Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
25-07-2022 04:40
Static task
static1
Behavioral task
behavioral1
Sample
b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exe
Resource
win7-20220718-en
General
-
Target
b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exe
-
Size
368KB
-
MD5
4edd5e53432ee2fde30e94e4887dec54
-
SHA1
6bb5c8be14d8da80f0f96c99fa2df3bb7124c965
-
SHA256
b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f
-
SHA512
28723099729b415b3af80922d7983fa07ba7bad88276d35ac9a481aed0e77f435bebb8460c6a8948068577ebda2d692e0622a2f9f181ded29475cb68e5d45eaa
Malware Config
Extracted
phorphiex
http://185.176.27.132/
13cQ2H6oszrEnvw1ZGdsPix9gUayB8tzNa
qr5pm4d27z250wpz4sfy08ytghxn56kryvsw5tdw99
XfrM8P9YWSg8mQTxSCCxyHUeQjMEGx8vnE
DSG5PddW9wu1eKdLcx4f3KBF4wUvaBFaGc
0x373b9854c9e4511b920372f5495640cdc25d6832
LSermtCTLWeS683x17AtYuhNT8MpMmVmi8
t1XgRHyGj6YDNqkS5EWwdcXG1rjQPFFdUsR
Signatures
-
Processes:
sysvywj.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection sysvywj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" sysvywj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" sysvywj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" sysvywj.exe -
Phorphiex payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/308-56-0x00000000003F0000-0x00000000003FE000-memory.dmp family_phorphiex -
Processes:
sysvywj.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysvywj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysvywj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" sysvywj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysvywj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysvywj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysvywj.exe -
suricata: ET MALWARE APT-C-23 Activity (GET)
suricata: ET MALWARE APT-C-23 Activity (GET)
-
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
-
Executes dropped EXE 1 IoCs
Processes:
sysvywj.exepid process 1536 sysvywj.exe -
Loads dropped DLL 2 IoCs
Processes:
b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exepid process 308 b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exe 308 b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exe -
Processes:
sysvywj.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1" sysvywj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysvywj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysvywj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysvywj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" sysvywj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysvywj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysvywj.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Driver = "C:\\Windows\\654929637\\sysvywj.exe" b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Driver = "C:\\Windows\\654929637\\sysvywj.exe" b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exe -
Drops file in Windows directory 3 IoCs
Processes:
b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exedescription ioc process File created C:\Windows\654929637\sysvywj.exe b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exe File opened for modification C:\Windows\654929637\sysvywj.exe b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exe File opened for modification C:\Windows\654929637 b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exesysvywj.exepid process 308 b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exe 308 b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exe 308 b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exe 308 b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exe 308 b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exe 308 b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exe 308 b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exe 308 b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exe 308 b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exe 1536 sysvywj.exe 1536 sysvywj.exe 1536 sysvywj.exe 1536 sysvywj.exe 1536 sysvywj.exe 1536 sysvywj.exe 1536 sysvywj.exe 1536 sysvywj.exe 1536 sysvywj.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exesysvywj.exedescription pid process Token: SeDebugPrivilege 308 b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exe Token: SeDebugPrivilege 1536 sysvywj.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exesysvywj.exepid process 308 b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exe 308 b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exe 1536 sysvywj.exe 1536 sysvywj.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exedescription pid process target process PID 308 wrote to memory of 1536 308 b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exe sysvywj.exe PID 308 wrote to memory of 1536 308 b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exe sysvywj.exe PID 308 wrote to memory of 1536 308 b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exe sysvywj.exe PID 308 wrote to memory of 1536 308 b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exe sysvywj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exe"C:\Users\Admin\AppData\Local\Temp\b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\654929637\sysvywj.exeC:\Windows\654929637\sysvywj.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\654929637\sysvywj.exeFilesize
368KB
MD54edd5e53432ee2fde30e94e4887dec54
SHA16bb5c8be14d8da80f0f96c99fa2df3bb7124c965
SHA256b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f
SHA51228723099729b415b3af80922d7983fa07ba7bad88276d35ac9a481aed0e77f435bebb8460c6a8948068577ebda2d692e0622a2f9f181ded29475cb68e5d45eaa
-
C:\Windows\654929637\sysvywj.exeFilesize
368KB
MD54edd5e53432ee2fde30e94e4887dec54
SHA16bb5c8be14d8da80f0f96c99fa2df3bb7124c965
SHA256b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f
SHA51228723099729b415b3af80922d7983fa07ba7bad88276d35ac9a481aed0e77f435bebb8460c6a8948068577ebda2d692e0622a2f9f181ded29475cb68e5d45eaa
-
\Windows\654929637\sysvywj.exeFilesize
368KB
MD54edd5e53432ee2fde30e94e4887dec54
SHA16bb5c8be14d8da80f0f96c99fa2df3bb7124c965
SHA256b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f
SHA51228723099729b415b3af80922d7983fa07ba7bad88276d35ac9a481aed0e77f435bebb8460c6a8948068577ebda2d692e0622a2f9f181ded29475cb68e5d45eaa
-
\Windows\654929637\sysvywj.exeFilesize
368KB
MD54edd5e53432ee2fde30e94e4887dec54
SHA16bb5c8be14d8da80f0f96c99fa2df3bb7124c965
SHA256b65cdaaf688423fb0d3b02e18dfa814ebc6bc2e4637e8a40f9c64c802b7f219f
SHA51228723099729b415b3af80922d7983fa07ba7bad88276d35ac9a481aed0e77f435bebb8460c6a8948068577ebda2d692e0622a2f9f181ded29475cb68e5d45eaa
-
memory/308-54-0x0000000075C51000-0x0000000075C53000-memory.dmpFilesize
8KB
-
memory/308-55-0x0000000000400000-0x0000000000460000-memory.dmpFilesize
384KB
-
memory/308-56-0x00000000003F0000-0x00000000003FE000-memory.dmpFilesize
56KB
-
memory/308-62-0x0000000000400000-0x0000000000460000-memory.dmpFilesize
384KB
-
memory/1536-64-0x0000000000000000-mapping.dmp
-
memory/1536-67-0x0000000000400000-0x0000000000460000-memory.dmpFilesize
384KB
-
memory/1536-74-0x0000000000400000-0x0000000000460000-memory.dmpFilesize
384KB