Overview
overview
10Static
static
101c50e838ff...8c.exe
windows7-x64
81c50e838ff...8c.exe
windows10-2004-x64
81d3c6d6b27...34.exe
windows7-x64
101d3c6d6b27...34.exe
windows10-2004-x64
1022f524abc9...92.exe
windows7-x64
1022f524abc9...92.exe
windows10-2004-x64
103759265786...d0.exe
windows7-x64
83759265786...d0.exe
windows10-2004-x64
839c853575c...e3.exe
windows7-x64
1039c853575c...e3.exe
windows10-2004-x64
106969c45198...dc.exe
windows7-x64
86969c45198...dc.exe
windows10-2004-x64
896c5607aa1...7a.exe
windows7-x64
896c5607aa1...7a.exe
windows10-2004-x64
8a8d0ac5762...96.exe
windows7-x64
10a8d0ac5762...96.exe
windows10-2004-x64
10c86e66ff92...5d.exe
windows7-x64
10c86e66ff92...5d.exe
windows10-2004-x64
10fca1bb147c...66.exe
windows7-x64
1fca1bb147c...66.exe
windows10-2004-x64
7Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28-09-2022 09:11
Behavioral task
behavioral1
Sample
1c50e838ff24a46f03e9afe9415b2002cda7e1479c4cff3884e49fc0e644288c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1c50e838ff24a46f03e9afe9415b2002cda7e1479c4cff3884e49fc0e644288c.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
1d3c6d6b276c0e1fa559cd6e48a12da63098cc3823329db71c4dbc12fa3a2334.exe
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
1d3c6d6b276c0e1fa559cd6e48a12da63098cc3823329db71c4dbc12fa3a2334.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
22f524abc98f958705febd3761bedc85ec1ae859316a653b67c0c01327533092.exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
22f524abc98f958705febd3761bedc85ec1ae859316a653b67c0c01327533092.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
3759265786b19c6b1196d620f48d8e1bd34d8f43268680065d545f34465f7ad0.exe
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
3759265786b19c6b1196d620f48d8e1bd34d8f43268680065d545f34465f7ad0.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
39c853575cbe6aa8343e8616cfc22c2dfdad567f78b5aee8e65f38423ebe10e3.exe
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
39c853575cbe6aa8343e8616cfc22c2dfdad567f78b5aee8e65f38423ebe10e3.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dc.exe
Resource
win7-20220901-en
Behavioral task
behavioral12
Sample
6969c45198338d2677fd4d30c7a374a1c56d35e8e062110e4679d1f9aefa26dc.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
96c5607aa1a1082ff6659842855fe584e1467a2119de3c017ff20b7c317adf7a.exe
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
96c5607aa1a1082ff6659842855fe584e1467a2119de3c017ff20b7c317adf7a.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral15
Sample
a8d0ac5762f61683d7cbcbfc53e0b650e632625d7ffabf08b45986908891ee96.exe
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
a8d0ac5762f61683d7cbcbfc53e0b650e632625d7ffabf08b45986908891ee96.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d.exe
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral19
Sample
fca1bb147cee65edf9ef821063fe3899d5ab3da1ca5310c9efe9913204675366.exe
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
fca1bb147cee65edf9ef821063fe3899d5ab3da1ca5310c9efe9913204675366.exe
Resource
win10v2004-20220812-en
General
-
Target
c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d.exe
-
Size
75KB
-
MD5
209baf40779b80d5e443c3dbbd656bfb
-
SHA1
b64fa8dded031d5dacac519a2035cefcd05e6503
-
SHA256
c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d
-
SHA512
9b4e3e82e141e569c85f22dd215f804b2f4e8969cda858662efca67532ba57d2e0acdbaa179524b4996be62f9acee3298eaf6cdfd03eff7e39e23bc7163c440e
-
SSDEEP
1536:E3Mz8Guoo90MXrtvWhzNmgrZBVnWw7V15FK9:fwGuPXpOh5mgrVnj7V15FK
Malware Config
Extracted
phorphiex
http://185.215.113.84/twizt/
12SJv5p8xUHeiKnXPCDaKCMpqvXj7TABT5BSxGt3csz9Beuc
1A6utf8R2zfLL7X31T5QRHdQyAx16BjdFD
3PFzu8Rw8aDNhDT6d5FMrZ3ckE4dEHzogfg
3BJS4zYwrnfcJMm4xLxRcsa69ght8n6QWz
qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k
XgWbWpuyPGney7hcS9vZ7eNhkj7WcvGcj8
DPcSSyFAYLu4aEB4s1Yotb8ANwtx6bZEQG
0xb899fC445a1b61Cdd62266795193203aa72351fE
LRDpmP5wHZ82LZimzWDLHVqJPDSpkM1gZ7
r1eZ7W1fmUT9tiUZwK6rr3g6RNiE4QpU1
TBdEh7r35ywUD5omutc2kDTX7rXhnFkxy5
t1T7mBRBgTYPEL9RPPBnAVgcftiWUPBFWyy
AGUqhQzF52Qwbvun5wQSrpokPtCC4b9yiX
bitcoincash:qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k
4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK
GCVFMTUKNLFBGHE3AHRJH4IJDRZGWOJ6JD2FQTFQAAIQR64ALD7QJHUY
bnb1rcg9mnkzna2tw4u8ughyaj6ja8feyj87hss9ky
bc1qzs2hs5dvyx04h0erq4ea72sctcre2rcwadsq2v
Signatures
-
Processes:
wklopsvcs.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" wklopsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" wklopsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" wklopsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" wklopsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" wklopsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" wklopsvcs.exe -
Executes dropped EXE 3 IoCs
Processes:
wklopsvcs.exe287145087.exe1349823367.exepid process 688 wklopsvcs.exe 1736 287145087.exe 472 1349823367.exe -
Loads dropped DLL 2 IoCs
Processes:
wklopsvcs.exepid process 688 wklopsvcs.exe 688 wklopsvcs.exe -
Processes:
wklopsvcs.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" wklopsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" wklopsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" wklopsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" wklopsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" wklopsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" wklopsvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" wklopsvcs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\wklopsvcs.exe" c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d.exe -
Drops file in Windows directory 2 IoCs
Processes:
c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d.exedescription ioc process File created C:\Windows\wklopsvcs.exe c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d.exe File opened for modification C:\Windows\wklopsvcs.exe c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
287145087.exepid process 1736 287145087.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
287145087.exedescription pid process Token: SeDebugPrivilege 1736 287145087.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d.exewklopsvcs.exe287145087.execmd.execmd.exedescription pid process target process PID 1112 wrote to memory of 688 1112 c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d.exe wklopsvcs.exe PID 1112 wrote to memory of 688 1112 c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d.exe wklopsvcs.exe PID 1112 wrote to memory of 688 1112 c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d.exe wklopsvcs.exe PID 1112 wrote to memory of 688 1112 c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d.exe wklopsvcs.exe PID 688 wrote to memory of 1736 688 wklopsvcs.exe 287145087.exe PID 688 wrote to memory of 1736 688 wklopsvcs.exe 287145087.exe PID 688 wrote to memory of 1736 688 wklopsvcs.exe 287145087.exe PID 688 wrote to memory of 1736 688 wklopsvcs.exe 287145087.exe PID 1736 wrote to memory of 1444 1736 287145087.exe cmd.exe PID 1736 wrote to memory of 1444 1736 287145087.exe cmd.exe PID 1736 wrote to memory of 1444 1736 287145087.exe cmd.exe PID 1736 wrote to memory of 1968 1736 287145087.exe cmd.exe PID 1736 wrote to memory of 1968 1736 287145087.exe cmd.exe PID 1736 wrote to memory of 1968 1736 287145087.exe cmd.exe PID 1444 wrote to memory of 588 1444 cmd.exe reg.exe PID 1444 wrote to memory of 588 1444 cmd.exe reg.exe PID 1444 wrote to memory of 588 1444 cmd.exe reg.exe PID 1968 wrote to memory of 1084 1968 cmd.exe schtasks.exe PID 1968 wrote to memory of 1084 1968 cmd.exe schtasks.exe PID 1968 wrote to memory of 1084 1968 cmd.exe schtasks.exe PID 688 wrote to memory of 472 688 wklopsvcs.exe 1349823367.exe PID 688 wrote to memory of 472 688 wklopsvcs.exe 1349823367.exe PID 688 wrote to memory of 472 688 wklopsvcs.exe 1349823367.exe PID 688 wrote to memory of 472 688 wklopsvcs.exe 1349823367.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d.exe"C:\Users\Admin\AppData\Local\Temp\c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\wklopsvcs.exeC:\Windows\wklopsvcs.exe2⤵
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\287145087.exeC:\Users\Admin\AppData\Local\Temp\287145087.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "User Configuration" /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "User Configuration" /f5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "User Configuration"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /delete /f /tn "User Configuration"5⤵
-
C:\Users\Admin\AppData\Local\Temp\1349823367.exeC:\Users\Admin\AppData\Local\Temp\1349823367.exe3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1349823367.exeFilesize
6KB
MD5f99a026691957a1490c606890021a4db
SHA14eca65b16ce9b8284f3fc54344f8ae15b406b4e1
SHA256db23276681cfb7d843bfc35b96e40dcb77b3bafcb87aa211d3fa6910da6937bd
SHA512e4d9f869e4c12667a91af5792213350b9205a6fd3a2175e3af39571f2066ffa6a4b398a010497f428310b91033b4d5555835ede6669793f5cfd79ae47321421f
-
C:\Users\Admin\AppData\Local\Temp\287145087.exeFilesize
8KB
MD566bbb99fb92a3688d31a899992f73cdf
SHA1836fad08d9de8ea28c35d1885496af8e1284a6e7
SHA2561d6be0622c56551a30c4bf5560050b226ff0f30dc2c05c5496e389efe51c62b6
SHA5126a710765a53d68f1ab91b460dc16b59e273b1ddab43df01886d5ffd54d35c06f399038a6bb07b63d59933ed3c190d00ba9b59506cd0cd94fbb6ea0949d92ca36
-
C:\Users\Admin\AppData\Local\Temp\287145087.exeFilesize
8KB
MD566bbb99fb92a3688d31a899992f73cdf
SHA1836fad08d9de8ea28c35d1885496af8e1284a6e7
SHA2561d6be0622c56551a30c4bf5560050b226ff0f30dc2c05c5496e389efe51c62b6
SHA5126a710765a53d68f1ab91b460dc16b59e273b1ddab43df01886d5ffd54d35c06f399038a6bb07b63d59933ed3c190d00ba9b59506cd0cd94fbb6ea0949d92ca36
-
C:\Windows\wklopsvcs.exeFilesize
75KB
MD5209baf40779b80d5e443c3dbbd656bfb
SHA1b64fa8dded031d5dacac519a2035cefcd05e6503
SHA256c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d
SHA5129b4e3e82e141e569c85f22dd215f804b2f4e8969cda858662efca67532ba57d2e0acdbaa179524b4996be62f9acee3298eaf6cdfd03eff7e39e23bc7163c440e
-
C:\Windows\wklopsvcs.exeFilesize
75KB
MD5209baf40779b80d5e443c3dbbd656bfb
SHA1b64fa8dded031d5dacac519a2035cefcd05e6503
SHA256c86e66ff929bb7b66fa3a3dcbf12b2a39041ec1740cd5f748d4672bf06d6db5d
SHA5129b4e3e82e141e569c85f22dd215f804b2f4e8969cda858662efca67532ba57d2e0acdbaa179524b4996be62f9acee3298eaf6cdfd03eff7e39e23bc7163c440e
-
\Users\Admin\AppData\Local\Temp\1349823367.exeFilesize
6KB
MD5f99a026691957a1490c606890021a4db
SHA14eca65b16ce9b8284f3fc54344f8ae15b406b4e1
SHA256db23276681cfb7d843bfc35b96e40dcb77b3bafcb87aa211d3fa6910da6937bd
SHA512e4d9f869e4c12667a91af5792213350b9205a6fd3a2175e3af39571f2066ffa6a4b398a010497f428310b91033b4d5555835ede6669793f5cfd79ae47321421f
-
\Users\Admin\AppData\Local\Temp\287145087.exeFilesize
8KB
MD566bbb99fb92a3688d31a899992f73cdf
SHA1836fad08d9de8ea28c35d1885496af8e1284a6e7
SHA2561d6be0622c56551a30c4bf5560050b226ff0f30dc2c05c5496e389efe51c62b6
SHA5126a710765a53d68f1ab91b460dc16b59e273b1ddab43df01886d5ffd54d35c06f399038a6bb07b63d59933ed3c190d00ba9b59506cd0cd94fbb6ea0949d92ca36
-
memory/472-70-0x0000000000000000-mapping.dmp
-
memory/588-67-0x0000000000000000-mapping.dmp
-
memory/688-55-0x0000000000000000-mapping.dmp
-
memory/1084-68-0x0000000000000000-mapping.dmp
-
memory/1112-54-0x0000000074D61000-0x0000000074D63000-memory.dmpFilesize
8KB
-
memory/1444-65-0x0000000000000000-mapping.dmp
-
memory/1736-64-0x000007FEFB801000-0x000007FEFB803000-memory.dmpFilesize
8KB
-
memory/1736-63-0x000000013FDC0000-0x000000013FDC6000-memory.dmpFilesize
24KB
-
memory/1736-60-0x0000000000000000-mapping.dmp
-
memory/1968-66-0x0000000000000000-mapping.dmp