Analysis
-
max time kernel
152s -
max time network
160s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
25-07-2022 02:46
Static task
static1
Behavioral task
behavioral1
Sample
d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe
Resource
win7-20220718-en
General
-
Target
d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe
-
Size
392KB
-
MD5
712a19e062672ca95f393732f9250b6e
-
SHA1
687c166c40697686aecd7c5dac972361f3362676
-
SHA256
d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf
-
SHA512
33d5779bae56f7231f841f691ed4ae48641a80baedb5c262ec4b86605a44cd0f02512b514241a3c2d4788c527308dc974382bd3c4ab0af74fe2e064235ed0c65
Malware Config
Extracted
phorphiex
http://185.176.27.132/
13cQ2H6oszrEnvw1ZGdsPix9gUayB8tzNa
qr5pm4d27z250wpz4sfy08ytghxn56kryvsw5tdw99
XfrM8P9YWSg8mQTxSCCxyHUeQjMEGx8vnE
DSG5PddW9wu1eKdLcx4f3KBF4wUvaBFaGc
0x373b9854c9e4511b920372f5495640cdc25d6832
LSermtCTLWeS683x17AtYuhNT8MpMmVmi8
t1XgRHyGj6YDNqkS5EWwdcXG1rjQPFFdUsR
Signatures
-
Processes:
sysuwys.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection sysuwys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" sysuwys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" sysuwys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" sysuwys.exe -
Phorphiex payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1412-56-0x0000000000300000-0x000000000030E000-memory.dmp family_phorphiex behavioral1/memory/2044-68-0x0000000000230000-0x000000000023E000-memory.dmp family_phorphiex -
Processes:
sysuwys.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" sysuwys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysuwys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysuwys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysuwys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysuwys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysuwys.exe -
Executes dropped EXE 1 IoCs
Processes:
sysuwys.exepid process 2044 sysuwys.exe -
Loads dropped DLL 2 IoCs
Processes:
d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exepid process 1412 d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe 1412 d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe -
Processes:
sysuwys.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysuwys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1" sysuwys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysuwys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysuwys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysuwys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" sysuwys.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysuwys.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Driver = "C:\\Windows\\251915576\\sysuwys.exe" d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Driver = "C:\\Windows\\251915576\\sysuwys.exe" d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe -
Drops file in Windows directory 3 IoCs
Processes:
d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exedescription ioc process File created C:\Windows\251915576\sysuwys.exe d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe File opened for modification C:\Windows\251915576\sysuwys.exe d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe File opened for modification C:\Windows\251915576 d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exesysuwys.exepid process 1412 d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe 1412 d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe 1412 d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe 1412 d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe 1412 d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe 1412 d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe 1412 d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe 1412 d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe 1412 d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe 2044 sysuwys.exe 2044 sysuwys.exe 2044 sysuwys.exe 2044 sysuwys.exe 2044 sysuwys.exe 2044 sysuwys.exe 2044 sysuwys.exe 2044 sysuwys.exe 2044 sysuwys.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exesysuwys.exedescription pid process Token: SeDebugPrivilege 1412 d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe Token: SeDebugPrivilege 2044 sysuwys.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exesysuwys.exepid process 1412 d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe 1412 d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe 2044 sysuwys.exe 2044 sysuwys.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exedescription pid process target process PID 1412 wrote to memory of 2044 1412 d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe sysuwys.exe PID 1412 wrote to memory of 2044 1412 d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe sysuwys.exe PID 1412 wrote to memory of 2044 1412 d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe sysuwys.exe PID 1412 wrote to memory of 2044 1412 d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe sysuwys.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe"C:\Users\Admin\AppData\Local\Temp\d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\251915576\sysuwys.exeC:\Windows\251915576\sysuwys.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2044
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
392KB
MD5712a19e062672ca95f393732f9250b6e
SHA1687c166c40697686aecd7c5dac972361f3362676
SHA256d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf
SHA51233d5779bae56f7231f841f691ed4ae48641a80baedb5c262ec4b86605a44cd0f02512b514241a3c2d4788c527308dc974382bd3c4ab0af74fe2e064235ed0c65
-
Filesize
392KB
MD5712a19e062672ca95f393732f9250b6e
SHA1687c166c40697686aecd7c5dac972361f3362676
SHA256d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf
SHA51233d5779bae56f7231f841f691ed4ae48641a80baedb5c262ec4b86605a44cd0f02512b514241a3c2d4788c527308dc974382bd3c4ab0af74fe2e064235ed0c65
-
Filesize
392KB
MD5712a19e062672ca95f393732f9250b6e
SHA1687c166c40697686aecd7c5dac972361f3362676
SHA256d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf
SHA51233d5779bae56f7231f841f691ed4ae48641a80baedb5c262ec4b86605a44cd0f02512b514241a3c2d4788c527308dc974382bd3c4ab0af74fe2e064235ed0c65
-
Filesize
392KB
MD5712a19e062672ca95f393732f9250b6e
SHA1687c166c40697686aecd7c5dac972361f3362676
SHA256d746e41e18bb637062881aca207186dc3d005e79c857e025f89ce2a1b3e52ecf
SHA51233d5779bae56f7231f841f691ed4ae48641a80baedb5c262ec4b86605a44cd0f02512b514241a3c2d4788c527308dc974382bd3c4ab0af74fe2e064235ed0c65