Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
22-02-2023 11:20
Behavioral task
behavioral1
Sample
508bc81bf6a736b3f6ff1c2cb2613418.exe
Resource
win7-20230220-en
General
-
Target
508bc81bf6a736b3f6ff1c2cb2613418.exe
-
Size
75KB
-
MD5
508bc81bf6a736b3f6ff1c2cb2613418
-
SHA1
c0a6c581783273794c54d5c4622e5af6e0e5b755
-
SHA256
e4fdc23e22c217e8123fb10c408e5d9203d656c70b3f0b6dcbc11235342347a0
-
SHA512
d39368a1e169d7a3d6f8f9edd9e91878724eeecf23d260a0ed3881f328dda58aa3fe1f04dbf264d8fccc468245a8b0d65a6620a1a4c8359748e2f794e316c2ae
-
SSDEEP
1536:gE3Mz8byyu11Lc3niGhAX5WKxqlfF+XEdeeeeeeeeeeeeeeeeeeeWeeeee:Qwbk1LSiGepvqlfFj
Malware Config
Extracted
phorphiex
http://185.215.113.66/
0x77BC9dDbaf423139eC0C7F699B676c72Ab34fcc7
TCX5ybBsuZE2BZk6GJMqZaCjBEjiuX1zPP
1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6
qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL
LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX
rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH
ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ
48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg
3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC
3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3
D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH
t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn
bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd
bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg
bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE
Signatures
-
Processes:
sysmsrvcx.exesysmsrvcx.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysmsrvcx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysmsrvcx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysmsrvcx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysmsrvcx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" sysmsrvcx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysmsrvcx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysmsrvcx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" sysmsrvcx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysmsrvcx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysmsrvcx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysmsrvcx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysmsrvcx.exe -
Executes dropped EXE 5 IoCs
Processes:
sysmsrvcx.exe2769725352.exe239528006.exesysmsrvcx.exe504130786.exepid process 1840 sysmsrvcx.exe 1004 2769725352.exe 1620 239528006.exe 668 sysmsrvcx.exe 1992 504130786.exe -
Loads dropped DLL 6 IoCs
Processes:
sysmsrvcx.exe239528006.exesysmsrvcx.exepid process 1840 sysmsrvcx.exe 1840 sysmsrvcx.exe 1840 sysmsrvcx.exe 1620 239528006.exe 1620 239528006.exe 668 sysmsrvcx.exe -
Processes:
sysmsrvcx.exesysmsrvcx.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysmsrvcx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" sysmsrvcx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysmsrvcx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysmsrvcx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysmsrvcx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" sysmsrvcx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" sysmsrvcx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysmsrvcx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysmsrvcx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" sysmsrvcx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysmsrvcx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysmsrvcx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysmsrvcx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysmsrvcx.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
508bc81bf6a736b3f6ff1c2cb2613418.exe239528006.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysmsrvcx.exe" 508bc81bf6a736b3f6ff1c2cb2613418.exe Set value (str) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Users\\Admin\\sysmsrvcx.exe" 239528006.exe -
Drops file in Windows directory 3 IoCs
Processes:
239528006.exe508bc81bf6a736b3f6ff1c2cb2613418.exedescription ioc process File created C:\Windows\sysmsrvcx.exe 239528006.exe File created C:\Windows\sysmsrvcx.exe 508bc81bf6a736b3f6ff1c2cb2613418.exe File opened for modification C:\Windows\sysmsrvcx.exe 508bc81bf6a736b3f6ff1c2cb2613418.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
508bc81bf6a736b3f6ff1c2cb2613418.exesysmsrvcx.exe239528006.exesysmsrvcx.exedescription pid process target process PID 944 wrote to memory of 1840 944 508bc81bf6a736b3f6ff1c2cb2613418.exe sysmsrvcx.exe PID 944 wrote to memory of 1840 944 508bc81bf6a736b3f6ff1c2cb2613418.exe sysmsrvcx.exe PID 944 wrote to memory of 1840 944 508bc81bf6a736b3f6ff1c2cb2613418.exe sysmsrvcx.exe PID 944 wrote to memory of 1840 944 508bc81bf6a736b3f6ff1c2cb2613418.exe sysmsrvcx.exe PID 1840 wrote to memory of 1004 1840 sysmsrvcx.exe 2769725352.exe PID 1840 wrote to memory of 1004 1840 sysmsrvcx.exe 2769725352.exe PID 1840 wrote to memory of 1004 1840 sysmsrvcx.exe 2769725352.exe PID 1840 wrote to memory of 1004 1840 sysmsrvcx.exe 2769725352.exe PID 1840 wrote to memory of 1620 1840 sysmsrvcx.exe 239528006.exe PID 1840 wrote to memory of 1620 1840 sysmsrvcx.exe 239528006.exe PID 1840 wrote to memory of 1620 1840 sysmsrvcx.exe 239528006.exe PID 1840 wrote to memory of 1620 1840 sysmsrvcx.exe 239528006.exe PID 1620 wrote to memory of 668 1620 239528006.exe sysmsrvcx.exe PID 1620 wrote to memory of 668 1620 239528006.exe sysmsrvcx.exe PID 1620 wrote to memory of 668 1620 239528006.exe sysmsrvcx.exe PID 1620 wrote to memory of 668 1620 239528006.exe sysmsrvcx.exe PID 668 wrote to memory of 1992 668 sysmsrvcx.exe 504130786.exe PID 668 wrote to memory of 1992 668 sysmsrvcx.exe 504130786.exe PID 668 wrote to memory of 1992 668 sysmsrvcx.exe 504130786.exe PID 668 wrote to memory of 1992 668 sysmsrvcx.exe 504130786.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\508bc81bf6a736b3f6ff1c2cb2613418.exe"C:\Users\Admin\AppData\Local\Temp\508bc81bf6a736b3f6ff1c2cb2613418.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\sysmsrvcx.exeC:\Windows\sysmsrvcx.exe2⤵
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2769725352.exeC:\Users\Admin\AppData\Local\Temp\2769725352.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\239528006.exeC:\Users\Admin\AppData\Local\Temp\239528006.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\sysmsrvcx.exeC:\Users\Admin\sysmsrvcx.exe4⤵
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\504130786.exeC:\Users\Admin\AppData\Local\Temp\504130786.exe5⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7BYN4WSI\1[1]Filesize
6KB
MD535e1609b5e653be9ff4740e5b24dff64
SHA15fad868f2b10d73f8189b144009dd19faf846a1a
SHA256cf9b08b51b1ac1a1819f6891135437eceda332bfdfab1ca6123081e5a0814ccc
SHA5127846d98e7fa7f34628128bf25ddabe83d6f966e94f7c3140852066d0f01be8d67dd2602897abbb45fba01cf8530a8138e57aace71216f466c02847193863305e
-
C:\Users\Admin\AppData\Local\Temp\239528006.exeFilesize
75KB
MD5508bc81bf6a736b3f6ff1c2cb2613418
SHA1c0a6c581783273794c54d5c4622e5af6e0e5b755
SHA256e4fdc23e22c217e8123fb10c408e5d9203d656c70b3f0b6dcbc11235342347a0
SHA512d39368a1e169d7a3d6f8f9edd9e91878724eeecf23d260a0ed3881f328dda58aa3fe1f04dbf264d8fccc468245a8b0d65a6620a1a4c8359748e2f794e316c2ae
-
C:\Users\Admin\AppData\Local\Temp\239528006.exeFilesize
75KB
MD5508bc81bf6a736b3f6ff1c2cb2613418
SHA1c0a6c581783273794c54d5c4622e5af6e0e5b755
SHA256e4fdc23e22c217e8123fb10c408e5d9203d656c70b3f0b6dcbc11235342347a0
SHA512d39368a1e169d7a3d6f8f9edd9e91878724eeecf23d260a0ed3881f328dda58aa3fe1f04dbf264d8fccc468245a8b0d65a6620a1a4c8359748e2f794e316c2ae
-
C:\Users\Admin\AppData\Local\Temp\2769725352.exeFilesize
6KB
MD503ee7b245daeebbf2ccaa1690a9fc8fc
SHA1561710d7f8c05ff5c2a3a384be5de6e023e41ac4
SHA2566bc23b9878978a2f3c507acfdad0b2244a8bda5143359613db039cb21d9c1228
SHA512f64163899218b24ee1dd59748e024e0106d83dbea3e31c0f05b1efb8558a47c232dbbcd1463a121c63e2dff2743887925238d8bf6eab0b9ee0292386918e8e55
-
C:\Users\Admin\AppData\Local\Temp\504130786.exeFilesize
6KB
MD503ee7b245daeebbf2ccaa1690a9fc8fc
SHA1561710d7f8c05ff5c2a3a384be5de6e023e41ac4
SHA2566bc23b9878978a2f3c507acfdad0b2244a8bda5143359613db039cb21d9c1228
SHA512f64163899218b24ee1dd59748e024e0106d83dbea3e31c0f05b1efb8558a47c232dbbcd1463a121c63e2dff2743887925238d8bf6eab0b9ee0292386918e8e55
-
C:\Users\Admin\AppData\Local\Temp\504130786.exeFilesize
6KB
MD503ee7b245daeebbf2ccaa1690a9fc8fc
SHA1561710d7f8c05ff5c2a3a384be5de6e023e41ac4
SHA2566bc23b9878978a2f3c507acfdad0b2244a8bda5143359613db039cb21d9c1228
SHA512f64163899218b24ee1dd59748e024e0106d83dbea3e31c0f05b1efb8558a47c232dbbcd1463a121c63e2dff2743887925238d8bf6eab0b9ee0292386918e8e55
-
C:\Users\Admin\sysmsrvcx.exeFilesize
75KB
MD5508bc81bf6a736b3f6ff1c2cb2613418
SHA1c0a6c581783273794c54d5c4622e5af6e0e5b755
SHA256e4fdc23e22c217e8123fb10c408e5d9203d656c70b3f0b6dcbc11235342347a0
SHA512d39368a1e169d7a3d6f8f9edd9e91878724eeecf23d260a0ed3881f328dda58aa3fe1f04dbf264d8fccc468245a8b0d65a6620a1a4c8359748e2f794e316c2ae
-
C:\Users\Admin\sysmsrvcx.exeFilesize
75KB
MD5508bc81bf6a736b3f6ff1c2cb2613418
SHA1c0a6c581783273794c54d5c4622e5af6e0e5b755
SHA256e4fdc23e22c217e8123fb10c408e5d9203d656c70b3f0b6dcbc11235342347a0
SHA512d39368a1e169d7a3d6f8f9edd9e91878724eeecf23d260a0ed3881f328dda58aa3fe1f04dbf264d8fccc468245a8b0d65a6620a1a4c8359748e2f794e316c2ae
-
C:\Users\Admin\tbcmds.datFilesize
289B
MD51c90136084bb0c42b92f777d19a15ae8
SHA199f2ae69188b44e90370d49f605eef56104de05c
SHA2563913e12d3d32eae206f2eb5da8c3a187dace44817dd815453f294560e87c24b7
SHA5129fba1aeed9a5d758f332651c5ca7d7263b00a7faf12a0b573e6664946defcd3c1a4b5619ada1a6a843215f378a20ba6e665f1f0009c97a0ef808ff6c2bc5b962
-
C:\Users\Admin\tbnds.datFilesize
4KB
MD5f85b6497f5d3b7f7c78adee4f4323b96
SHA1078a7ee87504eb2862530a4189524cafbca5d8d9
SHA256ca26bb249bef18edf6ea21dca73d05f0de453da1fcc98e5ecfa14477cb21faf7
SHA5125941e5e3f94810dbe7d286ea323352a7df8202f8c97ac98fdab2dcf197890ac6689c78e824573582f34900d36e1164557fa591f5e7d6a696b5b634a059173859
-
C:\Windows\sysmsrvcx.exeFilesize
75KB
MD5508bc81bf6a736b3f6ff1c2cb2613418
SHA1c0a6c581783273794c54d5c4622e5af6e0e5b755
SHA256e4fdc23e22c217e8123fb10c408e5d9203d656c70b3f0b6dcbc11235342347a0
SHA512d39368a1e169d7a3d6f8f9edd9e91878724eeecf23d260a0ed3881f328dda58aa3fe1f04dbf264d8fccc468245a8b0d65a6620a1a4c8359748e2f794e316c2ae
-
C:\Windows\sysmsrvcx.exeFilesize
75KB
MD5508bc81bf6a736b3f6ff1c2cb2613418
SHA1c0a6c581783273794c54d5c4622e5af6e0e5b755
SHA256e4fdc23e22c217e8123fb10c408e5d9203d656c70b3f0b6dcbc11235342347a0
SHA512d39368a1e169d7a3d6f8f9edd9e91878724eeecf23d260a0ed3881f328dda58aa3fe1f04dbf264d8fccc468245a8b0d65a6620a1a4c8359748e2f794e316c2ae
-
C:\Windows\sysmsrvcx.exeFilesize
75KB
MD5508bc81bf6a736b3f6ff1c2cb2613418
SHA1c0a6c581783273794c54d5c4622e5af6e0e5b755
SHA256e4fdc23e22c217e8123fb10c408e5d9203d656c70b3f0b6dcbc11235342347a0
SHA512d39368a1e169d7a3d6f8f9edd9e91878724eeecf23d260a0ed3881f328dda58aa3fe1f04dbf264d8fccc468245a8b0d65a6620a1a4c8359748e2f794e316c2ae
-
\Users\Admin\AppData\Local\Temp\239528006.exeFilesize
75KB
MD5508bc81bf6a736b3f6ff1c2cb2613418
SHA1c0a6c581783273794c54d5c4622e5af6e0e5b755
SHA256e4fdc23e22c217e8123fb10c408e5d9203d656c70b3f0b6dcbc11235342347a0
SHA512d39368a1e169d7a3d6f8f9edd9e91878724eeecf23d260a0ed3881f328dda58aa3fe1f04dbf264d8fccc468245a8b0d65a6620a1a4c8359748e2f794e316c2ae
-
\Users\Admin\AppData\Local\Temp\239528006.exeFilesize
75KB
MD5508bc81bf6a736b3f6ff1c2cb2613418
SHA1c0a6c581783273794c54d5c4622e5af6e0e5b755
SHA256e4fdc23e22c217e8123fb10c408e5d9203d656c70b3f0b6dcbc11235342347a0
SHA512d39368a1e169d7a3d6f8f9edd9e91878724eeecf23d260a0ed3881f328dda58aa3fe1f04dbf264d8fccc468245a8b0d65a6620a1a4c8359748e2f794e316c2ae
-
\Users\Admin\AppData\Local\Temp\2769725352.exeFilesize
6KB
MD503ee7b245daeebbf2ccaa1690a9fc8fc
SHA1561710d7f8c05ff5c2a3a384be5de6e023e41ac4
SHA2566bc23b9878978a2f3c507acfdad0b2244a8bda5143359613db039cb21d9c1228
SHA512f64163899218b24ee1dd59748e024e0106d83dbea3e31c0f05b1efb8558a47c232dbbcd1463a121c63e2dff2743887925238d8bf6eab0b9ee0292386918e8e55
-
\Users\Admin\AppData\Local\Temp\504130786.exeFilesize
6KB
MD503ee7b245daeebbf2ccaa1690a9fc8fc
SHA1561710d7f8c05ff5c2a3a384be5de6e023e41ac4
SHA2566bc23b9878978a2f3c507acfdad0b2244a8bda5143359613db039cb21d9c1228
SHA512f64163899218b24ee1dd59748e024e0106d83dbea3e31c0f05b1efb8558a47c232dbbcd1463a121c63e2dff2743887925238d8bf6eab0b9ee0292386918e8e55
-
\Users\Admin\sysmsrvcx.exeFilesize
75KB
MD5508bc81bf6a736b3f6ff1c2cb2613418
SHA1c0a6c581783273794c54d5c4622e5af6e0e5b755
SHA256e4fdc23e22c217e8123fb10c408e5d9203d656c70b3f0b6dcbc11235342347a0
SHA512d39368a1e169d7a3d6f8f9edd9e91878724eeecf23d260a0ed3881f328dda58aa3fe1f04dbf264d8fccc468245a8b0d65a6620a1a4c8359748e2f794e316c2ae
-
\Users\Admin\sysmsrvcx.exeFilesize
75KB
MD5508bc81bf6a736b3f6ff1c2cb2613418
SHA1c0a6c581783273794c54d5c4622e5af6e0e5b755
SHA256e4fdc23e22c217e8123fb10c408e5d9203d656c70b3f0b6dcbc11235342347a0
SHA512d39368a1e169d7a3d6f8f9edd9e91878724eeecf23d260a0ed3881f328dda58aa3fe1f04dbf264d8fccc468245a8b0d65a6620a1a4c8359748e2f794e316c2ae