Analysis
-
max time kernel
153s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
25-11-2022 08:39
General
-
Target
2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe
-
Size
149KB
-
MD5
24e0cf05d2d34b1e6efbc7949bd7aa1f
-
SHA1
dfdf26d8de8f123dbfdc0b4d5a0a967aee454d9b
-
SHA256
2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90
-
SHA512
5b0a000a3dc159de262de88d8721b766ced6424209ab136c5630c4cd0eb4fc0f7e14624b3f6fb08c2b775ab45402fe863975ae43b48c6b9775f67045f29773f2
-
SSDEEP
3072:iMYxKXZHdlgQhA+zXuIDl33qMDqNfSwAk/GDbjXR4s4npu4:UOltfDl33BDsJAS8R4Xpu
Score
10/10
Malware Config
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Drops startup file 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 52 IoCs
-
Suspicious use of WriteProcessMemory 38 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe"C:\Users\Admin\AppData\Local\Temp\2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe"{path}"2⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe"C:\Users\Admin\AppData\Local\Temp\2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe"{path}"4⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2d310cd28162abfe2bc489e000fc1a9ca52f7d2b739f29be266d807439bced90.exe.logFilesize
507B
MD5ab4c71d3ff6255edd4e5c1e09540f49e
SHA122e06bf4e258741b5df918061871cba998c50cea
SHA2561690fec628f775dd3c3385b800eed126b37978ef2ffd592b024052724caafb5a
SHA5128fa7d0045796e6cda7c28e2b9a690ef550619828c1b5d0ebf8e8367aff4bf4d9f63121e5b4f199d30cb8006eb584c6767f4c59150749b8256dab9dd0ebd9f1af
-
memory/508-155-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/508-151-0x0000000000000000-mapping.dmp
-
memory/808-136-0x0000000000000000-mapping.dmp
-
memory/1700-145-0x0000000000000000-mapping.dmp
-
memory/2220-135-0x0000000006110000-0x00000000066B4000-memory.dmpFilesize
5.6MB
-
memory/2220-132-0x0000000000AF0000-0x0000000000B1C000-memory.dmpFilesize
176KB
-
memory/2220-134-0x0000000005590000-0x0000000005622000-memory.dmpFilesize
584KB
-
memory/2220-133-0x0000000005450000-0x00000000054EC000-memory.dmpFilesize
624KB
-
memory/3120-150-0x0000000000000000-mapping.dmp
-
memory/3284-144-0x0000000000000000-mapping.dmp
-
memory/3776-149-0x0000000000000000-mapping.dmp
-
memory/4652-142-0x0000000000000000-mapping.dmp
-
memory/4852-147-0x0000000000000000-mapping.dmp
-
memory/5060-137-0x0000000000000000-mapping.dmp
-
memory/5060-146-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/5060-141-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/5060-140-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/5060-138-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/5088-148-0x0000000000000000-mapping.dmp