Analysis
-
max time kernel
154s -
max time network
159s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
21-12-2021 11:54
Static task
static1
Behavioral task
behavioral1
Sample
4151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa.bin.exe
Resource
win7-en-20211208
General
-
Target
4151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa.bin.exe
-
Size
70KB
-
MD5
0a49900b4492f43b68331af062731f33
-
SHA1
95adde1482efa92c0907917c8716cd337f008d7e
-
SHA256
4151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa
-
SHA512
5d7328a6e4e573c67dd829aafeccefbf84543b2c3fc7d3d9ace9bab026c66a6c78c913436ebd7ea315b5af636c40a6c7d6650b5bef5aabd694bc9c83eee8aa53
Malware Config
Signatures
-
Phorphiex Payload 2 IoCs
Processes:
resource yara_rule behavioral1/files/0x0008000000012217-57.dat family_phorphiex behavioral1/files/0x0008000000012217-59.dat family_phorphiex -
Executes dropped EXE 1 IoCs
Processes:
drvmngrsv.exepid Process 1796 drvmngrsv.exe -
Processes:
drvmngrsv.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" drvmngrsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" drvmngrsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" drvmngrsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" drvmngrsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" drvmngrsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" drvmngrsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" drvmngrsv.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
4151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa.bin.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\drvmngrsv.exe" 4151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa.bin.exe -
Drops file in Windows directory 2 IoCs
Processes:
4151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa.bin.exedescription ioc Process File created C:\Windows\drvmngrsv.exe 4151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa.bin.exe File opened for modification C:\Windows\drvmngrsv.exe 4151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa.bin.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
4151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa.bin.exedescription pid Process procid_target PID 1180 wrote to memory of 1796 1180 4151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa.bin.exe 27 PID 1180 wrote to memory of 1796 1180 4151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa.bin.exe 27 PID 1180 wrote to memory of 1796 1180 4151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa.bin.exe 27 PID 1180 wrote to memory of 1796 1180 4151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa.bin.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\4151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa.bin.exe"C:\Users\Admin\AppData\Local\Temp\4151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa.bin.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\drvmngrsv.exeC:\Windows\drvmngrsv.exe2⤵
- Executes dropped EXE
- Windows security modification
PID:1796
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
0a49900b4492f43b68331af062731f33
SHA195adde1482efa92c0907917c8716cd337f008d7e
SHA2564151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa
SHA5125d7328a6e4e573c67dd829aafeccefbf84543b2c3fc7d3d9ace9bab026c66a6c78c913436ebd7ea315b5af636c40a6c7d6650b5bef5aabd694bc9c83eee8aa53
-
MD5
0a49900b4492f43b68331af062731f33
SHA195adde1482efa92c0907917c8716cd337f008d7e
SHA2564151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa
SHA5125d7328a6e4e573c67dd829aafeccefbf84543b2c3fc7d3d9ace9bab026c66a6c78c913436ebd7ea315b5af636c40a6c7d6650b5bef5aabd694bc9c83eee8aa53