phorphiex | 555513aa074aca680c4962f0078f43445a0d382e78046623d53203d8436bad99

General

Target

555513aa074aca680c4962f0078f43445a0d382e78046623d53203d8436bad99.bin.exe
Size

71KB
MD5

c532ac418f3e867907c2757a7ca56a53
SHA1

0583af526b3825a570237c0d954c445fb30948d3
SHA256

555513aa074aca680c4962f0078f43445a0d382e78046623d53203d8436bad99
SHA512

4d906dfa69bd84c5a7b37cb1139c9de2ce3025bcc6ee0f5d36444c9f75c31e03c8d06d6379ff7ba526a72cce319f979a9e2cbc18bd096e5d4bff53839761608c

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Signatures

Phorphiex Payload 2 IoCs

Processes:

resource	yara_rule
C:\Windows\wsecsvcmgr.exe	family_phorphiex
C:\Windows\wsecsvcmgr.exe	family_phorphiex

Phorphiex Worm
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Executes dropped EXE 1 IoCs

Processes:

wsecsvcmgr.exe

pid process

2140 wsecsvcmgr.exe

pid	process
2140	wsecsvcmgr.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

wsecsvcmgr.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	wsecsvcmgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	wsecsvcmgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	wsecsvcmgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	wsecsvcmgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	wsecsvcmgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	wsecsvcmgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	wsecsvcmgr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

555513aa074aca680c4962f0078f43445a0d382e78046623d53203d8436bad99.bin.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Update Service = "C:\\Windows\\wsecsvcmgr.exe"	555513aa074aca680c4962f0078f43445a0d382e78046623d53203d8436bad99.bin.exe

Drops file in Windows directory 2 IoCs

Processes:

555513aa074aca680c4962f0078f43445a0d382e78046623d53203d8436bad99.bin.exe

description	ioc	process
File created	C:\Windows\wsecsvcmgr.exe	555513aa074aca680c4962f0078f43445a0d382e78046623d53203d8436bad99.bin.exe
File opened for modification	C:\Windows\wsecsvcmgr.exe	555513aa074aca680c4962f0078f43445a0d382e78046623d53203d8436bad99.bin.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

555513aa074aca680c4962f0078f43445a0d382e78046623d53203d8436bad99.bin.exe

description	pid	process	target process
PID 3620 wrote to memory of 2140	3620	555513aa074aca680c4962f0078f43445a0d382e78046623d53203d8436bad99.bin.exe	wsecsvcmgr.exe
PID 3620 wrote to memory of 2140	3620	555513aa074aca680c4962f0078f43445a0d382e78046623d53203d8436bad99.bin.exe	wsecsvcmgr.exe
PID 3620 wrote to memory of 2140	3620	555513aa074aca680c4962f0078f43445a0d382e78046623d53203d8436bad99.bin.exe	wsecsvcmgr.exe

C:\Users\Admin\AppData\Local\Temp\555513aa074aca680c4962f0078f43445a0d382e78046623d53203d8436bad99.bin.exe
"C:\Users\Admin\AppData\Local\Temp\555513aa074aca680c4962f0078f43445a0d382e78046623d53203d8436bad99.bin.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Windows\wsecsvcmgr.exe
  C:\Windows\wsecsvcmgr.exe
  2⤵
  - Executes dropped EXE
  - Windows security modification
  PID:2140

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\wsecsvcmgr.exe

MD5
c532ac418f3e867907c2757a7ca56a53

SHA1
0583af526b3825a570237c0d954c445fb30948d3

SHA256
555513aa074aca680c4962f0078f43445a0d382e78046623d53203d8436bad99

SHA512
4d906dfa69bd84c5a7b37cb1139c9de2ce3025bcc6ee0f5d36444c9f75c31e03c8d06d6379ff7ba526a72cce319f979a9e2cbc18bd096e5d4bff53839761608c

Download Submit
C:\Windows\wsecsvcmgr.exe

MD5
c532ac418f3e867907c2757a7ca56a53

SHA1
0583af526b3825a570237c0d954c445fb30948d3

SHA256
555513aa074aca680c4962f0078f43445a0d382e78046623d53203d8436bad99

SHA512
4d906dfa69bd84c5a7b37cb1139c9de2ce3025bcc6ee0f5d36444c9f75c31e03c8d06d6379ff7ba526a72cce319f979a9e2cbc18bd096e5d4bff53839761608c

Download Submit
memory/2140-118-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads