Analysis
-
max time kernel
158s -
max time network
158s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
21-12-2021 11:54
Static task
static1
Behavioral task
behavioral1
Sample
f3fd26579b32378c1115937a1aea5daa2dc4d9f11c7c69c3f6878962e31e6fdc.bin.exe
Resource
win7-en-20211208
General
-
Target
f3fd26579b32378c1115937a1aea5daa2dc4d9f11c7c69c3f6878962e31e6fdc.bin.exe
-
Size
72KB
-
MD5
ec96bcc50ca8fa91821e820fdfe30915
-
SHA1
f1a542683b90038b6619df44dc3cd8e30ad93f5d
-
SHA256
f3fd26579b32378c1115937a1aea5daa2dc4d9f11c7c69c3f6878962e31e6fdc
-
SHA512
572785bd3dfa297c1b03be308bd8460ada2bdf888f7ea9bb483203c41169b07a9d64ca522f70fd2627c4a9022e6bbb635b398e594b02e0a704956384d9597b9a
Malware Config
Signatures
-
Phorphiex Payload 2 IoCs
Processes:
resource yara_rule behavioral2/files/0x000600000001ab19-119.dat family_phorphiex behavioral2/files/0x000600000001ab19-120.dat family_phorphiex -
Executes dropped EXE 1 IoCs
Processes:
wcvpsvcr.exepid Process 2780 wcvpsvcr.exe -
Processes:
wcvpsvcr.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" wcvpsvcr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" wcvpsvcr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" wcvpsvcr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" wcvpsvcr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" wcvpsvcr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" wcvpsvcr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" wcvpsvcr.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
f3fd26579b32378c1115937a1aea5daa2dc4d9f11c7c69c3f6878962e31e6fdc.bin.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Update Service = "C:\\Windows\\wcvpsvcr.exe" f3fd26579b32378c1115937a1aea5daa2dc4d9f11c7c69c3f6878962e31e6fdc.bin.exe -
Drops file in Windows directory 2 IoCs
Processes:
f3fd26579b32378c1115937a1aea5daa2dc4d9f11c7c69c3f6878962e31e6fdc.bin.exedescription ioc Process File created C:\Windows\wcvpsvcr.exe f3fd26579b32378c1115937a1aea5daa2dc4d9f11c7c69c3f6878962e31e6fdc.bin.exe File opened for modification C:\Windows\wcvpsvcr.exe f3fd26579b32378c1115937a1aea5daa2dc4d9f11c7c69c3f6878962e31e6fdc.bin.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
f3fd26579b32378c1115937a1aea5daa2dc4d9f11c7c69c3f6878962e31e6fdc.bin.exedescription pid Process procid_target PID 2416 wrote to memory of 2780 2416 f3fd26579b32378c1115937a1aea5daa2dc4d9f11c7c69c3f6878962e31e6fdc.bin.exe 68 PID 2416 wrote to memory of 2780 2416 f3fd26579b32378c1115937a1aea5daa2dc4d9f11c7c69c3f6878962e31e6fdc.bin.exe 68 PID 2416 wrote to memory of 2780 2416 f3fd26579b32378c1115937a1aea5daa2dc4d9f11c7c69c3f6878962e31e6fdc.bin.exe 68
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3fd26579b32378c1115937a1aea5daa2dc4d9f11c7c69c3f6878962e31e6fdc.bin.exe"C:\Users\Admin\AppData\Local\Temp\f3fd26579b32378c1115937a1aea5daa2dc4d9f11c7c69c3f6878962e31e6fdc.bin.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\wcvpsvcr.exeC:\Windows\wcvpsvcr.exe2⤵
- Executes dropped EXE
- Windows security modification
PID:2780
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
ec96bcc50ca8fa91821e820fdfe30915
SHA1f1a542683b90038b6619df44dc3cd8e30ad93f5d
SHA256f3fd26579b32378c1115937a1aea5daa2dc4d9f11c7c69c3f6878962e31e6fdc
SHA512572785bd3dfa297c1b03be308bd8460ada2bdf888f7ea9bb483203c41169b07a9d64ca522f70fd2627c4a9022e6bbb635b398e594b02e0a704956384d9597b9a
-
MD5
ec96bcc50ca8fa91821e820fdfe30915
SHA1f1a542683b90038b6619df44dc3cd8e30ad93f5d
SHA256f3fd26579b32378c1115937a1aea5daa2dc4d9f11c7c69c3f6878962e31e6fdc
SHA512572785bd3dfa297c1b03be308bd8460ada2bdf888f7ea9bb483203c41169b07a9d64ca522f70fd2627c4a9022e6bbb635b398e594b02e0a704956384d9597b9a