Temp\DS_Store.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:632

C:\287931393624834\svchost.exe
C:\287931393624834\svchost.exe
2⤵
- Executes dropped EXE
- Windows security modification
PID:2940

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

2

T1089

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\287931393624834\svchost.exe
MD5
820c6d166bc9dd13d3bedec142d8306a

SHA1
7ad5636414b0b56de62fcdc7491c665af79e094c

SHA256
43ce59f24af9a723eac0c833352ee4c06722004dbd0e2b74ead114eaf4cd1297

SHA512
70d7e65220703925477b57ef5a1841a926ad16155fcc80adb10cbca1fdca1373c2683dda4833230a7813f48cf1be023473ab77bda886c4ba73984843ef06fff0

Download Submit
C:\287931393624834\svchost.exe
MD5
820c6d166bc9dd13d3bedec142d8306a

SHA1
7ad5636414b0b56de62fcdc7491c665af79e094c

SHA256
43ce59f24af9a723eac0c833352ee4c06722004dbd0e2b74ead114eaf4cd1297

SHA512
70d7e65220703925477b57ef5a1841a926ad16155fcc80adb10cbca1fdca1373c2683dda4833230a7813f48cf1be023473ab77bda886c4ba73984843ef06fff0

Download Submit
memory/2940-114-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads