Analysis
-
max time kernel
170s -
max time network
176s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
21-12-2021 11:54
Static task
static1
Behavioral task
behavioral1
Sample
4151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa.bin.exe
Resource
win7-en-20211208
General
-
Target
4151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa.bin.exe
-
Size
70KB
-
MD5
0a49900b4492f43b68331af062731f33
-
SHA1
95adde1482efa92c0907917c8716cd337f008d7e
-
SHA256
4151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa
-
SHA512
5d7328a6e4e573c67dd829aafeccefbf84543b2c3fc7d3d9ace9bab026c66a6c78c913436ebd7ea315b5af636c40a6c7d6650b5bef5aabd694bc9c83eee8aa53
Malware Config
Signatures
-
Phorphiex Payload 2 IoCs
Processes:
resource yara_rule behavioral2/files/0x000600000001ab0b-117.dat family_phorphiex behavioral2/files/0x000600000001ab0b-116.dat family_phorphiex -
Executes dropped EXE 1 IoCs
Processes:
drvmngrsv.exepid Process 2304 drvmngrsv.exe -
Processes:
drvmngrsv.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" drvmngrsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" drvmngrsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" drvmngrsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" drvmngrsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" drvmngrsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" drvmngrsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" drvmngrsv.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
4151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa.bin.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\drvmngrsv.exe" 4151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa.bin.exe -
Drops file in Windows directory 2 IoCs
Processes:
4151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa.bin.exedescription ioc Process File created C:\Windows\drvmngrsv.exe 4151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa.bin.exe File opened for modification C:\Windows\drvmngrsv.exe 4151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa.bin.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
4151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa.bin.exedescription pid Process procid_target PID 3704 wrote to memory of 2304 3704 4151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa.bin.exe 69 PID 3704 wrote to memory of 2304 3704 4151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa.bin.exe 69 PID 3704 wrote to memory of 2304 3704 4151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa.bin.exe 69
Processes
-
C:\Users\Admin\AppData\Local\Temp\4151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa.bin.exe"C:\Users\Admin\AppData\Local\Temp\4151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa.bin.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\drvmngrsv.exeC:\Windows\drvmngrsv.exe2⤵
- Executes dropped EXE
- Windows security modification
PID:2304
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
0a49900b4492f43b68331af062731f33
SHA195adde1482efa92c0907917c8716cd337f008d7e
SHA2564151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa
SHA5125d7328a6e4e573c67dd829aafeccefbf84543b2c3fc7d3d9ace9bab026c66a6c78c913436ebd7ea315b5af636c40a6c7d6650b5bef5aabd694bc9c83eee8aa53
-
MD5
0a49900b4492f43b68331af062731f33
SHA195adde1482efa92c0907917c8716cd337f008d7e
SHA2564151d9af5a104eea9106b18d35102f3b11134d7ba598e1fd57580a932d4596fa
SHA5125d7328a6e4e573c67dd829aafeccefbf84543b2c3fc7d3d9ace9bab026c66a6c78c913436ebd7ea315b5af636c40a6c7d6650b5bef5aabd694bc9c83eee8aa53