Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
13-08-2022 13:00
Behavioral task
behavioral1
Sample
516319480.exe
Resource
win7-20220812-en
General
-
Target
516319480.exe
-
Size
75KB
-
MD5
5741eadfc89a1352c61f1ff0a5c01c06
-
SHA1
cdff6ddd67f17385f283a0f9e8de76731f11a9b6
-
SHA256
ea500d77aabc3c9d440480002c3f1d2f2977a7f860f35260edda8a26406ca1c3
-
SHA512
08104893c726e06c6fe7687394d084365b72cf19e821be0d7a1b094c9a0d54ccea65fd01ea33a1f507680d21c6f98e62e2d765b4a0ce3b3d8d458063bd375063
Malware Config
Extracted
phorphiex
http://185.215.113.84/twizt/
12SJv5p8xUHeiKnXPCDaKCMpqvXj7TABT5BSxGt3csz9Beuc
1A6utf8R2zfLL7X31T5QRHdQyAx16BjdFD
3PFzu8Rw8aDNhDT6d5FMrZ3ckE4dEHzogfg
3BJS4zYwrnfcJMm4xLxRcsa69ght8n6QWz
qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k
XgWbWpuyPGney7hcS9vZ7eNhkj7WcvGcj8
DPcSSyFAYLu4aEB4s1Yotb8ANwtx6bZEQG
0xb899fC445a1b61Cdd62266795193203aa72351fE
LRDpmP5wHZ82LZimzWDLHVqJPDSpkM1gZ7
r1eZ7W1fmUT9tiUZwK6rr3g6RNiE4QpU1
TBdEh7r35ywUD5omutc2kDTX7rXhnFkxy5
t1T7mBRBgTYPEL9RPPBnAVgcftiWUPBFWyy
AGUqhQzF52Qwbvun5wQSrpokPtCC4b9yiX
bitcoincash:qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k
4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK
GCVFMTUKNLFBGHE3AHRJH4IJDRZGWOJ6JD2FQTFQAAIQR64ALD7QJHUY
bnb1rcg9mnkzna2tw4u8ughyaj6ja8feyj87hss9ky
bc1qzs2hs5dvyx04h0erq4ea72sctcre2rcwadsq2v
Signatures
-
Processes:
wcdsemgr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" wcdsemgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" wcdsemgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" wcdsemgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" wcdsemgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" wcdsemgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" wcdsemgr.exe -
Executes dropped EXE 3 IoCs
Processes:
wcdsemgr.exe469420666.exe2356332166.exepid process 1984 wcdsemgr.exe 1840 469420666.exe 1084 2356332166.exe -
Loads dropped DLL 2 IoCs
Processes:
wcdsemgr.exepid process 1984 wcdsemgr.exe 1984 wcdsemgr.exe -
Processes:
wcdsemgr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" wcdsemgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" wcdsemgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" wcdsemgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" wcdsemgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" wcdsemgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" wcdsemgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" wcdsemgr.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
516319480.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\wcdsemgr.exe" 516319480.exe -
Drops file in Windows directory 2 IoCs
Processes:
516319480.exedescription ioc process File created C:\Windows\wcdsemgr.exe 516319480.exe File opened for modification C:\Windows\wcdsemgr.exe 516319480.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
516319480.exewcdsemgr.exedescription pid process target process PID 1820 wrote to memory of 1984 1820 516319480.exe wcdsemgr.exe PID 1820 wrote to memory of 1984 1820 516319480.exe wcdsemgr.exe PID 1820 wrote to memory of 1984 1820 516319480.exe wcdsemgr.exe PID 1820 wrote to memory of 1984 1820 516319480.exe wcdsemgr.exe PID 1984 wrote to memory of 1840 1984 wcdsemgr.exe 469420666.exe PID 1984 wrote to memory of 1840 1984 wcdsemgr.exe 469420666.exe PID 1984 wrote to memory of 1840 1984 wcdsemgr.exe 469420666.exe PID 1984 wrote to memory of 1840 1984 wcdsemgr.exe 469420666.exe PID 1984 wrote to memory of 1084 1984 wcdsemgr.exe 2356332166.exe PID 1984 wrote to memory of 1084 1984 wcdsemgr.exe 2356332166.exe PID 1984 wrote to memory of 1084 1984 wcdsemgr.exe 2356332166.exe PID 1984 wrote to memory of 1084 1984 wcdsemgr.exe 2356332166.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\516319480.exe"C:\Users\Admin\AppData\Local\Temp\516319480.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\wcdsemgr.exeC:\Windows\wcdsemgr.exe2⤵
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\469420666.exeC:\Users\Admin\AppData\Local\Temp\469420666.exe3⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\2356332166.exeC:\Users\Admin\AppData\Local\Temp\2356332166.exe3⤵
- Executes dropped EXE
PID:1084
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5a475e43527d7dc7d6f2d23bad64fcc99
SHA1793a7625c0106d6cd79d060b4eec94e58530833e
SHA256f97c43bf3dce6180e658f2c3776e31cf52472b28ac8249be4d307880b6405eeb
SHA5124af57a218d7d790b5ec4581dd2bc941deff05ea11bf6054a9d268c054af421977cdd68d5090884358208925f50023c97e9cfaba0831d72e9bcdcca729447d900
-
Filesize
9KB
MD5c8a69840ffff790ea975bb0cf55f7f4d
SHA1dd1c74f0eb2fc813d16c96669e22fb657b67c4b3
SHA256e532a8c62dbf01fecc09896f376e689ee836c5498ff24586ed142f72cfd174dc
SHA512df22b912e15640cd1c5f91908e1e2d2b4fc7be27d54415fd2c0ba5f0de83a785662b67912e4513e13fde30abab4082763d4dd6e65ddc2cdfe47bbe6ee40d249a
-
Filesize
75KB
MD55741eadfc89a1352c61f1ff0a5c01c06
SHA1cdff6ddd67f17385f283a0f9e8de76731f11a9b6
SHA256ea500d77aabc3c9d440480002c3f1d2f2977a7f860f35260edda8a26406ca1c3
SHA51208104893c726e06c6fe7687394d084365b72cf19e821be0d7a1b094c9a0d54ccea65fd01ea33a1f507680d21c6f98e62e2d765b4a0ce3b3d8d458063bd375063
-
Filesize
75KB
MD55741eadfc89a1352c61f1ff0a5c01c06
SHA1cdff6ddd67f17385f283a0f9e8de76731f11a9b6
SHA256ea500d77aabc3c9d440480002c3f1d2f2977a7f860f35260edda8a26406ca1c3
SHA51208104893c726e06c6fe7687394d084365b72cf19e821be0d7a1b094c9a0d54ccea65fd01ea33a1f507680d21c6f98e62e2d765b4a0ce3b3d8d458063bd375063
-
Filesize
6KB
MD5a475e43527d7dc7d6f2d23bad64fcc99
SHA1793a7625c0106d6cd79d060b4eec94e58530833e
SHA256f97c43bf3dce6180e658f2c3776e31cf52472b28ac8249be4d307880b6405eeb
SHA5124af57a218d7d790b5ec4581dd2bc941deff05ea11bf6054a9d268c054af421977cdd68d5090884358208925f50023c97e9cfaba0831d72e9bcdcca729447d900
-
Filesize
9KB
MD5c8a69840ffff790ea975bb0cf55f7f4d
SHA1dd1c74f0eb2fc813d16c96669e22fb657b67c4b3
SHA256e532a8c62dbf01fecc09896f376e689ee836c5498ff24586ed142f72cfd174dc
SHA512df22b912e15640cd1c5f91908e1e2d2b4fc7be27d54415fd2c0ba5f0de83a785662b67912e4513e13fde30abab4082763d4dd6e65ddc2cdfe47bbe6ee40d249a