phorphiex | a3172e45bb1824fa625a04ff1d7e08617de13309ba9d31fb6b03ec9a921f345b

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28-09-2022 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d3c6d6b276c0e1fa559cd6e48a12da63098cc3823329db71c4dbc12fa3a2334.exe
Size

76KB
MD5

bd280f51fc7e46a3f9470713f5f859cc
SHA1

ed748025627617facd90eaad22c36687819f7535
SHA256

1d3c6d6b276c0e1fa559cd6e48a12da63098cc3823329db71c4dbc12fa3a2334
SHA512

b2c7aa0f9dffda55c078570d6ea51490ef5c5e13c1e8dccab7f0f5e324d785e3610e69a2f26d897bbd82ca74b4372447f838cc1296598faed4d9ddc45013bbc2
SSDEEP

1536:d3Mz8teK4zdEEP7ACU5wvclRSJytpKHaHlt5F92V:mwoKIP7q+vclR/tp3Ft5F92

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Extracted

Family

phorphiex

http://185.215.113.84/twizt/

Wallets

13dJT8HaqHG3SzwEHN351NKpZHjT51LUMioPeZCuYFMn6Em2

1AFyjUHBU47bKeWD3Yv9vxFvfQCNFVhEB1

3PLCWMHvHvUKmzNKvrNxRHcpBBt841bLLRm

qraj0r42vag30v888rxrv23us6n9mwqzxqmanzrjzz

XdpMAtREQP2GiJPnhECJE17Yo47kqwxE2g

DAd39Hg29o3hXTXkCp867rWZ82QtYemBr1

0x7acBe663481E7cAB6C7b22af594A1Fa5553ddA5f

LVSQJj6WFnMzAFDZLidL19hCtTtJu1WNHy

rsJ93nxUfY9p5a1g8ZYd1w1YsHdVP3tSn1

TXGiKCawSp4VEYnXC4Eyvz8gVugh3ibZjr

t1eAsZic54jTo4V4DRPWMN4oLgSzsSSYxcw

AHZnFT4zfKU59R811DCthwxBPKuRqG2ES1

bitcoincash:qraj0r42vag30v888rxrv23us6n9mwqzxqmanzrjzz

4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK

GABBG3OBFC3JLJEXMFEKJMMHANGFWVPTPKUJSVOMZZGQO522AXGL7Q3P

GMinVxCfyuHFUBiuuWuaWkUBWgN1kgowfsNzjjuad7W9

bnb16yfddrq3325xuqh3070tlqsr5gr74jun7zefgz

bc1qvdu6nyvrppjtshy7rgfpkl74hkklj7plavr8je

Signatures

Phorphiex
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winopdvcs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	winopdvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winopdvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	winopdvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winopdvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	winopdvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	winopdvcs.exe

Executes dropped EXE 3 IoCs

Processes:

winopdvcs.exe1355410489.exe118228510.exe

pid process

2036 winopdvcs.exe
1704 1355410489.exe
1276 118228510.exe
Loads dropped DLL 2 IoCs

Processes:

winopdvcs.exe

pid process

2036 winopdvcs.exe
2036 winopdvcs.exe

pid	process
2036	winopdvcs.exe
1704	1355410489.exe
1276	118228510.exe

pid	process
2036	winopdvcs.exe
2036	winopdvcs.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

winopdvcs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	winopdvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	winopdvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	winopdvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	winopdvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	winopdvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	winopdvcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	winopdvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

1d3c6d6b276c0e1fa559cd6e48a12da63098cc3823329db71c4dbc12fa3a2334.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\winopdvcs.exe"	1d3c6d6b276c0e1fa559cd6e48a12da63098cc3823329db71c4dbc12fa3a2334.exe

Drops file in Windows directory 2 IoCs

Processes:

1d3c6d6b276c0e1fa559cd6e48a12da63098cc3823329db71c4dbc12fa3a2334.exe

description	ioc	process
File opened for modification	C:\Windows\winopdvcs.exe	1d3c6d6b276c0e1fa559cd6e48a12da63098cc3823329db71c4dbc12fa3a2334.exe
File created	C:\Windows\winopdvcs.exe	1d3c6d6b276c0e1fa559cd6e48a12da63098cc3823329db71c4dbc12fa3a2334.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

1355410489.exe

pid process

1704 1355410489.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1355410489.exe

description pid process

Token: SeDebugPrivilege 1704 1355410489.exe

pid	process
1704	1355410489.exe

description	pid	process
Token: SeDebugPrivilege	1704	1355410489.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

1d3c6d6b276c0e1fa559cd6e48a12da63098cc3823329db71c4dbc12fa3a2334.exewinopdvcs.exe1355410489.execmd.execmd.exe

description	pid	process	target process
PID 1724 wrote to memory of 2036	1724	1d3c6d6b276c0e1fa559cd6e48a12da63098cc3823329db71c4dbc12fa3a2334.exe	winopdvcs.exe
PID 1724 wrote to memory of 2036	1724	1d3c6d6b276c0e1fa559cd6e48a12da63098cc3823329db71c4dbc12fa3a2334.exe	winopdvcs.exe
PID 1724 wrote to memory of 2036	1724	1d3c6d6b276c0e1fa559cd6e48a12da63098cc3823329db71c4dbc12fa3a2334.exe	winopdvcs.exe
PID 1724 wrote to memory of 2036	1724	1d3c6d6b276c0e1fa559cd6e48a12da63098cc3823329db71c4dbc12fa3a2334.exe	winopdvcs.exe
PID 2036 wrote to memory of 1704	2036	winopdvcs.exe	1355410489.exe
PID 2036 wrote to memory of 1704	2036	winopdvcs.exe	1355410489.exe
PID 2036 wrote to memory of 1704	2036	winopdvcs.exe	1355410489.exe
PID 2036 wrote to memory of 1704	2036	winopdvcs.exe	1355410489.exe
PID 1704 wrote to memory of 1536	1704	1355410489.exe	cmd.exe
PID 1704 wrote to memory of 1536	1704	1355410489.exe	cmd.exe
PID 1704 wrote to memory of 1536	1704	1355410489.exe	cmd.exe
PID 1704 wrote to memory of 1948	1704	1355410489.exe	cmd.exe
PID 1704 wrote to memory of 1948	1704	1355410489.exe	cmd.exe
PID 1704 wrote to memory of 1948	1704	1355410489.exe	cmd.exe
PID 1536 wrote to memory of 1920	1536	cmd.exe	reg.exe
PID 1536 wrote to memory of 1920	1536	cmd.exe	reg.exe
PID 1536 wrote to memory of 1920	1536	cmd.exe	reg.exe
PID 1948 wrote to memory of 1044	1948	cmd.exe	schtasks.exe
PID 1948 wrote to memory of 1044	1948	cmd.exe	schtasks.exe
PID 1948 wrote to memory of 1044	1948	cmd.exe	schtasks.exe
PID 2036 wrote to memory of 1276	2036	winopdvcs.exe	118228510.exe
PID 2036 wrote to memory of 1276	2036	winopdvcs.exe	118228510.exe
PID 2036 wrote to memory of 1276	2036	winopdvcs.exe	118228510.exe
PID 2036 wrote to memory of 1276	2036	winopdvcs.exe	118228510.exe

C:\Users\Admin\AppData\Local\Temp\1d3c6d6b276c0e1fa559cd6e48a12da63098cc3823329db71c4dbc12fa3a2334.exe
"C:\Users\Admin\AppData\Local\Temp\1d3c6d6b276c0e1fa559cd6e48a12da63098cc3823329db71c4dbc12fa3a2334.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\winopdvcs.exe
C:\Windows\winopdvcs.exe
2⤵
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:2036

C:\Users\Admin\AppData\Local\Temp\1355410489.exe
C:\Users\Admin\AppData\Local\Temp\1355410489.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "User Configuration" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:1536

C:\Windows\system32\reg.exe
reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "User Configuration" /f
5⤵
PID:1920

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "User Configuration"
4⤵
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\system32\schtasks.exe
schtasks /delete /f /tn "User Configuration"
5⤵
PID:1044

C:\Users\Admin\AppData\Local\Temp\118228510.exe
C:\Users\Admin\AppData\Local\Temp\118228510.exe
3⤵
- Executes dropped EXE
PID:1276

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\118228510.exe
Filesize
6KB

MD5
f99a026691957a1490c606890021a4db

SHA1
4eca65b16ce9b8284f3fc54344f8ae15b406b4e1

SHA256
db23276681cfb7d843bfc35b96e40dcb77b3bafcb87aa211d3fa6910da6937bd

SHA512
e4d9f869e4c12667a91af5792213350b9205a6fd3a2175e3af39571f2066ffa6a4b398a010497f428310b91033b4d5555835ede6669793f5cfd79ae47321421f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1355410489.exe
Filesize
8KB

MD5
66bbb99fb92a3688d31a899992f73cdf

SHA1
836fad08d9de8ea28c35d1885496af8e1284a6e7

SHA256
1d6be0622c56551a30c4bf5560050b226ff0f30dc2c05c5496e389efe51c62b6

SHA512
6a710765a53d68f1ab91b460dc16b59e273b1ddab43df01886d5ffd54d35c06f399038a6bb07b63d59933ed3c190d00ba9b59506cd0cd94fbb6ea0949d92ca36

Download Submit
C:\Users\Admin\AppData\Local\Temp\1355410489.exe
Filesize
8KB

MD5
66bbb99fb92a3688d31a899992f73cdf

SHA1
836fad08d9de8ea28c35d1885496af8e1284a6e7

SHA256
1d6be0622c56551a30c4bf5560050b226ff0f30dc2c05c5496e389efe51c62b6

SHA512
6a710765a53d68f1ab91b460dc16b59e273b1ddab43df01886d5ffd54d35c06f399038a6bb07b63d59933ed3c190d00ba9b59506cd0cd94fbb6ea0949d92ca36

Download Submit
C:\Windows\winopdvcs.exe
Filesize
76KB

MD5
bd280f51fc7e46a3f9470713f5f859cc

SHA1
ed748025627617facd90eaad22c36687819f7535

SHA256
1d3c6d6b276c0e1fa559cd6e48a12da63098cc3823329db71c4dbc12fa3a2334

SHA512
b2c7aa0f9dffda55c078570d6ea51490ef5c5e13c1e8dccab7f0f5e324d785e3610e69a2f26d897bbd82ca74b4372447f838cc1296598faed4d9ddc45013bbc2

Download Submit
C:\Windows\winopdvcs.exe
Filesize
76KB

MD5
bd280f51fc7e46a3f9470713f5f859cc

SHA1
ed748025627617facd90eaad22c36687819f7535

SHA256
1d3c6d6b276c0e1fa559cd6e48a12da63098cc3823329db71c4dbc12fa3a2334

SHA512
b2c7aa0f9dffda55c078570d6ea51490ef5c5e13c1e8dccab7f0f5e324d785e3610e69a2f26d897bbd82ca74b4372447f838cc1296598faed4d9ddc45013bbc2

Download Submit
\Users\Admin\AppData\Local\Temp\118228510.exe
Filesize
6KB

MD5
f99a026691957a1490c606890021a4db

SHA1
4eca65b16ce9b8284f3fc54344f8ae15b406b4e1

SHA256
db23276681cfb7d843bfc35b96e40dcb77b3bafcb87aa211d3fa6910da6937bd

SHA512
e4d9f869e4c12667a91af5792213350b9205a6fd3a2175e3af39571f2066ffa6a4b398a010497f428310b91033b4d5555835ede6669793f5cfd79ae47321421f

Download Submit
\Users\Admin\AppData\Local\Temp\1355410489.exe
Filesize
8KB

MD5
66bbb99fb92a3688d31a899992f73cdf

SHA1
836fad08d9de8ea28c35d1885496af8e1284a6e7

SHA256
1d6be0622c56551a30c4bf5560050b226ff0f30dc2c05c5496e389efe51c62b6

SHA512
6a710765a53d68f1ab91b460dc16b59e273b1ddab43df01886d5ffd54d35c06f399038a6bb07b63d59933ed3c190d00ba9b59506cd0cd94fbb6ea0949d92ca36

Download Submit
memory/1044-68-0x0000000000000000-mapping.dmp

Download
memory/1276-70-0x0000000000000000-mapping.dmp

Download
memory/1536-65-0x0000000000000000-mapping.dmp

Download
memory/1704-63-0x000000013FFD0000-0x000000013FFD6000-memory.dmp

Filesize
24KB

Download
memory/1704-64-0x000007FEFB771000-0x000007FEFB773000-memory.dmp

Filesize
8KB

Download
memory/1704-60-0x0000000000000000-mapping.dmp

Download
memory/1724-54-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download
memory/1920-67-0x0000000000000000-mapping.dmp

Download
memory/1948-66-0x0000000000000000-mapping.dmp

Download
memory/2036-55-0x0000000000000000-mapping.dmp

Download