phorphiex | a3172e45bb1824fa625a04ff1d7e08617de13309ba9d31fb6b03ec9a921f345b

Analysis

max time kernel
151s
max time network
101s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-09-2022 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8d0ac5762f61683d7cbcbfc53e0b650e632625d7ffabf08b45986908891ee96.exe
Size

9KB
MD5

fe304e909fb1f67c4d9030fc74d0a2f1
SHA1

1102fb973b3b83bbd5749db3ceb9405443c09dfe
SHA256

a8d0ac5762f61683d7cbcbfc53e0b650e632625d7ffabf08b45986908891ee96
SHA512

46f797b30affdc7bc2291b2b1fb064246a7aa2359072380468abce1423b338859c0ad45b02c2dc5623d167ef51c65414e06890c7c9dfe4b9e305a0b70257f1aa
SSDEEP

192:oeJbEZ11AsLvRP1oynfUOMNc1Fu669tk2Hv:BJwZ11T51BUOMNqF96s

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Extracted

Family

phorphiex

http://185.215.113.66/twizt/

Wallets

12SJv5p8xUHeiKnXPCDaKCMpqvXj7TABT5BSxGt3csz9Beuc

1A6utf8R2zfLL7X31T5QRHdQyAx16BjdFD

3PFzu8Rw8aDNhDT6d5FMrZ3ckE4dEHzogfg

3BJS4zYwrnfcJMm4xLxRcsa69ght8n6QWz

qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k

XgWbWpuyPGney7hcS9vZ7eNhkj7WcvGcj8

DPcSSyFAYLu4aEB4s1Yotb8ANwtx6bZEQG

0xb899fC445a1b61Cdd62266795193203aa72351fE

LRDpmP5wHZ82LZimzWDLHVqJPDSpkM1gZ7

r1eZ7W1fmUT9tiUZwK6rr3g6RNiE4QpU1

TBdEh7r35ywUD5omutc2kDTX7rXhnFkxy5

t1T7mBRBgTYPEL9RPPBnAVgcftiWUPBFWyy

AGUqhQzF52Qwbvun5wQSrpokPtCC4b9yiX

bitcoincash:qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k

43ABGVDKXksdy7UTP8aHqkRf4xAVDmKKXBYDRevAadwaLJhHzH4ubZHGLjVpLc5ZWk7TVmHbHHAWUBF78mx1YG4eNbww6fr

GCVFMTUKNLFBGHE3AHRJH4IJDRZGWOJ6JD2FQTFQAAIQR64ALD7QJHUY

bnb1rcg9mnkzna2tw4u8ughyaj6ja8feyj87hss9ky

bc1qzs2hs5dvyx04h0erq4ea72sctcre2rcwadsq2v

Signatures

Phorphiex
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winuedrvs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	winuedrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	winuedrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	winuedrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winuedrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	winuedrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winuedrvs.exe

Downloads MZ/PE file
Executes dropped EXE 4 IoCs

Processes:

155217673.scrwinuedrvs.exe34748149.exe222168598.exe

pid process

304 155217673.scr
1068 winuedrvs.exe
1940 34748149.exe
1600 222168598.exe

pid	process
304	155217673.scr
1068	winuedrvs.exe
1940	34748149.exe
1600	222168598.exe

Loads dropped DLL 4 IoCs

Processes:

a8d0ac5762f61683d7cbcbfc53e0b650e632625d7ffabf08b45986908891ee96.exewinuedrvs.exe

pid	process
1416	a8d0ac5762f61683d7cbcbfc53e0b650e632625d7ffabf08b45986908891ee96.exe
1416	a8d0ac5762f61683d7cbcbfc53e0b650e632625d7ffabf08b45986908891ee96.exe
1068	winuedrvs.exe
1068	winuedrvs.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winuedrvs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	winuedrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winuedrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	winuedrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	winuedrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winuedrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	winuedrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	winuedrvs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

155217673.scr

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\winuedrvs.exe"	155217673.scr

Drops file in Windows directory 2 IoCs

Processes:

155217673.scr

description ioc process

File created C:\Windows\winuedrvs.exe 155217673.scr
File opened for modification C:\Windows\winuedrvs.exe 155217673.scr
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

34748149.exe

pid process

1940 34748149.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

34748149.exe

description pid process

Token: SeDebugPrivilege 1940 34748149.exe

description	ioc	process
File created	C:\Windows\winuedrvs.exe	155217673.scr
File opened for modification	C:\Windows\winuedrvs.exe	155217673.scr

pid	process
1940	34748149.exe

description	pid	process
Token: SeDebugPrivilege	1940	34748149.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

a8d0ac5762f61683d7cbcbfc53e0b650e632625d7ffabf08b45986908891ee96.exe155217673.scrwinuedrvs.exe34748149.execmd.execmd.exe

description	pid	process	target process
PID 1416 wrote to memory of 304	1416	a8d0ac5762f61683d7cbcbfc53e0b650e632625d7ffabf08b45986908891ee96.exe	155217673.scr
PID 1416 wrote to memory of 304	1416	a8d0ac5762f61683d7cbcbfc53e0b650e632625d7ffabf08b45986908891ee96.exe	155217673.scr
PID 1416 wrote to memory of 304	1416	a8d0ac5762f61683d7cbcbfc53e0b650e632625d7ffabf08b45986908891ee96.exe	155217673.scr
PID 1416 wrote to memory of 304	1416	a8d0ac5762f61683d7cbcbfc53e0b650e632625d7ffabf08b45986908891ee96.exe	155217673.scr
PID 304 wrote to memory of 1068	304	155217673.scr	winuedrvs.exe
PID 304 wrote to memory of 1068	304	155217673.scr	winuedrvs.exe
PID 304 wrote to memory of 1068	304	155217673.scr	winuedrvs.exe
PID 304 wrote to memory of 1068	304	155217673.scr	winuedrvs.exe
PID 1068 wrote to memory of 1940	1068	winuedrvs.exe	34748149.exe
PID 1068 wrote to memory of 1940	1068	winuedrvs.exe	34748149.exe
PID 1068 wrote to memory of 1940	1068	winuedrvs.exe	34748149.exe
PID 1068 wrote to memory of 1940	1068	winuedrvs.exe	34748149.exe
PID 1940 wrote to memory of 1724	1940	34748149.exe	cmd.exe
PID 1940 wrote to memory of 1724	1940	34748149.exe	cmd.exe
PID 1940 wrote to memory of 1724	1940	34748149.exe	cmd.exe
PID 1724 wrote to memory of 1900	1724	cmd.exe	reg.exe
PID 1724 wrote to memory of 1900	1724	cmd.exe	reg.exe
PID 1724 wrote to memory of 1900	1724	cmd.exe	reg.exe
PID 1940 wrote to memory of 436	1940	34748149.exe	cmd.exe
PID 1940 wrote to memory of 436	1940	34748149.exe	cmd.exe
PID 1940 wrote to memory of 436	1940	34748149.exe	cmd.exe
PID 436 wrote to memory of 796	436	cmd.exe	schtasks.exe
PID 436 wrote to memory of 796	436	cmd.exe	schtasks.exe
PID 436 wrote to memory of 796	436	cmd.exe	schtasks.exe
PID 1068 wrote to memory of 1600	1068	winuedrvs.exe	222168598.exe
PID 1068 wrote to memory of 1600	1068	winuedrvs.exe	222168598.exe
PID 1068 wrote to memory of 1600	1068	winuedrvs.exe	222168598.exe
PID 1068 wrote to memory of 1600	1068	winuedrvs.exe	222168598.exe

C:\Users\Admin\AppData\Local\Temp\a8d0ac5762f61683d7cbcbfc53e0b650e632625d7ffabf08b45986908891ee96.exe
"C:\Users\Admin\AppData\Local\Temp\a8d0ac5762f61683d7cbcbfc53e0b650e632625d7ffabf08b45986908891ee96.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1416

C:\Users\Admin\AppData\Local\Temp\155217673.scr
C:\Users\Admin\AppData\Local\Temp\155217673.scr
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:304

C:\Windows\winuedrvs.exe
C:\Windows\winuedrvs.exe
3⤵
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:1068

C:\Users\Admin\AppData\Local\Temp\34748149.exe
C:\Users\Admin\AppData\Local\Temp\34748149.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "User Configuration" /f
5⤵
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\system32\reg.exe
reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "User Configuration" /f
6⤵
PID:1900

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "User Configuration"
5⤵
- Suspicious use of WriteProcessMemory
PID:436

C:\Windows\system32\schtasks.exe
schtasks /delete /f /tn "User Configuration"
6⤵
PID:796

C:\Users\Admin\AppData\Local\Temp\222168598.exe
C:\Users\Admin\AppData\Local\Temp\222168598.exe
4⤵
- Executes dropped EXE
PID:1600

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\155217673.scr
Filesize
75KB

MD5
96de9c78028eaec7cd06d8e3e755ffc4

SHA1
612d1261bce41723b0a981c92bf9f186c9d46fe2

SHA256
d560cfb59c61c87d0d4b33aecc98b74c58475c6dd8a3cf6f3bcff2ee05d4c45f

SHA512
5906efdbf22af2ca3dc9f75accb4bb1f50ad0ddd792a14f5f891975a8e2b5632ce9e7e0e987b216851fef66a4e9bf9c03d847631093382dae79d0d132a41264f

Download Submit
C:\Users\Admin\AppData\Local\Temp\155217673.scr
Filesize
75KB

MD5
96de9c78028eaec7cd06d8e3e755ffc4

SHA1
612d1261bce41723b0a981c92bf9f186c9d46fe2

SHA256
d560cfb59c61c87d0d4b33aecc98b74c58475c6dd8a3cf6f3bcff2ee05d4c45f

SHA512
5906efdbf22af2ca3dc9f75accb4bb1f50ad0ddd792a14f5f891975a8e2b5632ce9e7e0e987b216851fef66a4e9bf9c03d847631093382dae79d0d132a41264f

Download Submit
C:\Users\Admin\AppData\Local\Temp\222168598.exe
Filesize
6KB

MD5
f99a026691957a1490c606890021a4db

SHA1
4eca65b16ce9b8284f3fc54344f8ae15b406b4e1

SHA256
db23276681cfb7d843bfc35b96e40dcb77b3bafcb87aa211d3fa6910da6937bd

SHA512
e4d9f869e4c12667a91af5792213350b9205a6fd3a2175e3af39571f2066ffa6a4b398a010497f428310b91033b4d5555835ede6669793f5cfd79ae47321421f

Download Submit
C:\Users\Admin\AppData\Local\Temp\34748149.exe
Filesize
8KB

MD5
66bbb99fb92a3688d31a899992f73cdf

SHA1
836fad08d9de8ea28c35d1885496af8e1284a6e7

SHA256
1d6be0622c56551a30c4bf5560050b226ff0f30dc2c05c5496e389efe51c62b6

SHA512
6a710765a53d68f1ab91b460dc16b59e273b1ddab43df01886d5ffd54d35c06f399038a6bb07b63d59933ed3c190d00ba9b59506cd0cd94fbb6ea0949d92ca36

Download Submit
C:\Users\Admin\AppData\Local\Temp\34748149.exe
Filesize
8KB

MD5
66bbb99fb92a3688d31a899992f73cdf

SHA1
836fad08d9de8ea28c35d1885496af8e1284a6e7

SHA256
1d6be0622c56551a30c4bf5560050b226ff0f30dc2c05c5496e389efe51c62b6

SHA512
6a710765a53d68f1ab91b460dc16b59e273b1ddab43df01886d5ffd54d35c06f399038a6bb07b63d59933ed3c190d00ba9b59506cd0cd94fbb6ea0949d92ca36

Download Submit
C:\Windows\winuedrvs.exe
Filesize
75KB

MD5
96de9c78028eaec7cd06d8e3e755ffc4

SHA1
612d1261bce41723b0a981c92bf9f186c9d46fe2

SHA256
d560cfb59c61c87d0d4b33aecc98b74c58475c6dd8a3cf6f3bcff2ee05d4c45f

SHA512
5906efdbf22af2ca3dc9f75accb4bb1f50ad0ddd792a14f5f891975a8e2b5632ce9e7e0e987b216851fef66a4e9bf9c03d847631093382dae79d0d132a41264f

Download Submit
C:\Windows\winuedrvs.exe
Filesize
75KB

MD5
96de9c78028eaec7cd06d8e3e755ffc4

SHA1
612d1261bce41723b0a981c92bf9f186c9d46fe2

SHA256
d560cfb59c61c87d0d4b33aecc98b74c58475c6dd8a3cf6f3bcff2ee05d4c45f

SHA512
5906efdbf22af2ca3dc9f75accb4bb1f50ad0ddd792a14f5f891975a8e2b5632ce9e7e0e987b216851fef66a4e9bf9c03d847631093382dae79d0d132a41264f

Download Submit
\Users\Admin\AppData\Local\Temp\155217673.scr
Filesize
75KB

MD5
96de9c78028eaec7cd06d8e3e755ffc4

SHA1
612d1261bce41723b0a981c92bf9f186c9d46fe2

SHA256
d560cfb59c61c87d0d4b33aecc98b74c58475c6dd8a3cf6f3bcff2ee05d4c45f

SHA512
5906efdbf22af2ca3dc9f75accb4bb1f50ad0ddd792a14f5f891975a8e2b5632ce9e7e0e987b216851fef66a4e9bf9c03d847631093382dae79d0d132a41264f

Download Submit
\Users\Admin\AppData\Local\Temp\155217673.scr
Filesize
75KB

MD5
96de9c78028eaec7cd06d8e3e755ffc4

SHA1
612d1261bce41723b0a981c92bf9f186c9d46fe2

SHA256
d560cfb59c61c87d0d4b33aecc98b74c58475c6dd8a3cf6f3bcff2ee05d4c45f

SHA512
5906efdbf22af2ca3dc9f75accb4bb1f50ad0ddd792a14f5f891975a8e2b5632ce9e7e0e987b216851fef66a4e9bf9c03d847631093382dae79d0d132a41264f

Download Submit
\Users\Admin\AppData\Local\Temp\222168598.exe
Filesize
6KB

MD5
f99a026691957a1490c606890021a4db

SHA1
4eca65b16ce9b8284f3fc54344f8ae15b406b4e1

SHA256
db23276681cfb7d843bfc35b96e40dcb77b3bafcb87aa211d3fa6910da6937bd

SHA512
e4d9f869e4c12667a91af5792213350b9205a6fd3a2175e3af39571f2066ffa6a4b398a010497f428310b91033b4d5555835ede6669793f5cfd79ae47321421f

Download Submit
\Users\Admin\AppData\Local\Temp\34748149.exe
Filesize
8KB

MD5
66bbb99fb92a3688d31a899992f73cdf

SHA1
836fad08d9de8ea28c35d1885496af8e1284a6e7

SHA256
1d6be0622c56551a30c4bf5560050b226ff0f30dc2c05c5496e389efe51c62b6

SHA512
6a710765a53d68f1ab91b460dc16b59e273b1ddab43df01886d5ffd54d35c06f399038a6bb07b63d59933ed3c190d00ba9b59506cd0cd94fbb6ea0949d92ca36

Download Submit
memory/304-57-0x0000000000000000-mapping.dmp

Download
memory/436-73-0x0000000000000000-mapping.dmp

Download
memory/796-74-0x0000000000000000-mapping.dmp

Download
memory/1068-61-0x0000000000000000-mapping.dmp

Download
memory/1416-54-0x0000000075E81000-0x0000000075E83000-memory.dmp

Filesize
8KB

Download
memory/1600-76-0x0000000000000000-mapping.dmp

Download
memory/1724-71-0x0000000000000000-mapping.dmp

Download
memory/1900-72-0x0000000000000000-mapping.dmp

Download
memory/1940-70-0x000007FEFB9F1000-0x000007FEFB9F3000-memory.dmp

Filesize
8KB

Download
memory/1940-69-0x000000013FAA0000-0x000000013FAA6000-memory.dmp

Filesize
24KB

Download
memory/1940-66-0x0000000000000000-mapping.dmp

Download