phorphiex | 6cda2e78e02e7b2d195868d9d47a127e4b7dedd76c95f7f44d5b7fc8ac485078

General

Target
6cda2e78e02e7b2d195868d9d47a127e4b7dedd76c95f7f44d5b7fc8ac485078.exe
Size 32KB
Sample220515-1hd7baafek
SHA256 6cda2e78e02e7b2d195868d9d47a127e4b7dedd76c95f7f44d5b7fc8ac485078
MD5 629fba91ff579f1e890e489a028d7eb1
SHA1 c6871d6ce30d012e79412761bd6c0c75be37d084
SHA512 5e5786f841a6581879c929374e848d55525ad73e136fbb8690c5d89587c431ef60c2f666203bb216cd8271fc27274119025e315156cb7b24cf1bb4d59f611183
MD5 SHA1 SHA512

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Signatures

Phorphiex Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000400000001d886-131.dat	family_phorphiex
behavioral2/files/0x000400000001d886-132.dat	family_phorphiex

Phorphiex Worm
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
3592	svchost.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\296230203938\\svchost.exe"	6cda2e78e02e7b2d195868d9d47a127e4b7dedd76c95f7f44d5b7fc8ac485078.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\296230203938\\svchost.exe"	6cda2e78e02e7b2d195868d9d47a127e4b7dedd76c95f7f44d5b7fc8ac485078.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 3592	2664	6cda2e78e02e7b2d195868d9d47a127e4b7dedd76c95f7f44d5b7fc8ac485078.exe	81
PID 2664 wrote to memory of 3592	2664	6cda2e78e02e7b2d195868d9d47a127e4b7dedd76c95f7f44d5b7fc8ac485078.exe	81
PID 2664 wrote to memory of 3592	2664	6cda2e78e02e7b2d195868d9d47a127e4b7dedd76c95f7f44d5b7fc8ac485078.exe	81

C:\Users\Admin\AppData\Local\Temp\6cda2e78e02e7b2d195868d9d47a127e4b7dedd76c95f7f44d5b7fc8ac485078.exe
"C:\Users\Admin\AppData\Local\Temp\6cda2e78e02e7b2d195868d9d47a127e4b7dedd76c95f7f44d5b7fc8ac485078.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2664
- C:\296230203938\svchost.exe
  C:\296230203938\svchost.exe
  2⤵
  - Executes dropped EXE
  - Windows security modification
  PID:3592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\296230203938\svchost.exe
Size 32KB
SHA256 6cda2e78e02e7b2d195868d9d47a127e4b7dedd76c95f7f44d5b7fc8ac485078
MD5 629fba91ff579f1e890e489a028d7eb1
SHA1 c6871d6ce30d012e79412761bd6c0c75be37d084
SHA512 5e5786f841a6581879c929374e848d55525ad73e136fbb8690c5d89587c431ef60c2f666203bb216cd8271fc27274119025e315156cb7b24cf1bb4d59f611183
SSDEEP 384:UOFl9ooXxUDs/uG67GRtA2ZmQF1szUQIENIay2vWpQVGq71BV7ISlDqzhr1zFz:U0l9GDs/uGTNnggERZBV7VWzFDz
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\296230203938\svchost.exe
Size 32KB
SHA256 6cda2e78e02e7b2d195868d9d47a127e4b7dedd76c95f7f44d5b7fc8ac485078
MD5 629fba91ff579f1e890e489a028d7eb1
SHA1 c6871d6ce30d012e79412761bd6c0c75be37d084
SHA512 5e5786f841a6581879c929374e848d55525ad73e136fbb8690c5d89587c431ef60c2f666203bb216cd8271fc27274119025e315156cb7b24cf1bb4d59f611183
SSDEEP 384:UOFl9ooXxUDs/uG67GRtA2ZmQF1szUQIENIay2vWpQVGq71BV7ISlDqzhr1zFz:U0l9GDs/uGTNnggERZBV7VWzFDz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads