Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
21-12-2021 11:54
Static task
static1
Behavioral task
behavioral1
Sample
143e15adc8d63526b124a401fe1182a44542fb79f22fc17c602151a839c22682.bin.exe
Resource
win7-en-20211208
General
-
Target
143e15adc8d63526b124a401fe1182a44542fb79f22fc17c602151a839c22682.bin.exe
-
Size
72KB
-
MD5
bd5f71fcdba70236587930dddef0e59a
-
SHA1
4c47a7d780fb06a05763be682f6694de93e609b0
-
SHA256
143e15adc8d63526b124a401fe1182a44542fb79f22fc17c602151a839c22682
-
SHA512
98b05fd4fae3ff5c3f433fe82cec481ef8c040fa80fc92ad01b2d9bb9f95f5cd898e49efd253d62043a2e5db71c737ea44bf8440b3f4497f66efe059ca1075cf
Malware Config
Signatures
-
Phorphiex Payload 2 IoCs
Processes:
resource yara_rule behavioral2/files/0x000600000001ab05-116.dat family_phorphiex behavioral2/files/0x000600000001ab05-117.dat family_phorphiex -
Executes dropped EXE 1 IoCs
Processes:
wlpmsvcr.exepid Process 3976 wlpmsvcr.exe -
Processes:
wlpmsvcr.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" wlpmsvcr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" wlpmsvcr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" wlpmsvcr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" wlpmsvcr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" wlpmsvcr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" wlpmsvcr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" wlpmsvcr.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
143e15adc8d63526b124a401fe1182a44542fb79f22fc17c602151a839c22682.bin.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Update Service = "C:\\Windows\\wlpmsvcr.exe" 143e15adc8d63526b124a401fe1182a44542fb79f22fc17c602151a839c22682.bin.exe -
Drops file in Windows directory 2 IoCs
Processes:
143e15adc8d63526b124a401fe1182a44542fb79f22fc17c602151a839c22682.bin.exedescription ioc Process File created C:\Windows\wlpmsvcr.exe 143e15adc8d63526b124a401fe1182a44542fb79f22fc17c602151a839c22682.bin.exe File opened for modification C:\Windows\wlpmsvcr.exe 143e15adc8d63526b124a401fe1182a44542fb79f22fc17c602151a839c22682.bin.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
143e15adc8d63526b124a401fe1182a44542fb79f22fc17c602151a839c22682.bin.exedescription pid Process procid_target PID 2144 wrote to memory of 3976 2144 143e15adc8d63526b124a401fe1182a44542fb79f22fc17c602151a839c22682.bin.exe 69 PID 2144 wrote to memory of 3976 2144 143e15adc8d63526b124a401fe1182a44542fb79f22fc17c602151a839c22682.bin.exe 69 PID 2144 wrote to memory of 3976 2144 143e15adc8d63526b124a401fe1182a44542fb79f22fc17c602151a839c22682.bin.exe 69
Processes
-
C:\Users\Admin\AppData\Local\Temp\143e15adc8d63526b124a401fe1182a44542fb79f22fc17c602151a839c22682.bin.exe"C:\Users\Admin\AppData\Local\Temp\143e15adc8d63526b124a401fe1182a44542fb79f22fc17c602151a839c22682.bin.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\wlpmsvcr.exeC:\Windows\wlpmsvcr.exe2⤵
- Executes dropped EXE
- Windows security modification
PID:3976
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
bd5f71fcdba70236587930dddef0e59a
SHA14c47a7d780fb06a05763be682f6694de93e609b0
SHA256143e15adc8d63526b124a401fe1182a44542fb79f22fc17c602151a839c22682
SHA51298b05fd4fae3ff5c3f433fe82cec481ef8c040fa80fc92ad01b2d9bb9f95f5cd898e49efd253d62043a2e5db71c737ea44bf8440b3f4497f66efe059ca1075cf
-
MD5
bd5f71fcdba70236587930dddef0e59a
SHA14c47a7d780fb06a05763be682f6694de93e609b0
SHA256143e15adc8d63526b124a401fe1182a44542fb79f22fc17c602151a839c22682
SHA51298b05fd4fae3ff5c3f433fe82cec481ef8c040fa80fc92ad01b2d9bb9f95f5cd898e49efd253d62043a2e5db71c737ea44bf8440b3f4497f66efe059ca1075cf