phorphiex | 23eb5ce08da7b25da36273341a12ea84f5a062fc77fe32cedb83d6310f572b12

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysdrvefda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysdrvefda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysdrvefda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysdrvefda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysdrvefda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysdrvefda.exe

Enumerates VirtualBox registry keys 2 TTPs 5 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	2382919392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	2382919392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	2382919392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	2382919392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	2382919392.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	2382919392.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	2382919392.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2382919392.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	2382919392.exe

Downloads MZ/PE file

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	2382919392.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2382919392.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2382919392.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2382919392.exe

Executes dropped EXE 11 IoCs

pid	Process
1148	sysdrvefda.exe
1336	1926311814.exe
1316	3254922805.exe
1252	1597123712.exe
1628	Windows Security Upgrade Service.exe
1904	1589324514.exe
1468	2382919392.exe
1676	Windows Security Upgrade Service.exe
1064	Windows Security Upgrade Service.exe
1644	2015127625.exe
268	winsvrupd.exe

Loads dropped DLL 12 IoCs

pid	Process
1148	sysdrvefda.exe
1148	sysdrvefda.exe
1148	sysdrvefda.exe
1148	sysdrvefda.exe
1252	1597123712.exe
1148	sysdrvefda.exe
1904	1589324514.exe
1904	1589324514.exe
1252	1597123712.exe
1252	1597123712.exe
1316	3254922805.exe
1548	taskeng.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysdrvefda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysdrvefda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysdrvefda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysdrvefda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysdrvefda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysdrvefda.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysdrvefda.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysdrvefda.exe"	ce87790b45cd1822a71e4d81733ec535a8aa5c42ec48f3593b14c5049ab635e6.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2382919392.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2382919392.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1468	2382919392.exe
1468	2382919392.exe
1468	2382919392.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	2382919392.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\sysdrvefda.exe	ce87790b45cd1822a71e4d81733ec535a8aa5c42ec48f3593b14c5049ab635e6.exe
File opened for modification	C:\Windows\sysdrvefda.exe	ce87790b45cd1822a71e4d81733ec535a8aa5c42ec48f3593b14c5049ab635e6.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2382919392.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2382919392.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2382919392.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
320	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1468	2382919392.exe
1468	2382919392.exe
1468	2382919392.exe
1468	2382919392.exe
1468	2382919392.exe
1468	2382919392.exe
1468	2382919392.exe
1468	2382919392.exe
1468	2382919392.exe
1468	2382919392.exe
1644	2015127625.exe
1644	2015127625.exe
1836	powershell.exe
1644	2015127625.exe
1644	2015127625.exe
1536	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1468	2382919392.exe
Token: SeDebugPrivilege	1836	powershell.exe
Token: SeDebugPrivilege	1536	powershell.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 1148	904	ce87790b45cd1822a71e4d81733ec535a8aa5c42ec48f3593b14c5049ab635e6.exe	28
PID 904 wrote to memory of 1148	904	ce87790b45cd1822a71e4d81733ec535a8aa5c42ec48f3593b14c5049ab635e6.exe	28
PID 904 wrote to memory of 1148	904	ce87790b45cd1822a71e4d81733ec535a8aa5c42ec48f3593b14c5049ab635e6.exe	28
PID 904 wrote to memory of 1148	904	ce87790b45cd1822a71e4d81733ec535a8aa5c42ec48f3593b14c5049ab635e6.exe	28
PID 1148 wrote to memory of 1336	1148	sysdrvefda.exe	31
PID 1148 wrote to memory of 1336	1148	sysdrvefda.exe	31
PID 1148 wrote to memory of 1336	1148	sysdrvefda.exe	31
PID 1148 wrote to memory of 1336	1148	sysdrvefda.exe	31
PID 1148 wrote to memory of 1316	1148	sysdrvefda.exe	32
PID 1148 wrote to memory of 1316	1148	sysdrvefda.exe	32
PID 1148 wrote to memory of 1316	1148	sysdrvefda.exe	32
PID 1148 wrote to memory of 1316	1148	sysdrvefda.exe	32
PID 1148 wrote to memory of 1252	1148	sysdrvefda.exe	33
PID 1148 wrote to memory of 1252	1148	sysdrvefda.exe	33
PID 1148 wrote to memory of 1252	1148	sysdrvefda.exe	33
PID 1148 wrote to memory of 1252	1148	sysdrvefda.exe	33
PID 1252 wrote to memory of 1628	1252	1597123712.exe	34
PID 1252 wrote to memory of 1628	1252	1597123712.exe	34
PID 1252 wrote to memory of 1628	1252	1597123712.exe	34
PID 1252 wrote to memory of 1628	1252	1597123712.exe	34
PID 1148 wrote to memory of 1904	1148	sysdrvefda.exe	36
PID 1148 wrote to memory of 1904	1148	sysdrvefda.exe	36
PID 1148 wrote to memory of 1904	1148	sysdrvefda.exe	36
PID 1148 wrote to memory of 1904	1148	sysdrvefda.exe	36
PID 1904 wrote to memory of 1468	1904	1589324514.exe	37
PID 1904 wrote to memory of 1468	1904	1589324514.exe	37
PID 1904 wrote to memory of 1468	1904	1589324514.exe	37
PID 1904 wrote to memory of 1468	1904	1589324514.exe	37
PID 1252 wrote to memory of 1676	1252	1597123712.exe	39
PID 1252 wrote to memory of 1676	1252	1597123712.exe	39
PID 1252 wrote to memory of 1676	1252	1597123712.exe	39
PID 1252 wrote to memory of 1676	1252	1597123712.exe	39
PID 1252 wrote to memory of 1064	1252	1597123712.exe	40
PID 1252 wrote to memory of 1064	1252	1597123712.exe	40
PID 1252 wrote to memory of 1064	1252	1597123712.exe	40
PID 1252 wrote to memory of 1064	1252	1597123712.exe	40
PID 1316 wrote to memory of 1644	1316	3254922805.exe	43
PID 1316 wrote to memory of 1644	1316	3254922805.exe	43
PID 1316 wrote to memory of 1644	1316	3254922805.exe	43
PID 1316 wrote to memory of 1644	1316	3254922805.exe	43
PID 1836 wrote to memory of 320	1836	powershell.exe	47
PID 1836 wrote to memory of 320	1836	powershell.exe	47
PID 1836 wrote to memory of 320	1836	powershell.exe	47
PID 1536 wrote to memory of 1856	1536	powershell.exe	50
PID 1536 wrote to memory of 1856	1536	powershell.exe	50
PID 1536 wrote to memory of 1856	1536	powershell.exe	50
PID 1548 wrote to memory of 268	1548	taskeng.exe	52
PID 1548 wrote to memory of 268	1548	taskeng.exe	52
PID 1548 wrote to memory of 268	1548	taskeng.exe	52

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212
- C:\Users\Admin\AppData\Local\Temp\ce87790b45cd1822a71e4d81733ec535a8aa5c42ec48f3593b14c5049ab635e6.exe
  "C:\Users\Admin\AppData\Local\Temp\ce87790b45cd1822a71e4d81733ec535a8aa5c42ec48f3593b14c5049ab635e6.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Windows\sysdrvefda.exe
    C:\Windows\sysdrvefda.exe
    3⤵
    - Windows security bypass
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - Suspicious use of WriteProcessMemory
    PID:1148
  - - C:\Users\Admin\AppData\Local\Temp\1926311814.exe
      C:\Users\Admin\AppData\Local\Temp\1926311814.exe
      4⤵
      Executes dropped EXE
      PID:1336
  - - C:\Users\Admin\AppData\Local\Temp\3254922805.exe
      C:\Users\Admin\AppData\Local\Temp\3254922805.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1316
    - - C:\Users\Admin\AppData\Local\Temp\2015127625.exe
        
        C:\Users\Admin\AppData\Local\Temp\2015127625.exe
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1644
  - - C:\Users\Admin\AppData\Local\Temp\1597123712.exe
      C:\Users\Admin\AppData\Local\Temp\1597123712.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1252
    - - C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"
        5⤵
        Executes dropped EXE
        
        PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"
        5⤵
        Executes dropped EXE
        
        PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"
        5⤵
        Executes dropped EXE
        
        PID:1064
  - - C:\Users\Admin\AppData\Local\Temp\1589324514.exe
      C:\Users\Admin\AppData\Local\Temp\1589324514.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1904
    - - C:\Users\Admin\AppData\Local\Temp\2382919392.exe
        
        C:\Users\Admin\AppData\Local\Temp\2382919392.exe
        5⤵
        Enumerates VirtualBox registry keys
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Looks for VirtualBox Guest Additions in registry
        Looks for VMWare Tools registry key
        Checks BIOS information in registry
        Executes dropped EXE
        Checks system information in the registry
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Checks for VirtualBox DLLs, possible anti-VM trick
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#fwjcobfk#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachine' /tr '''C:\Users\Admin\Windows Security\Update\winsvrupd.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Security\Update\winsvrupd.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachine' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachine" /t REG_SZ /f /d 'C:\Users\Admin\Windows Security\Update\winsvrupd.exe' }
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn GoogleUpdateTaskMachine /tr "'C:\Users\Admin\Windows Security\Update\winsvrupd.exe'"
    3⤵
    - Creates scheduled task(s)
    PID:320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#boaqiqu#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachine" } Else { "C:\Users\Admin\Windows Security\Update\winsvrupd.exe" }
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachine
    3⤵
    PID:1856

C:\Windows\system32\taskeng.exe
taskeng.exe {0ED33562-6339-4B2C-9B81-AFAA68A96623} S-1-5-21-3430344531-3702557399-3004411149-1000:WFSTZEPN\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Users\Admin\Windows Security\Update\winsvrupd.exe
  "C:\Users\Admin\Windows Security\Update\winsvrupd.exe"
  2⤵
  - Executes dropped EXE
  PID:268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion