phorphiex | a3172e45bb1824fa625a04ff1d7e08617de13309ba9d31fb6b03ec9a921f345b

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-09-2022 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39c853575cbe6aa8343e8616cfc22c2dfdad567f78b5aee8e65f38423ebe10e3.exe
Size

76KB
MD5

5db9a00364b3c87e0bc4c52d3fbda13d
SHA1

f2e1f784019db62dd2866295499650a2a7d629dd
SHA256

39c853575cbe6aa8343e8616cfc22c2dfdad567f78b5aee8e65f38423ebe10e3
SHA512

7b472c384b011b24c8d4b0c7b67cc08f9708fee30bcbc38c93188064d1795ba581177cfbdd2f03d5a6f07c7ea4251c934f67710ade09ab04e9cb3884db94ef70
SSDEEP

1536:e3Mz8WzKcG6EBACCUDqgorWZK+DldD5Fw0F36:lwWWB0Aqg6WPpdD5Fwc6

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Extracted

Family

phorphiex

http://185.215.113.84/twizt/

Wallets

13dJT8HaqHG3SzwEHN351NKpZHjT51LUMioPeZCuYFMn6Em2

1AFyjUHBU47bKeWD3Yv9vxFvfQCNFVhEB1

3PLCWMHvHvUKmzNKvrNxRHcpBBt841bLLRm

3LVETtCrwgP6fhf1W5h1aiuUbG5yp8MG2x

qraj0r42vag30v888rxrv23us6n9mwqzxqmanzrjzz

XdpMAtREQP2GiJPnhECJE17Yo47kqwxE2g

DAd39Hg29o3hXTXkCp867rWZ82QtYemBr1

0x7acBe663481E7cAB6C7b22af594A1Fa5553ddA5f

LVSQJj6WFnMzAFDZLidL19hCtTtJu1WNHy

rsJ93nxUfY9p5a1g8ZYd1w1YsHdVP3tSn1

TXGiKCawSp4VEYnXC4Eyvz8gVugh3ibZjr

t1eAsZic54jTo4V4DRPWMN4oLgSzsSSYxcw

AHZnFT4zfKU59R811DCthwxBPKuRqG2ES1

bitcoincash:qraj0r42vag30v888rxrv23us6n9mwqzxqmanzrjzz

44HTTxP6AQ716zmPnc96XWRzCPtmJCYU8CZeU1bUUGyVNTEcHvLrGsg53AHiifFgz8W5F2ERtVCBxdC73gJFNhCDNs4ndn2

GABBG3OBFC3JLJEXMFEKJMMHANGFWVPTPKUJSVOMZZGQO522AXGL7Q3P

GMinVxCfyuHFUBiuuWuaWkUBWgN1kgowfsNzjjuad7W9

bnb16yfddrq3325xuqh3070tlqsr5gr74jun7zefgz

bc1qvdu6nyvrppjtshy7rgfpkl74hkklj7plavr8je

Signatures

Phorphiex
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

sysfgdrvs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysfgdrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysfgdrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysfgdrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysfgdrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysfgdrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysfgdrvs.exe

Executes dropped EXE 3 IoCs

Processes:

sysfgdrvs.exe1656221913.exe207527470.exe

pid process

1488 sysfgdrvs.exe
1540 1656221913.exe
760 207527470.exe
Loads dropped DLL 2 IoCs

Processes:

sysfgdrvs.exe

pid process

1488 sysfgdrvs.exe
1488 sysfgdrvs.exe

pid	process
1488	sysfgdrvs.exe
1540	1656221913.exe
760	207527470.exe

pid	process
1488	sysfgdrvs.exe
1488	sysfgdrvs.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

sysfgdrvs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysfgdrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysfgdrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysfgdrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysfgdrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysfgdrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysfgdrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysfgdrvs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

39c853575cbe6aa8343e8616cfc22c2dfdad567f78b5aee8e65f38423ebe10e3.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysfgdrvs.exe"	39c853575cbe6aa8343e8616cfc22c2dfdad567f78b5aee8e65f38423ebe10e3.exe

Drops file in Windows directory 2 IoCs

Processes:

39c853575cbe6aa8343e8616cfc22c2dfdad567f78b5aee8e65f38423ebe10e3.exe

description	ioc	process
File created	C:\Windows\sysfgdrvs.exe	39c853575cbe6aa8343e8616cfc22c2dfdad567f78b5aee8e65f38423ebe10e3.exe
File opened for modification	C:\Windows\sysfgdrvs.exe	39c853575cbe6aa8343e8616cfc22c2dfdad567f78b5aee8e65f38423ebe10e3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

1656221913.exe

pid process

1540 1656221913.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1656221913.exe

description pid process

Token: SeDebugPrivilege 1540 1656221913.exe

pid	process
1540	1656221913.exe

description	pid	process
Token: SeDebugPrivilege	1540	1656221913.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

39c853575cbe6aa8343e8616cfc22c2dfdad567f78b5aee8e65f38423ebe10e3.exesysfgdrvs.exe1656221913.execmd.execmd.exe

description	pid	process	target process
PID 948 wrote to memory of 1488	948	39c853575cbe6aa8343e8616cfc22c2dfdad567f78b5aee8e65f38423ebe10e3.exe	sysfgdrvs.exe
PID 948 wrote to memory of 1488	948	39c853575cbe6aa8343e8616cfc22c2dfdad567f78b5aee8e65f38423ebe10e3.exe	sysfgdrvs.exe
PID 948 wrote to memory of 1488	948	39c853575cbe6aa8343e8616cfc22c2dfdad567f78b5aee8e65f38423ebe10e3.exe	sysfgdrvs.exe
PID 948 wrote to memory of 1488	948	39c853575cbe6aa8343e8616cfc22c2dfdad567f78b5aee8e65f38423ebe10e3.exe	sysfgdrvs.exe
PID 1488 wrote to memory of 1540	1488	sysfgdrvs.exe	1656221913.exe
PID 1488 wrote to memory of 1540	1488	sysfgdrvs.exe	1656221913.exe
PID 1488 wrote to memory of 1540	1488	sysfgdrvs.exe	1656221913.exe
PID 1488 wrote to memory of 1540	1488	sysfgdrvs.exe	1656221913.exe
PID 1540 wrote to memory of 1152	1540	1656221913.exe	cmd.exe
PID 1540 wrote to memory of 1152	1540	1656221913.exe	cmd.exe
PID 1540 wrote to memory of 1152	1540	1656221913.exe	cmd.exe
PID 1540 wrote to memory of 1316	1540	1656221913.exe	cmd.exe
PID 1540 wrote to memory of 1316	1540	1656221913.exe	cmd.exe
PID 1540 wrote to memory of 1316	1540	1656221913.exe	cmd.exe
PID 1152 wrote to memory of 1700	1152	cmd.exe	reg.exe
PID 1152 wrote to memory of 1700	1152	cmd.exe	reg.exe
PID 1152 wrote to memory of 1700	1152	cmd.exe	reg.exe
PID 1316 wrote to memory of 1752	1316	cmd.exe	schtasks.exe
PID 1316 wrote to memory of 1752	1316	cmd.exe	schtasks.exe
PID 1316 wrote to memory of 1752	1316	cmd.exe	schtasks.exe
PID 1488 wrote to memory of 760	1488	sysfgdrvs.exe	207527470.exe
PID 1488 wrote to memory of 760	1488	sysfgdrvs.exe	207527470.exe
PID 1488 wrote to memory of 760	1488	sysfgdrvs.exe	207527470.exe
PID 1488 wrote to memory of 760	1488	sysfgdrvs.exe	207527470.exe

C:\Users\Admin\AppData\Local\Temp\39c853575cbe6aa8343e8616cfc22c2dfdad567f78b5aee8e65f38423ebe10e3.exe
"C:\Users\Admin\AppData\Local\Temp\39c853575cbe6aa8343e8616cfc22c2dfdad567f78b5aee8e65f38423ebe10e3.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\sysfgdrvs.exe
C:\Windows\sysfgdrvs.exe
2⤵
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:1488

C:\Users\Admin\AppData\Local\Temp\1656221913.exe
C:\Users\Admin\AppData\Local\Temp\1656221913.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "User Configuration" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:1152

C:\Windows\system32\reg.exe
reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "User Configuration" /f
5⤵
PID:1700

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "User Configuration"
4⤵
- Suspicious use of WriteProcessMemory
PID:1316

C:\Windows\system32\schtasks.exe
schtasks /delete /f /tn "User Configuration"
5⤵
PID:1752

C:\Users\Admin\AppData\Local\Temp\207527470.exe
C:\Users\Admin\AppData\Local\Temp\207527470.exe
3⤵
- Executes dropped EXE
PID:760

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1656221913.exe
Filesize
8KB

MD5
66bbb99fb92a3688d31a899992f73cdf

SHA1
836fad08d9de8ea28c35d1885496af8e1284a6e7

SHA256
1d6be0622c56551a30c4bf5560050b226ff0f30dc2c05c5496e389efe51c62b6

SHA512
6a710765a53d68f1ab91b460dc16b59e273b1ddab43df01886d5ffd54d35c06f399038a6bb07b63d59933ed3c190d00ba9b59506cd0cd94fbb6ea0949d92ca36

Download Submit
C:\Users\Admin\AppData\Local\Temp\1656221913.exe
Filesize
8KB

MD5
66bbb99fb92a3688d31a899992f73cdf

SHA1
836fad08d9de8ea28c35d1885496af8e1284a6e7

SHA256
1d6be0622c56551a30c4bf5560050b226ff0f30dc2c05c5496e389efe51c62b6

SHA512
6a710765a53d68f1ab91b460dc16b59e273b1ddab43df01886d5ffd54d35c06f399038a6bb07b63d59933ed3c190d00ba9b59506cd0cd94fbb6ea0949d92ca36

Download Submit
C:\Users\Admin\AppData\Local\Temp\207527470.exe
Filesize
6KB

MD5
f99a026691957a1490c606890021a4db

SHA1
4eca65b16ce9b8284f3fc54344f8ae15b406b4e1

SHA256
db23276681cfb7d843bfc35b96e40dcb77b3bafcb87aa211d3fa6910da6937bd

SHA512
e4d9f869e4c12667a91af5792213350b9205a6fd3a2175e3af39571f2066ffa6a4b398a010497f428310b91033b4d5555835ede6669793f5cfd79ae47321421f

Download Submit
C:\Windows\sysfgdrvs.exe
Filesize
76KB

MD5
5db9a00364b3c87e0bc4c52d3fbda13d

SHA1
f2e1f784019db62dd2866295499650a2a7d629dd

SHA256
39c853575cbe6aa8343e8616cfc22c2dfdad567f78b5aee8e65f38423ebe10e3

SHA512
7b472c384b011b24c8d4b0c7b67cc08f9708fee30bcbc38c93188064d1795ba581177cfbdd2f03d5a6f07c7ea4251c934f67710ade09ab04e9cb3884db94ef70

Download Submit
C:\Windows\sysfgdrvs.exe
Filesize
76KB

MD5
5db9a00364b3c87e0bc4c52d3fbda13d

SHA1
f2e1f784019db62dd2866295499650a2a7d629dd

SHA256
39c853575cbe6aa8343e8616cfc22c2dfdad567f78b5aee8e65f38423ebe10e3

SHA512
7b472c384b011b24c8d4b0c7b67cc08f9708fee30bcbc38c93188064d1795ba581177cfbdd2f03d5a6f07c7ea4251c934f67710ade09ab04e9cb3884db94ef70

Download Submit
\Users\Admin\AppData\Local\Temp\1656221913.exe
Filesize
8KB

MD5
66bbb99fb92a3688d31a899992f73cdf

SHA1
836fad08d9de8ea28c35d1885496af8e1284a6e7

SHA256
1d6be0622c56551a30c4bf5560050b226ff0f30dc2c05c5496e389efe51c62b6

SHA512
6a710765a53d68f1ab91b460dc16b59e273b1ddab43df01886d5ffd54d35c06f399038a6bb07b63d59933ed3c190d00ba9b59506cd0cd94fbb6ea0949d92ca36

Download Submit
\Users\Admin\AppData\Local\Temp\207527470.exe
Filesize
6KB

MD5
f99a026691957a1490c606890021a4db

SHA1
4eca65b16ce9b8284f3fc54344f8ae15b406b4e1

SHA256
db23276681cfb7d843bfc35b96e40dcb77b3bafcb87aa211d3fa6910da6937bd

SHA512
e4d9f869e4c12667a91af5792213350b9205a6fd3a2175e3af39571f2066ffa6a4b398a010497f428310b91033b4d5555835ede6669793f5cfd79ae47321421f

Download Submit
memory/760-70-0x0000000000000000-mapping.dmp

Download
memory/948-54-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download
memory/1152-65-0x0000000000000000-mapping.dmp

Download
memory/1316-66-0x0000000000000000-mapping.dmp

Download
memory/1488-55-0x0000000000000000-mapping.dmp

Download
memory/1540-63-0x000000013F870000-0x000000013F876000-memory.dmp

Filesize
24KB

Download
memory/1540-64-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmp

Filesize
8KB

Download
memory/1540-60-0x0000000000000000-mapping.dmp

Download
memory/1700-67-0x0000000000000000-mapping.dmp

Download
memory/1752-68-0x0000000000000000-mapping.dmp

Download