Analysis

  • max time kernel
    160s
  • max time network
    167s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    21-12-2021 11:54

General

  • Target

    7d72f66070b144fdd4d0fcbe39c732d1943b5836c8da1d469da876c27775808e.bin.exe

  • Size

    72KB

  • MD5

    9fa3010c557db8477aec95587748dc82

  • SHA1

    10ffea2306659a4c021bf55a842afa2fd69761be

  • SHA256

    7d72f66070b144fdd4d0fcbe39c732d1943b5836c8da1d469da876c27775808e

  • SHA512

    77c6f7e9bfb3e15ebd1bc58cf6b206477d6e44128083a36ea051fb232f8008b31c4807b509ba6918da2af006dc472763caf12d8e128f221c040925ab1732b7f2

Malware Config

Signatures

  • Phorphiex Payload 2 IoCs
  • Phorphiex Worm

    Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

  • Windows security bypass 2 TTPs
  • Executes dropped EXE 1 IoCs
  • Windows security modification 2 TTPs 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7d72f66070b144fdd4d0fcbe39c732d1943b5836c8da1d469da876c27775808e.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\7d72f66070b144fdd4d0fcbe39c732d1943b5836c8da1d469da876c27775808e.bin.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:3732
    • C:\Windows\wapmsvcr.exe
      C:\Windows\wapmsvcr.exe
      2⤵
      • Executes dropped EXE
      • Windows security modification
      PID:3116

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\wapmsvcr.exe

    MD5

    9fa3010c557db8477aec95587748dc82

    SHA1

    10ffea2306659a4c021bf55a842afa2fd69761be

    SHA256

    7d72f66070b144fdd4d0fcbe39c732d1943b5836c8da1d469da876c27775808e

    SHA512

    77c6f7e9bfb3e15ebd1bc58cf6b206477d6e44128083a36ea051fb232f8008b31c4807b509ba6918da2af006dc472763caf12d8e128f221c040925ab1732b7f2

  • C:\Windows\wapmsvcr.exe

    MD5

    9fa3010c557db8477aec95587748dc82

    SHA1

    10ffea2306659a4c021bf55a842afa2fd69761be

    SHA256

    7d72f66070b144fdd4d0fcbe39c732d1943b5836c8da1d469da876c27775808e

    SHA512

    77c6f7e9bfb3e15ebd1bc58cf6b206477d6e44128083a36ea051fb232f8008b31c4807b509ba6918da2af006dc472763caf12d8e128f221c040925ab1732b7f2

  • memory/3116-115-0x0000000000000000-mapping.dmp