Analysis
-
max time kernel
144s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 21:56
Behavioral task
behavioral1
Sample
4495447ebb434423103b2da44c41c3138a491eb0c3e5c68b33cf362c0a54aa49.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
4495447ebb434423103b2da44c41c3138a491eb0c3e5c68b33cf362c0a54aa49.exe
-
Size
142KB
-
MD5
3f77e8af75b455f40cfa74908ae8bac3
-
SHA1
80d2eec53813a6c8017634b11ac6719fa7884aad
-
SHA256
4495447ebb434423103b2da44c41c3138a491eb0c3e5c68b33cf362c0a54aa49
-
SHA512
ecff89cd29a8e6c927b89ef81d8f5fcd2c9f65320d54816076628f11bf9e68c14794b01f0cebc312ebba2506fcf4b26d12ade32f8e15818fbae603f507f96fb9
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
phoenixsmall.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat phoenixsmall.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
phoenixsmall.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 phoenixsmall.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A1443E57-030B-4224-A3B0-F624131B5308}\be-d9-97-07-f5-7a phoenixsmall.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-d9-97-07-f5-7a\WpadDecisionReason = "1" phoenixsmall.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-d9-97-07-f5-7a\WpadDecisionTime = 200dfa55a56cd801 phoenixsmall.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix phoenixsmall.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" phoenixsmall.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 phoenixsmall.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00b1000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 phoenixsmall.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A1443E57-030B-4224-A3B0-F624131B5308}\WpadDecisionTime = 200dfa55a56cd801 phoenixsmall.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" phoenixsmall.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A1443E57-030B-4224-A3B0-F624131B5308} phoenixsmall.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A1443E57-030B-4224-A3B0-F624131B5308}\WpadNetworkName = "Network 3" phoenixsmall.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-d9-97-07-f5-7a phoenixsmall.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A1443E57-030B-4224-A3B0-F624131B5308}\WpadDecisionReason = "1" phoenixsmall.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A1443E57-030B-4224-A3B0-F624131B5308}\WpadDecision = "0" phoenixsmall.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-d9-97-07-f5-7a\WpadDecision = "0" phoenixsmall.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings phoenixsmall.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections phoenixsmall.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings phoenixsmall.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" phoenixsmall.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad phoenixsmall.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
phoenixsmall.exepid process 2036 phoenixsmall.exe 2036 phoenixsmall.exe 2036 phoenixsmall.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
4495447ebb434423103b2da44c41c3138a491eb0c3e5c68b33cf362c0a54aa49.exepid process 1720 4495447ebb434423103b2da44c41c3138a491eb0c3e5c68b33cf362c0a54aa49.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
4495447ebb434423103b2da44c41c3138a491eb0c3e5c68b33cf362c0a54aa49.exe4495447ebb434423103b2da44c41c3138a491eb0c3e5c68b33cf362c0a54aa49.exephoenixsmall.exephoenixsmall.exepid process 1756 4495447ebb434423103b2da44c41c3138a491eb0c3e5c68b33cf362c0a54aa49.exe 1720 4495447ebb434423103b2da44c41c3138a491eb0c3e5c68b33cf362c0a54aa49.exe 2028 phoenixsmall.exe 2036 phoenixsmall.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
4495447ebb434423103b2da44c41c3138a491eb0c3e5c68b33cf362c0a54aa49.exephoenixsmall.exedescription pid process target process PID 1756 wrote to memory of 1720 1756 4495447ebb434423103b2da44c41c3138a491eb0c3e5c68b33cf362c0a54aa49.exe 4495447ebb434423103b2da44c41c3138a491eb0c3e5c68b33cf362c0a54aa49.exe PID 1756 wrote to memory of 1720 1756 4495447ebb434423103b2da44c41c3138a491eb0c3e5c68b33cf362c0a54aa49.exe 4495447ebb434423103b2da44c41c3138a491eb0c3e5c68b33cf362c0a54aa49.exe PID 1756 wrote to memory of 1720 1756 4495447ebb434423103b2da44c41c3138a491eb0c3e5c68b33cf362c0a54aa49.exe 4495447ebb434423103b2da44c41c3138a491eb0c3e5c68b33cf362c0a54aa49.exe PID 1756 wrote to memory of 1720 1756 4495447ebb434423103b2da44c41c3138a491eb0c3e5c68b33cf362c0a54aa49.exe 4495447ebb434423103b2da44c41c3138a491eb0c3e5c68b33cf362c0a54aa49.exe PID 2028 wrote to memory of 2036 2028 phoenixsmall.exe phoenixsmall.exe PID 2028 wrote to memory of 2036 2028 phoenixsmall.exe phoenixsmall.exe PID 2028 wrote to memory of 2036 2028 phoenixsmall.exe phoenixsmall.exe PID 2028 wrote to memory of 2036 2028 phoenixsmall.exe phoenixsmall.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4495447ebb434423103b2da44c41c3138a491eb0c3e5c68b33cf362c0a54aa49.exe"C:\Users\Admin\AppData\Local\Temp\4495447ebb434423103b2da44c41c3138a491eb0c3e5c68b33cf362c0a54aa49.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4495447ebb434423103b2da44c41c3138a491eb0c3e5c68b33cf362c0a54aa49.exe--ba2221582⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\phoenixsmall.exe"C:\Windows\SysWOW64\phoenixsmall.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\phoenixsmall.exe--d5127dea2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1720-54-0x0000000000000000-mapping.dmp
-
memory/1720-57-0x0000000000220000-0x0000000000231000-memory.dmpFilesize
68KB
-
memory/1720-58-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1720-59-0x00000000753B1000-0x00000000753B3000-memory.dmpFilesize
8KB
-
memory/1756-55-0x00000000001B0000-0x00000000001C1000-memory.dmpFilesize
68KB
-
memory/1756-56-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2036-60-0x0000000000000000-mapping.dmp
-
memory/2036-61-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB