Analysis
-
max time kernel
157s -
max time network
155s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
21-12-2021 11:54
Static task
static1
Behavioral task
behavioral1
Sample
7356a7c98588b980302a5f2340b56f75a13bdac613f7c22b62eeb4590896e506.bin.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
7356a7c98588b980302a5f2340b56f75a13bdac613f7c22b62eeb4590896e506.bin.exe
Resource
win10-en-20211208
General
-
Target
7356a7c98588b980302a5f2340b56f75a13bdac613f7c22b62eeb4590896e506.bin.exe
-
Size
72KB
-
MD5
9857fb8f7630b354f482c3f6c65a3083
-
SHA1
5486dc80ae1073645626f197677c1eedf4329c1f
-
SHA256
7356a7c98588b980302a5f2340b56f75a13bdac613f7c22b62eeb4590896e506
-
SHA512
c1f001548869d4f02f01141d228121c4b32d1cec133b4d7fc51fb23171bda3c437a011511b2c0d1ace43814de4b359487b85783ff76b4155e57b324ef08b2fc9
Malware Config
Signatures
-
Phorphiex Payload 2 IoCs
Processes:
resource yara_rule behavioral1/files/0x0007000000013413-56.dat family_phorphiex behavioral1/files/0x0007000000013413-58.dat family_phorphiex -
Executes dropped EXE 1 IoCs
Processes:
wedrvcsvc.exepid Process 1452 wedrvcsvc.exe -
Processes:
wedrvcsvc.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" wedrvcsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" wedrvcsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" wedrvcsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" wedrvcsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" wedrvcsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" wedrvcsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" wedrvcsvc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
7356a7c98588b980302a5f2340b56f75a13bdac613f7c22b62eeb4590896e506.bin.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Update Service = "C:\\Windows\\wedrvcsvc.exe" 7356a7c98588b980302a5f2340b56f75a13bdac613f7c22b62eeb4590896e506.bin.exe -
Drops file in Windows directory 2 IoCs
Processes:
7356a7c98588b980302a5f2340b56f75a13bdac613f7c22b62eeb4590896e506.bin.exedescription ioc Process File created C:\Windows\wedrvcsvc.exe 7356a7c98588b980302a5f2340b56f75a13bdac613f7c22b62eeb4590896e506.bin.exe File opened for modification C:\Windows\wedrvcsvc.exe 7356a7c98588b980302a5f2340b56f75a13bdac613f7c22b62eeb4590896e506.bin.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
7356a7c98588b980302a5f2340b56f75a13bdac613f7c22b62eeb4590896e506.bin.exedescription pid Process procid_target PID 1448 wrote to memory of 1452 1448 7356a7c98588b980302a5f2340b56f75a13bdac613f7c22b62eeb4590896e506.bin.exe 27 PID 1448 wrote to memory of 1452 1448 7356a7c98588b980302a5f2340b56f75a13bdac613f7c22b62eeb4590896e506.bin.exe 27 PID 1448 wrote to memory of 1452 1448 7356a7c98588b980302a5f2340b56f75a13bdac613f7c22b62eeb4590896e506.bin.exe 27 PID 1448 wrote to memory of 1452 1448 7356a7c98588b980302a5f2340b56f75a13bdac613f7c22b62eeb4590896e506.bin.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\7356a7c98588b980302a5f2340b56f75a13bdac613f7c22b62eeb4590896e506.bin.exe"C:\Users\Admin\AppData\Local\Temp\7356a7c98588b980302a5f2340b56f75a13bdac613f7c22b62eeb4590896e506.bin.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\wedrvcsvc.exeC:\Windows\wedrvcsvc.exe2⤵
- Executes dropped EXE
- Windows security modification
PID:1452
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
9857fb8f7630b354f482c3f6c65a3083
SHA15486dc80ae1073645626f197677c1eedf4329c1f
SHA2567356a7c98588b980302a5f2340b56f75a13bdac613f7c22b62eeb4590896e506
SHA512c1f001548869d4f02f01141d228121c4b32d1cec133b4d7fc51fb23171bda3c437a011511b2c0d1ace43814de4b359487b85783ff76b4155e57b324ef08b2fc9
-
MD5
9857fb8f7630b354f482c3f6c65a3083
SHA15486dc80ae1073645626f197677c1eedf4329c1f
SHA2567356a7c98588b980302a5f2340b56f75a13bdac613f7c22b62eeb4590896e506
SHA512c1f001548869d4f02f01141d228121c4b32d1cec133b4d7fc51fb23171bda3c437a011511b2c0d1ace43814de4b359487b85783ff76b4155e57b324ef08b2fc9