phorphiex | 7dc4c399b8c13bba3ec5460bfb227d9024b6997250ee850f45c54a805031c752

Analysis

max time kernel
153s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
27/03/2022, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7dc4c399b8c13bba3ec5460bfb227d9024b6997250ee850f45c54a805031c752.exe
Size 84KB
Sample220327-3dptcsadgr
SHA256 7dc4c399b8c13bba3ec5460bfb227d9024b6997250ee850f45c54a805031c752
MD5 01fb5198d7ba9f2da21cbdc772aa0c5b
SHA1 f4fe3b6e65fcfad2c0d357d2858a027b53d57e82
SHA512 b264e0c37be3467e8b29c43bf0de1f43572b0ad61b6a83812b4d30c326ff25d1576a494b38db5a6f1883bcd9e211ffc2076a7fde23beabe2b20ce05402a08a11
MD5 SHA1 SHA512

Score

10^/10

phorphiex evasion loader persistence suricata trojan worm

Malware Config

Signatures

Phorphiex Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0006000000021e67-125.dat	family_phorphiex
behavioral2/files/0x0006000000021e67-126.dat	family_phorphiex

Phorphiex Worm
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata
suricata: ET MALWARE Phorpiex CnC Domain in DNS Query
suricata: ET MALWARE Phorpiex CnC Domain in DNS Query
suricata
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata
suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016
suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016
suricata

Executes dropped EXE 5 IoCs

pid	Process
4340	svchost.exe
3064	1125522948.exe
2552	winversvcs.exe
376	1739731263.exe
3432	386617735.exe

Windows security modification 2 TTPs 11 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	winversvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	winversvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	winversvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winversvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	winversvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winversvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	winversvcs.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\41572102524276\\svchost.exe"	7dc4c399b8c13bba3ec5460bfb227d9024b6997250ee850f45c54a805031c752.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\41572102524276\\svchost.exe"	7dc4c399b8c13bba3ec5460bfb227d9024b6997250ee850f45c54a805031c752.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\winversvcs.exe"	1125522948.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\winversvcs.exe	1125522948.exe
File opened for modification	C:\Windows\winversvcs.exe	1125522948.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 4340	1716	7dc4c399b8c13bba3ec5460bfb227d9024b6997250ee850f45c54a805031c752.exe	76
PID 1716 wrote to memory of 4340	1716	7dc4c399b8c13bba3ec5460bfb227d9024b6997250ee850f45c54a805031c752.exe	76
PID 1716 wrote to memory of 4340	1716	7dc4c399b8c13bba3ec5460bfb227d9024b6997250ee850f45c54a805031c752.exe	76
PID 4340 wrote to memory of 3064	4340	svchost.exe	77
PID 4340 wrote to memory of 3064	4340	svchost.exe	77
PID 4340 wrote to memory of 3064	4340	svchost.exe	77
PID 3064 wrote to memory of 2552	3064	1125522948.exe	78
PID 3064 wrote to memory of 2552	3064	1125522948.exe	78
PID 3064 wrote to memory of 2552	3064	1125522948.exe	78
PID 4340 wrote to memory of 376	4340	svchost.exe	79
PID 4340 wrote to memory of 376	4340	svchost.exe	79
PID 4340 wrote to memory of 376	4340	svchost.exe	79
PID 2552 wrote to memory of 3432	2552	winversvcs.exe	80
PID 2552 wrote to memory of 3432	2552	winversvcs.exe	80
PID 2552 wrote to memory of 3432	2552	winversvcs.exe	80

C:\Users\Admin\AppData\Local\Temp\7dc4c399b8c13bba3ec5460bfb227d9024b6997250ee850f45c54a805031c752.exe
"C:\Users\Admin\AppData\Local\Temp\7dc4c399b8c13bba3ec5460bfb227d9024b6997250ee850f45c54a805031c752.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1716
- C:\41572102524276\svchost.exe
  C:\41572102524276\svchost.exe
  2⤵
  - Executes dropped EXE
  - Windows security modification
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Users\Admin\AppData\Local\Temp\1125522948.exe
    C:\Users\Admin\AppData\Local\Temp\1125522948.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Windows\winversvcs.exe
      C:\Windows\winversvcs.exe
      4⤵
      Executes dropped EXE
      Windows security modification
      Suspicious use of WriteProcessMemory
      PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\386617735.exe
        
        C:\Users\Admin\AppData\Local\Temp\386617735.exe
        5⤵
        Executes dropped EXE
        
        PID:3432
- - C:\Users\Admin\AppData\Local\Temp\1739731263.exe
    C:\Users\Admin\AppData\Local\Temp\1739731263.exe
    3⤵
    - Executes dropped EXE
    PID:376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\41572102524276\svchost.exe
Size 84KB
SHA256 7dc4c399b8c13bba3ec5460bfb227d9024b6997250ee850f45c54a805031c752
MD5 01fb5198d7ba9f2da21cbdc772aa0c5b
SHA1 f4fe3b6e65fcfad2c0d357d2858a027b53d57e82
SHA512 b264e0c37be3467e8b29c43bf0de1f43572b0ad61b6a83812b4d30c326ff25d1576a494b38db5a6f1883bcd9e211ffc2076a7fde23beabe2b20ce05402a08a11
SSDEEP 1536:tYgysMUCKTyJ4rmwTUszFTn10OS66Wk1rw5V:Sgy0NjTUszFr10Fl9cV
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\41572102524276\svchost.exe
Size 84KB
SHA256 7dc4c399b8c13bba3ec5460bfb227d9024b6997250ee850f45c54a805031c752
MD5 01fb5198d7ba9f2da21cbdc772aa0c5b
SHA1 f4fe3b6e65fcfad2c0d357d2858a027b53d57e82
SHA512 b264e0c37be3467e8b29c43bf0de1f43572b0ad61b6a83812b4d30c326ff25d1576a494b38db5a6f1883bcd9e211ffc2076a7fde23beabe2b20ce05402a08a11
SSDEEP 1536:tYgysMUCKTyJ4rmwTUszFTn10OS66Wk1rw5V:Sgy0NjTUszFr10Fl9cV
MD5 SHA1 SHA512 SSDEEP

Submit Download

1125522948.exe

Path C:\Users\Admin\AppData\Local\Temp\1125522948.exe
Size 78KB
SHA256 db354d4e80d8450dcc331519e1afa8a0be30f331f02402c8d0807a102ae396a1
MD5 2f0e78e11f106960f4bc0efddda14d0b
SHA1 88fb0b46fd5cd215ea615e1faad8451974ac5f07
SHA512 498c605e40cc3d60135444fc16920988d03d33d005c3320569e86c7f198a2910f8a7a8e0774da1cf8463d679d6b5325c1faba039aa21303921fbf0f025503ea9
SSDEEP 1536:Qz3Mz8iUj49Y+kQZ8wmo7E3xopw3LDldMm8F3c:Pwi/JB83IEqpQpdd8FM
MD5 SHA1 SHA512 SSDEEP

Submit Download

1125522948.exe

Path C:\Users\Admin\AppData\Local\Temp\1125522948.exe
Size 78KB
SHA256 db354d4e80d8450dcc331519e1afa8a0be30f331f02402c8d0807a102ae396a1
MD5 2f0e78e11f106960f4bc0efddda14d0b
SHA1 88fb0b46fd5cd215ea615e1faad8451974ac5f07
SHA512 498c605e40cc3d60135444fc16920988d03d33d005c3320569e86c7f198a2910f8a7a8e0774da1cf8463d679d6b5325c1faba039aa21303921fbf0f025503ea9
SSDEEP 1536:Qz3Mz8iUj49Y+kQZ8wmo7E3xopw3LDldMm8F3c:Pwi/JB83IEqpQpdd8FM
MD5 SHA1 SHA512 SSDEEP

Submit Download

1739731263.exe

Path C:\Users\Admin\AppData\Local\Temp\1739731263.exe
Size 78KB
SHA256 db354d4e80d8450dcc331519e1afa8a0be30f331f02402c8d0807a102ae396a1
MD5 2f0e78e11f106960f4bc0efddda14d0b
SHA1 88fb0b46fd5cd215ea615e1faad8451974ac5f07
SHA512 498c605e40cc3d60135444fc16920988d03d33d005c3320569e86c7f198a2910f8a7a8e0774da1cf8463d679d6b5325c1faba039aa21303921fbf0f025503ea9
SSDEEP 1536:Qz3Mz8iUj49Y+kQZ8wmo7E3xopw3LDldMm8F3c:Pwi/JB83IEqpQpdd8FM
MD5 SHA1 SHA512 SSDEEP

Submit Download

1739731263.exe

Path C:\Users\Admin\AppData\Local\Temp\1739731263.exe
Size 78KB
SHA256 db354d4e80d8450dcc331519e1afa8a0be30f331f02402c8d0807a102ae396a1
MD5 2f0e78e11f106960f4bc0efddda14d0b
SHA1 88fb0b46fd5cd215ea615e1faad8451974ac5f07
SHA512 498c605e40cc3d60135444fc16920988d03d33d005c3320569e86c7f198a2910f8a7a8e0774da1cf8463d679d6b5325c1faba039aa21303921fbf0f025503ea9
SSDEEP 1536:Qz3Mz8iUj49Y+kQZ8wmo7E3xopw3LDldMm8F3c:Pwi/JB83IEqpQpdd8FM
MD5 SHA1 SHA512 SSDEEP

Submit Download

386617735.exe

Path C:\Users\Admin\AppData\Local\Temp\386617735.exe
Size 9KB
SHA256 961e42baa005099234a376979f8921f55f4ca017cf879498299fe56756447af8
MD5 d82736d4d144968cbe5ac954e4300630
SHA1 19b432b5f130c2784e923a8ef580edf0056ea5d7
SHA512 62f3dc40aeffa0fbfc7a4707840abd3f5525c2233e82cf385caa67a341b6e2136425761ab7f6cfedce3b3f30e68e50956ec69880c241daa5e8733cd5cfb9b2df
SSDEEP 192:zlf5/+nFWCsjzKxZ3RP1oynfU/n81Fu669tk2H1:zl52nFWl3KxX1BU/nKF96s
MD5 SHA1 SHA512 SSDEEP

Submit Download

386617735.exe

Path C:\Users\Admin\AppData\Local\Temp\386617735.exe
Size 9KB
SHA256 961e42baa005099234a376979f8921f55f4ca017cf879498299fe56756447af8
MD5 d82736d4d144968cbe5ac954e4300630
SHA1 19b432b5f130c2784e923a8ef580edf0056ea5d7
SHA512 62f3dc40aeffa0fbfc7a4707840abd3f5525c2233e82cf385caa67a341b6e2136425761ab7f6cfedce3b3f30e68e50956ec69880c241daa5e8733cd5cfb9b2df
SSDEEP 192:zlf5/+nFWCsjzKxZ3RP1oynfU/n81Fu669tk2H1:zl52nFWl3KxX1BU/nKF96s
MD5 SHA1 SHA512 SSDEEP

Submit Download

winversvcs.exe

Path C:\Windows\winversvcs.exe
Size 78KB
SHA256 db354d4e80d8450dcc331519e1afa8a0be30f331f02402c8d0807a102ae396a1
MD5 2f0e78e11f106960f4bc0efddda14d0b
SHA1 88fb0b46fd5cd215ea615e1faad8451974ac5f07
SHA512 498c605e40cc3d60135444fc16920988d03d33d005c3320569e86c7f198a2910f8a7a8e0774da1cf8463d679d6b5325c1faba039aa21303921fbf0f025503ea9
SSDEEP 1536:Qz3Mz8iUj49Y+kQZ8wmo7E3xopw3LDldMm8F3c:Pwi/JB83IEqpQpdd8FM
MD5 SHA1 SHA512 SSDEEP

Submit Download

winversvcs.exe

Path C:\Windows\winversvcs.exe
Size 78KB
SHA256 db354d4e80d8450dcc331519e1afa8a0be30f331f02402c8d0807a102ae396a1
MD5 2f0e78e11f106960f4bc0efddda14d0b
SHA1 88fb0b46fd5cd215ea615e1faad8451974ac5f07
SHA512 498c605e40cc3d60135444fc16920988d03d33d005c3320569e86c7f198a2910f8a7a8e0774da1cf8463d679d6b5325c1faba039aa21303921fbf0f025503ea9
SSDEEP 1536:Qz3Mz8iUj49Y+kQZ8wmo7E3xopw3LDldMm8F3c:Pwi/JB83IEqpQpdd8FM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads