Overview

overview

10

Static

static

phobos.exe

windows7-x64

10

phobos.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-08-2022 16:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    phobos.exe

  • Size

    71KB

  • MD5

    e59ffeaf7acb0c326e452fa30bb71a36

  • SHA1

    c88fad293256bfead6962124394de4f8b97765aa

  • SHA256

    a91491f45b851a07f91ba5a200967921bf796d38677786de51a4a8fe5ddeafd2

  • SHA512

    737937ac074b1754878f9548be0fae43a18b88ed669a5626468763577d254ef4cd833686d3b9ed5a3169eb8dd1593ca03a74f5ba4664ccc1446d9b85d2f316b3

Score
10/10
phobosevasionpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\info.hta

Ransom Note
All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Write this ID in the title of your message 04AF3D1F-1096 If there is no response from our mail, you can install the Jabber client and write to us in support of [email protected] You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 10Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Jabber client installation instructions: Download the jabber (Pidgin) client from https://pidgin.im/download/windows/ After installation, the Pidgin client will prompt you to create a new account. Click "Add" In the "Protocol" field, select XMPP In "Username" - come up with any name In the field "domain" - enter any jabber-server, there are a lot of them, for example - exploit.im Create a password At the bottom, put a tick "Create account" Click add If you selected "domain" - exploit.im, then a new window should appear in which you will need to re-enter your data: User password You will need to follow the link to the captcha (there you will see the characters that you need to enter in the field below) If you don't understand our Pidgin client installation instructions, you can find many installation tutorials on youtube - https://www.youtube.com/results?search_query=pidgin+jabber+install Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
URLs

https://pidgin.im/download/windows/

Signatures

  • Phobos

    Phobos ransomware appeared at the beginning of 2019.

    ransomwarephobos
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
    ransomwareevasion
  • Modifies Windows Firewall 1 TTPs 2 IoCs
    evasion
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 63 IoCs
  • Suspicious use of SendNotifyMessage 62 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\phobos.exe
    "C:\Users\Admin\AppData\Local\Temp\phobos.exe"
    1⤵
    • Modifies extensions of user files
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4716
    • C:\Users\Admin\AppData\Local\Temp\phobos.exe
      "C:\Users\Admin\AppData\Local\Temp\phobos.exe"
      2⤵
        PID:5028
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1412
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:2792
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4092
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:224
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled no
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:4780
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:312
        • C:\Windows\system32\netsh.exe
          netsh advfirewall set currentprofile state off
          3⤵
          • Modifies Windows Firewall
          PID:1472
        • C:\Windows\system32\netsh.exe
          netsh firewall set opmode mode=disable
          3⤵
          • Modifies Windows Firewall
          PID:3632
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        2⤵
          PID:512
        • C:\Windows\SysWOW64\mshta.exe
          "C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
          2⤵
            PID:5012
          • C:\Windows\SysWOW64\mshta.exe
            "C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
            2⤵
              PID:2308
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3868
              • C:\Windows\system32\vssadmin.exe
                vssadmin delete shadows /all /quiet
                3⤵
                • Interacts with shadow copies
                PID:3980
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic shadowcopy delete
                3⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1004
              • C:\Windows\system32\bcdedit.exe
                bcdedit /set {default} bootstatuspolicy ignoreallfailures
                3⤵
                • Modifies boot configuration data using bcdedit
                PID:2636
              • C:\Windows\system32\bcdedit.exe
                bcdedit /set {default} recoveryenabled no
                3⤵
                • Modifies boot configuration data using bcdedit
                PID:320
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
            1⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5052
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1068
          • C:\Windows\system32\taskmgr.exe
            "C:\Windows\system32\taskmgr.exe" /0
            1⤵
            • Drops startup file
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:2504
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -pss -s 456 -p 696 -ip 696
            1⤵
              PID:1424
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 696 -s 836
              1⤵
              • Program crash
              PID:2184

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[04AF3D1F-1096].[[email protected]].acute
              Filesize

              418B

              MD5

              10dcc2e8511d2fa66096030cf90c9056

              SHA1

              bca7f17929f0b0bcd2073d694a07d164fea7577a

              SHA256

              34448e04c40e3356741205d9edbdeb180571d3267fed0fa067aff5c9c2db7a47

              SHA512

              b75d8b945f8546a7b7a8243a8a8ec2560a185fa6a866d74bb55b4fddf40b6d0bda94bcbee1cfbf193cb708b2247602aaa5404c61f1b18642030afd71ba9f9dc3

              Download Submit

            • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\phobos.exe
              Filesize

              71KB

              MD5

              e59ffeaf7acb0c326e452fa30bb71a36

              SHA1

              c88fad293256bfead6962124394de4f8b97765aa

              SHA256

              a91491f45b851a07f91ba5a200967921bf796d38677786de51a4a8fe5ddeafd2

              SHA512

              737937ac074b1754878f9548be0fae43a18b88ed669a5626468763577d254ef4cd833686d3b9ed5a3169eb8dd1593ca03a74f5ba4664ccc1446d9b85d2f316b3

              Download Submit

            • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
              Filesize

              64KB

              MD5

              d2fb266b97caff2086bf0fa74eddb6b2

              SHA1

              2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

              SHA256

              b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

              SHA512

              c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

              Download Submit

            • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
              Filesize

              4B

              MD5

              f49655f856acb8884cc0ace29216f511

              SHA1

              cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

              SHA256

              7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

              SHA512

              599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

              Download Submit

            • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
              Filesize

              944B

              MD5

              6bd369f7c74a28194c991ed1404da30f

              SHA1

              0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

              SHA256

              878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

              SHA512

              8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

              Download Submit

            • C:\Users\Admin\AppData\Local\phobos.exe
              Filesize

              71KB

              MD5

              e59ffeaf7acb0c326e452fa30bb71a36

              SHA1

              c88fad293256bfead6962124394de4f8b97765aa

              SHA256

              a91491f45b851a07f91ba5a200967921bf796d38677786de51a4a8fe5ddeafd2

              SHA512

              737937ac074b1754878f9548be0fae43a18b88ed669a5626468763577d254ef4cd833686d3b9ed5a3169eb8dd1593ca03a74f5ba4664ccc1446d9b85d2f316b3

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[04AF3D1F-1096].[[email protected]].acute
              Filesize

              418B

              MD5

              f42da0d6e4dc9c9d4156a0fa2dc310e9

              SHA1

              e4e477621203cbc161cbd694c52522329ee69159

              SHA256

              007644af8ea5177772e00ebb4ddb44e8064c97e50d389f780e43a394724e0fb6

              SHA512

              322169cb8ed01817b912096a5b3f09ac07267b417478209b5a781be7a9a08e2aaaea399cf8a2e896b08ebf75200603ec3dd76fb0cf25299d956667fa6e1a9e2e

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\phobos.exe
              Filesize

              71KB

              MD5

              e59ffeaf7acb0c326e452fa30bb71a36

              SHA1

              c88fad293256bfead6962124394de4f8b97765aa

              SHA256

              a91491f45b851a07f91ba5a200967921bf796d38677786de51a4a8fe5ddeafd2

              SHA512

              737937ac074b1754878f9548be0fae43a18b88ed669a5626468763577d254ef4cd833686d3b9ed5a3169eb8dd1593ca03a74f5ba4664ccc1446d9b85d2f316b3

              Download Submit

            • C:\Users\Admin\Desktop\info.hta
              Filesize

              6KB

              MD5

              a00141858dd45364c19325e191eb4489

              SHA1

              186dc8cad290d520fb66e1525d2223dadf0f694d

              SHA256

              533d1b3797533c273f61338d56e2b527d4ac5c3b1790573ea9d0b94ee08c7036

              SHA512

              288b2cc2dd77e38fb08ed7953b7b923c4490996c9a4f7d53165257a0032727208b946e83b92701814221cdf2e16e7e4ad5e9130cf30edd18270b529595d6818f

              Download Submit

            • C:\info.hta
              Filesize

              6KB

              MD5

              a00141858dd45364c19325e191eb4489

              SHA1

              186dc8cad290d520fb66e1525d2223dadf0f694d

              SHA256

              533d1b3797533c273f61338d56e2b527d4ac5c3b1790573ea9d0b94ee08c7036

              SHA512

              288b2cc2dd77e38fb08ed7953b7b923c4490996c9a4f7d53165257a0032727208b946e83b92701814221cdf2e16e7e4ad5e9130cf30edd18270b529595d6818f

              Download Submit

            • C:\users\public\desktop\info.hta
              Filesize

              6KB

              MD5

              a00141858dd45364c19325e191eb4489

              SHA1

              186dc8cad290d520fb66e1525d2223dadf0f694d

              SHA256

              533d1b3797533c273f61338d56e2b527d4ac5c3b1790573ea9d0b94ee08c7036

              SHA512

              288b2cc2dd77e38fb08ed7953b7b923c4490996c9a4f7d53165257a0032727208b946e83b92701814221cdf2e16e7e4ad5e9130cf30edd18270b529595d6818f

              Download Submit

            • memory/224-139-0x0000000000000000-mapping.dmp

              Download

            • memory/312-133-0x0000000000000000-mapping.dmp

              Download

            • memory/320-159-0x0000000000000000-mapping.dmp

              Download

            • memory/512-149-0x0000000000000000-mapping.dmp

              Download

            • memory/1004-157-0x0000000000000000-mapping.dmp

              Download

            • memory/1412-134-0x0000000000000000-mapping.dmp

              Download

            • memory/1472-136-0x0000000000000000-mapping.dmp

              Download

            • memory/2308-151-0x0000000000000000-mapping.dmp

              Download

            • memory/2636-158-0x0000000000000000-mapping.dmp

              Download

            • memory/2792-135-0x0000000000000000-mapping.dmp

              Download

            • memory/3632-138-0x0000000000000000-mapping.dmp

              Download

            • memory/3868-152-0x0000000000000000-mapping.dmp

              Download

            • memory/3980-156-0x0000000000000000-mapping.dmp

              Download

            • memory/4092-137-0x0000000000000000-mapping.dmp

              Download

            • memory/4780-140-0x0000000000000000-mapping.dmp

              Download

            • memory/5012-150-0x0000000000000000-mapping.dmp

              Download

            • memory/5028-132-0x0000000000000000-mapping.dmp

              Download