Analysis
-
max time kernel
104s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
31-07-2022 04:54
Static task
static1
Behavioral task
behavioral1
Sample
ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exe
Resource
win7-20220718-en
General
-
Target
ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exe
-
Size
318KB
-
MD5
518c5cb213e1f22ee55fec3a22a0cab7
-
SHA1
3ecfc50dae59b216f4ab99a8c0262ff2a7bb3bba
-
SHA256
ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc
-
SHA512
9caa7aa7ee34b9fd8065d02e5266f6c22e29e13d2aec53727a99e0335bfbc4828b2266bc92239d4c95bc09de62244baf2b64e4f0c9491b91fe5377fd4d02257f
Malware Config
Extracted
phorphiex
http://193.32.161.73/
1L6sJ7pmk6EGMUoTmpdbLez9dXACcirRHh
qzgdgnfd805z83wpu04rhld0yqs4dlrd35ll0ltqql
Xt8ZtCcG9BFoc7NfUNBVnxcTvYT4mmzh5i
D7otx94yAiXMUuuff23v8PAYH5XpkdQ89M
0xa5228127395263575a4b4f532e4f132b14599d24
LUMrZN6GTetcrXtzMmRayLpRN9JrCNcTe7
t1PVHo3JR9ZAxMxRXgTziGBeDwfb5Gwm64z
Signatures
-
Processes:
sysixtr.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection sysixtr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" sysixtr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" sysixtr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" sysixtr.exe -
Phorphiex payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1832-56-0x0000000000370000-0x000000000037D000-memory.dmp family_phorphiex behavioral1/memory/2044-68-0x0000000000200000-0x000000000020D000-memory.dmp family_phorphiex -
Processes:
sysixtr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysixtr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysixtr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysixtr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysixtr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysixtr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" sysixtr.exe -
Executes dropped EXE 1 IoCs
Processes:
sysixtr.exepid process 2044 sysixtr.exe -
Loads dropped DLL 7 IoCs
Processes:
ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exeWerFault.exepid process 1832 ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exe 1832 ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exe 764 WerFault.exe 764 WerFault.exe 764 WerFault.exe 764 WerFault.exe 764 WerFault.exe -
Processes:
sysixtr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1" sysixtr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysixtr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysixtr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysixtr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" sysixtr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysixtr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysixtr.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Driver = "C:\\Windows\\2170516046\\sysixtr.exe" ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Driver = "C:\\Windows\\2170516046\\sysixtr.exe" ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exe -
Drops file in Program Files directory 3 IoCs
Processes:
sysixtr.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7z.exe sysixtr.exe File opened for modification C:\Program Files\7-Zip\7zfm.exe sysixtr.exe File opened for modification C:\Program Files\7-Zip\7zg.exe sysixtr.exe -
Drops file in Windows directory 3 IoCs
Processes:
ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exedescription ioc process File created C:\Windows\2170516046\sysixtr.exe ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exe File opened for modification C:\Windows\2170516046\sysixtr.exe ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exe File opened for modification C:\Windows\2170516046 ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 764 2044 WerFault.exe sysixtr.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exesysixtr.exepid process 1832 ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exe 1832 ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exe 1832 ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exe 1832 ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exe 1832 ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exe 1832 ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exe 1832 ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exe 1832 ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exe 1832 ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exe 2044 sysixtr.exe 2044 sysixtr.exe 2044 sysixtr.exe 2044 sysixtr.exe 2044 sysixtr.exe 2044 sysixtr.exe 2044 sysixtr.exe 2044 sysixtr.exe 2044 sysixtr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exesysixtr.exedescription pid process Token: SeDebugPrivilege 1832 ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exe Token: SeDebugPrivilege 2044 sysixtr.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exesysixtr.exepid process 1832 ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exe 1832 ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exe 2044 sysixtr.exe 2044 sysixtr.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exesysixtr.exedescription pid process target process PID 1832 wrote to memory of 2044 1832 ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exe sysixtr.exe PID 1832 wrote to memory of 2044 1832 ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exe sysixtr.exe PID 1832 wrote to memory of 2044 1832 ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exe sysixtr.exe PID 1832 wrote to memory of 2044 1832 ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exe sysixtr.exe PID 2044 wrote to memory of 764 2044 sysixtr.exe WerFault.exe PID 2044 wrote to memory of 764 2044 sysixtr.exe WerFault.exe PID 2044 wrote to memory of 764 2044 sysixtr.exe WerFault.exe PID 2044 wrote to memory of 764 2044 sysixtr.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exe"C:\Users\Admin\AppData\Local\Temp\ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\2170516046\sysixtr.exeC:\Windows\2170516046\sysixtr.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 15483⤵
- Loads dropped DLL
- Program crash
PID:764
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
318KB
MD5518c5cb213e1f22ee55fec3a22a0cab7
SHA13ecfc50dae59b216f4ab99a8c0262ff2a7bb3bba
SHA256ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc
SHA5129caa7aa7ee34b9fd8065d02e5266f6c22e29e13d2aec53727a99e0335bfbc4828b2266bc92239d4c95bc09de62244baf2b64e4f0c9491b91fe5377fd4d02257f
-
Filesize
318KB
MD5518c5cb213e1f22ee55fec3a22a0cab7
SHA13ecfc50dae59b216f4ab99a8c0262ff2a7bb3bba
SHA256ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc
SHA5129caa7aa7ee34b9fd8065d02e5266f6c22e29e13d2aec53727a99e0335bfbc4828b2266bc92239d4c95bc09de62244baf2b64e4f0c9491b91fe5377fd4d02257f
-
Filesize
318KB
MD5518c5cb213e1f22ee55fec3a22a0cab7
SHA13ecfc50dae59b216f4ab99a8c0262ff2a7bb3bba
SHA256ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc
SHA5129caa7aa7ee34b9fd8065d02e5266f6c22e29e13d2aec53727a99e0335bfbc4828b2266bc92239d4c95bc09de62244baf2b64e4f0c9491b91fe5377fd4d02257f
-
Filesize
318KB
MD5518c5cb213e1f22ee55fec3a22a0cab7
SHA13ecfc50dae59b216f4ab99a8c0262ff2a7bb3bba
SHA256ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc
SHA5129caa7aa7ee34b9fd8065d02e5266f6c22e29e13d2aec53727a99e0335bfbc4828b2266bc92239d4c95bc09de62244baf2b64e4f0c9491b91fe5377fd4d02257f
-
Filesize
318KB
MD5518c5cb213e1f22ee55fec3a22a0cab7
SHA13ecfc50dae59b216f4ab99a8c0262ff2a7bb3bba
SHA256ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc
SHA5129caa7aa7ee34b9fd8065d02e5266f6c22e29e13d2aec53727a99e0335bfbc4828b2266bc92239d4c95bc09de62244baf2b64e4f0c9491b91fe5377fd4d02257f
-
Filesize
318KB
MD5518c5cb213e1f22ee55fec3a22a0cab7
SHA13ecfc50dae59b216f4ab99a8c0262ff2a7bb3bba
SHA256ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc
SHA5129caa7aa7ee34b9fd8065d02e5266f6c22e29e13d2aec53727a99e0335bfbc4828b2266bc92239d4c95bc09de62244baf2b64e4f0c9491b91fe5377fd4d02257f
-
Filesize
318KB
MD5518c5cb213e1f22ee55fec3a22a0cab7
SHA13ecfc50dae59b216f4ab99a8c0262ff2a7bb3bba
SHA256ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc
SHA5129caa7aa7ee34b9fd8065d02e5266f6c22e29e13d2aec53727a99e0335bfbc4828b2266bc92239d4c95bc09de62244baf2b64e4f0c9491b91fe5377fd4d02257f
-
Filesize
318KB
MD5518c5cb213e1f22ee55fec3a22a0cab7
SHA13ecfc50dae59b216f4ab99a8c0262ff2a7bb3bba
SHA256ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc
SHA5129caa7aa7ee34b9fd8065d02e5266f6c22e29e13d2aec53727a99e0335bfbc4828b2266bc92239d4c95bc09de62244baf2b64e4f0c9491b91fe5377fd4d02257f
-
Filesize
318KB
MD5518c5cb213e1f22ee55fec3a22a0cab7
SHA13ecfc50dae59b216f4ab99a8c0262ff2a7bb3bba
SHA256ce8b46fe16021f65d5098ec9330b47aad163072a9b2ae4ae6f3a1cd5629adbcc
SHA5129caa7aa7ee34b9fd8065d02e5266f6c22e29e13d2aec53727a99e0335bfbc4828b2266bc92239d4c95bc09de62244baf2b64e4f0c9491b91fe5377fd4d02257f