Resubmissions

18-01-2023 08:49

230118-krh9mahh9x 10

05-01-2023 12:09

230105-pbskksbh36 10

Analysis

  • max time kernel
    150s
  • max time network
    105s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    18-01-2023 08:49

General

  • Target

    11.exe

  • Size

    55KB

  • MD5

    d5b1a26c5c3b592c7008f440a36be0c3

  • SHA1

    ac56976f6a5c9da52651d7a220a7a73e0d83b08a

  • SHA256

    818f1f91d4975dc988b1fc8d0380ce45f414623bd52b045a3f36241c859c90fc

  • SHA512

    2499b52bb1241ed091fc12404cf63446322015999b7d10afc8fd19d56ae8b58b73bad76723a4832b227d624e09271605135e19b17a75c7f003f91a4d7deb60ee

  • SSDEEP

    1536:UNeRBl5PT/rx1mzwRMSTdLpJg0BxI0qvGY:UQRrmzwR5JLI0l

Malware Config

Extracted

Path

C:\users\public\desktop\info.hta

Ransom Note
Files are locked* but not corrupted Your computer is infected with a virus. Files are locked* but not corrupted. Send an email [email protected] or alteranive mail [email protected] , specify in the subject unique identifier 70578ED8-2822 and you will definitely be helped to recover. *you can send us a couple of files and we will return the restored ones to prove that only we can do it IMPORTANT: 1. the infection was due to vulnerabilities in your software 2. if you want to make sure that it is impossible to recover files using third-party software, do this not on all files, otherwise you may lose all data. 3. only communication through our email can guarantee file recovery for you. We are not responsible for the actions of third parties who promise to help you - most often they are scammers. 4. if we do not respond to you within 24 hours, send a message to our telegram - @phobos_support 5. if you need an alternative communication channel - write a request by e-mail 6. our goal is to return your data, but if you do not contact us, we will not succeed

Signatures

  • Phobos

    Phobos ransomware appeared at the beginning of 2019.

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
  • Deletes backup catalog 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

  • Modifies Windows Firewall 1 TTPs 2 IoCs
  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Drops startup file 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\11.exe
    "C:\Users\Admin\AppData\Local\Temp\11.exe"
    1⤵
    • Modifies extensions of user files
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1748
    • C:\Users\Admin\AppData\Local\Temp\11.exe
      "C:\Users\Admin\AppData\Local\Temp\11.exe"
      2⤵
        PID:5088
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3736
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:4836
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4472
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:5044
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled no
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:4320
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          3⤵
          • Deletes backup catalog
          PID:4920
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:8
        • C:\Windows\system32\netsh.exe
          netsh advfirewall set currentprofile state off
          3⤵
          • Modifies Windows Firewall
          PID:4252
        • C:\Windows\system32\netsh.exe
          netsh firewall set opmode mode=disable
          3⤵
          • Modifies Windows Firewall
          PID:4932
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        2⤵
          PID:2764
        • C:\Windows\SysWOW64\mshta.exe
          "C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
          2⤵
            PID:408
          • C:\Windows\SysWOW64\mshta.exe
            "C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
            2⤵
              PID:2856
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:468
              • C:\Windows\system32\vssadmin.exe
                vssadmin delete shadows /all /quiet
                3⤵
                • Interacts with shadow copies
                PID:4800
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic shadowcopy delete
                3⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:4888
              • C:\Windows\system32\bcdedit.exe
                bcdedit /set {default} bootstatuspolicy ignoreallfailures
                3⤵
                • Modifies boot configuration data using bcdedit
                PID:2828
              • C:\Windows\system32\bcdedit.exe
                bcdedit /set {default} recoveryenabled no
                3⤵
                • Modifies boot configuration data using bcdedit
                PID:4764
              • C:\Windows\system32\wbadmin.exe
                wbadmin delete catalog -quiet
                3⤵
                • Deletes backup catalog
                PID:1816
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4256
          • C:\Windows\system32\wbengine.exe
            "C:\Windows\system32\wbengine.exe"
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4564
          • C:\Windows\System32\vdsldr.exe
            C:\Windows\System32\vdsldr.exe -Embedding
            1⤵
              PID:3184
            • C:\Windows\System32\vds.exe
              C:\Windows\System32\vds.exe
              1⤵
              • Checks SCSI registry key(s)
              PID:4656

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\Desktop\info.hta

              Filesize

              4KB

              MD5

              0074441412bfbd096e9bc3b37eb57b1f

              SHA1

              7f71e3292383d1c29fb724fa65dd7c6ae054e841

              SHA256

              4532b5bb5fe5e0b3cace6ba0b8063b3ff091b650d8297eed091b5f2285bf2083

              SHA512

              312bffa50b4564bca29aebedb46911ccf53b404c09cfff50b82bd5815f5c29fe2d675c0bf5e1167333b9efa3958d3b45bb90cf147c9c32d70d9e591910fb0ed5

            • C:\info.hta

              Filesize

              4KB

              MD5

              0074441412bfbd096e9bc3b37eb57b1f

              SHA1

              7f71e3292383d1c29fb724fa65dd7c6ae054e841

              SHA256

              4532b5bb5fe5e0b3cace6ba0b8063b3ff091b650d8297eed091b5f2285bf2083

              SHA512

              312bffa50b4564bca29aebedb46911ccf53b404c09cfff50b82bd5815f5c29fe2d675c0bf5e1167333b9efa3958d3b45bb90cf147c9c32d70d9e591910fb0ed5

            • C:\users\public\desktop\info.hta

              Filesize

              4KB

              MD5

              0074441412bfbd096e9bc3b37eb57b1f

              SHA1

              7f71e3292383d1c29fb724fa65dd7c6ae054e841

              SHA256

              4532b5bb5fe5e0b3cace6ba0b8063b3ff091b650d8297eed091b5f2285bf2083

              SHA512

              312bffa50b4564bca29aebedb46911ccf53b404c09cfff50b82bd5815f5c29fe2d675c0bf5e1167333b9efa3958d3b45bb90cf147c9c32d70d9e591910fb0ed5

            • memory/8-192-0x0000000000000000-mapping.dmp

            • memory/408-237-0x0000000000000000-mapping.dmp

            • memory/468-290-0x0000000000000000-mapping.dmp

            • memory/1748-133-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-132-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-128-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-129-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-130-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-131-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-152-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-134-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-121-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-136-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-137-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-135-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-138-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-139-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-140-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-141-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-142-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-143-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-150-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-145-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-146-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-147-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-148-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-149-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-144-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-127-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-151-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-153-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-154-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-155-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-122-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-123-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-124-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-126-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-120-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1748-125-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/1816-496-0x0000000000000000-mapping.dmp

            • memory/2764-226-0x0000000000000000-mapping.dmp

            • memory/2828-484-0x0000000000000000-mapping.dmp

            • memory/2856-282-0x0000000000000000-mapping.dmp

            • memory/3736-191-0x0000000000000000-mapping.dmp

            • memory/4252-203-0x0000000000000000-mapping.dmp

            • memory/4320-212-0x0000000000000000-mapping.dmp

            • memory/4472-206-0x0000000000000000-mapping.dmp

            • memory/4764-495-0x0000000000000000-mapping.dmp

            • memory/4800-355-0x0000000000000000-mapping.dmp

            • memory/4836-204-0x0000000000000000-mapping.dmp

            • memory/4888-399-0x0000000000000000-mapping.dmp

            • memory/4920-213-0x0000000000000000-mapping.dmp

            • memory/4932-205-0x0000000000000000-mapping.dmp

            • memory/5044-211-0x0000000000000000-mapping.dmp

            • memory/5088-162-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/5088-178-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/5088-179-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/5088-180-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/5088-181-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/5088-182-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/5088-183-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/5088-177-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/5088-176-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/5088-175-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/5088-174-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/5088-173-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/5088-172-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/5088-170-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/5088-171-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/5088-169-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/5088-168-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/5088-167-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/5088-166-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/5088-165-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/5088-164-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/5088-163-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/5088-161-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/5088-160-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/5088-159-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/5088-158-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/5088-157-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB

            • memory/5088-156-0x0000000076F50000-0x00000000770DE000-memory.dmp

              Filesize

              1.6MB