Analysis
-
max time kernel
150s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
05-05-2023 20:56
Behavioral task
behavioral1
Sample
rundll64.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
rundll64.exe
Resource
win10v2004-20230220-en
General
-
Target
rundll64.exe
-
Size
236KB
-
MD5
4165a3dba3c7ac26b225f8623f70ebaa
-
SHA1
587df43d63da7dfd726a4bb8f39877647cc07da0
-
SHA256
523d97331fcef84ff767dbb01836766d8b1be9bbeb3d76e9fda3a02ad46fd976
-
SHA512
43ad74651aad95f16bd17f6fea857534c6c6502cb0c06262092e7b10ab59a27b663565668d6fd4436c72a114f632ab6940fc4f1914d165eba7e5a8a8b5743b8e
-
SSDEEP
6144:qb/A0SeQu0hL2cyBt2iOjese1HSCRhECwt6:q8D5P2ICsDCRhQ6
Malware Config
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 1216 bcdedit.exe 1196 bcdedit.exe -
Processes:
wbadmin.exepid process 1984 wbadmin.exe -
Modifies Windows Firewall 1 TTPs 2 IoCs
-
Drops startup file 1 IoCs
Processes:
rundll64.exedescription ioc process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\rundll64.exe rundll64.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
rundll64.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rundll64 = "C:\\Users\\Admin\\AppData\\Local\\rundll64.exe" rundll64.exe Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Run\rundll64 = "C:\\Users\\Admin\\AppData\\Local\\rundll64.exe" rundll64.exe -
Drops desktop.ini file(s) 3 IoCs
Processes:
rundll64.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-3430344531-3702557399-3004411149-1000\desktop.ini rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini rundll64.exe File opened for modification C:\Program Files\desktop.ini rundll64.exe -
Drops file in Program Files directory 64 IoCs
Processes:
rundll64.exedescription ioc process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\tipresx.dll.mui rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf rundll64.exe File opened for modification C:\Program Files\Common Files\System\ado\msador15.dll rundll64.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui rundll64.exe File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui rundll64.exe File created C:\Program Files\7-Zip\Lang\ms.txt.id[A94330E5-3093].[[email protected]].eking rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui rundll64.exe File opened for modification C:\Program Files\Common Files\System\ado\adojavas.inc rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui rundll64.exe File created C:\Program Files\7-Zip\Lang\gu.txt.id[A94330E5-3093].[[email protected]].eking rundll64.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwresslm.dat rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm rundll64.exe File opened for modification C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui rundll64.exe File opened for modification C:\Program Files\7-Zip\descript.ion rundll64.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt rundll64.exe File created C:\Program Files\7-Zip\Lang\sv.txt.id[A94330E5-3093].[[email protected]].eking rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll rundll64.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt rundll64.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms.id[A94330E5-3093].[[email protected]].eking rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL.id[A94330E5-3093].[[email protected]].eking rundll64.exe File created C:\Program Files\desktop.ini.id[A94330E5-3093].[[email protected]].eking rundll64.exe File created C:\Program Files\7-Zip\Lang\en.ttt.id[A94330E5-3093].[[email protected]].eking rundll64.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui rundll64.exe File opened for modification C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb rundll64.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb.id[A94330E5-3093].[[email protected]].eking rundll64.exe File opened for modification C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui rundll64.exe File created C:\Program Files\7-Zip\Lang\ja.txt.id[A94330E5-3093].[[email protected]].eking rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\imjplm.dll rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg rundll64.exe File opened for modification C:\Program Files\Common Files\System\ado\msado26.tlb rundll64.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll rundll64.exe File opened for modification C:\Program Files\Common Files\System\msadc\adcvbs.inc rundll64.exe File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui rundll64.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui rundll64.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\msdaosp.dll rundll64.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml rundll64.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF.id[A94330E5-3093].[[email protected]].eking rundll64.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe rundll64.exe File opened for modification C:\Program Files\7-Zip\History.txt rundll64.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt rundll64.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt rundll64.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt rundll64.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx rundll64.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt rundll64.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 768 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll64.exepid process 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe 284 rundll64.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
Processes:
rundll64.exevssvc.exeWMIC.exewbengine.exedescription pid process Token: SeDebugPrivilege 284 rundll64.exe Token: SeBackupPrivilege 1844 vssvc.exe Token: SeRestorePrivilege 1844 vssvc.exe Token: SeAuditPrivilege 1844 vssvc.exe Token: SeIncreaseQuotaPrivilege 1268 WMIC.exe Token: SeSecurityPrivilege 1268 WMIC.exe Token: SeTakeOwnershipPrivilege 1268 WMIC.exe Token: SeLoadDriverPrivilege 1268 WMIC.exe Token: SeSystemProfilePrivilege 1268 WMIC.exe Token: SeSystemtimePrivilege 1268 WMIC.exe Token: SeProfSingleProcessPrivilege 1268 WMIC.exe Token: SeIncBasePriorityPrivilege 1268 WMIC.exe Token: SeCreatePagefilePrivilege 1268 WMIC.exe Token: SeBackupPrivilege 1268 WMIC.exe Token: SeRestorePrivilege 1268 WMIC.exe Token: SeShutdownPrivilege 1268 WMIC.exe Token: SeDebugPrivilege 1268 WMIC.exe Token: SeSystemEnvironmentPrivilege 1268 WMIC.exe Token: SeRemoteShutdownPrivilege 1268 WMIC.exe Token: SeUndockPrivilege 1268 WMIC.exe Token: SeManageVolumePrivilege 1268 WMIC.exe Token: 33 1268 WMIC.exe Token: 34 1268 WMIC.exe Token: 35 1268 WMIC.exe Token: SeIncreaseQuotaPrivilege 1268 WMIC.exe Token: SeSecurityPrivilege 1268 WMIC.exe Token: SeTakeOwnershipPrivilege 1268 WMIC.exe Token: SeLoadDriverPrivilege 1268 WMIC.exe Token: SeSystemProfilePrivilege 1268 WMIC.exe Token: SeSystemtimePrivilege 1268 WMIC.exe Token: SeProfSingleProcessPrivilege 1268 WMIC.exe Token: SeIncBasePriorityPrivilege 1268 WMIC.exe Token: SeCreatePagefilePrivilege 1268 WMIC.exe Token: SeBackupPrivilege 1268 WMIC.exe Token: SeRestorePrivilege 1268 WMIC.exe Token: SeShutdownPrivilege 1268 WMIC.exe Token: SeDebugPrivilege 1268 WMIC.exe Token: SeSystemEnvironmentPrivilege 1268 WMIC.exe Token: SeRemoteShutdownPrivilege 1268 WMIC.exe Token: SeUndockPrivilege 1268 WMIC.exe Token: SeManageVolumePrivilege 1268 WMIC.exe Token: 33 1268 WMIC.exe Token: 34 1268 WMIC.exe Token: 35 1268 WMIC.exe Token: SeBackupPrivilege 1184 wbengine.exe Token: SeRestorePrivilege 1184 wbengine.exe Token: SeSecurityPrivilege 1184 wbengine.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
rundll64.execmd.execmd.exedescription pid process target process PID 284 wrote to memory of 564 284 rundll64.exe cmd.exe PID 284 wrote to memory of 564 284 rundll64.exe cmd.exe PID 284 wrote to memory of 564 284 rundll64.exe cmd.exe PID 284 wrote to memory of 564 284 rundll64.exe cmd.exe PID 284 wrote to memory of 608 284 rundll64.exe cmd.exe PID 284 wrote to memory of 608 284 rundll64.exe cmd.exe PID 284 wrote to memory of 608 284 rundll64.exe cmd.exe PID 284 wrote to memory of 608 284 rundll64.exe cmd.exe PID 564 wrote to memory of 1832 564 cmd.exe netsh.exe PID 564 wrote to memory of 1832 564 cmd.exe netsh.exe PID 564 wrote to memory of 1832 564 cmd.exe netsh.exe PID 608 wrote to memory of 768 608 cmd.exe vssadmin.exe PID 608 wrote to memory of 768 608 cmd.exe vssadmin.exe PID 608 wrote to memory of 768 608 cmd.exe vssadmin.exe PID 564 wrote to memory of 700 564 cmd.exe netsh.exe PID 564 wrote to memory of 700 564 cmd.exe netsh.exe PID 564 wrote to memory of 700 564 cmd.exe netsh.exe PID 608 wrote to memory of 1268 608 cmd.exe WMIC.exe PID 608 wrote to memory of 1268 608 cmd.exe WMIC.exe PID 608 wrote to memory of 1268 608 cmd.exe WMIC.exe PID 608 wrote to memory of 1216 608 cmd.exe bcdedit.exe PID 608 wrote to memory of 1216 608 cmd.exe bcdedit.exe PID 608 wrote to memory of 1216 608 cmd.exe bcdedit.exe PID 608 wrote to memory of 1196 608 cmd.exe bcdedit.exe PID 608 wrote to memory of 1196 608 cmd.exe bcdedit.exe PID 608 wrote to memory of 1196 608 cmd.exe bcdedit.exe PID 608 wrote to memory of 1984 608 cmd.exe wbadmin.exe PID 608 wrote to memory of 1984 608 cmd.exe wbadmin.exe PID 608 wrote to memory of 1984 608 cmd.exe wbadmin.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\rundll64.exe"C:\Users\Admin\AppData\Local\Temp\rundll64.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:284 -
C:\Users\Admin\AppData\Local\Temp\rundll64.exe"C:\Users\Admin\AppData\Local\Temp\rundll64.exe"2⤵PID:924
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:768
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1268
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:1216
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:1196
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:1984
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
PID:1832
-
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
PID:700
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1844
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1184
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1936
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:884
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.id[A94330E5-3093].[[email protected]].eking
Filesize23.5MB
MD557929ab7556a5965c35638df972e5f05
SHA102814a3feb4799e6784fc1fadb596b5843215330
SHA256be86996d87cd619ad96e00cff7543883a7034a8d8bb467b95a28c9f40aa488de
SHA5121e893768f2c03965430bbbc457fce5810df66c7d2b1684d7abc8ec3784b3eec9b7f5a9b4ff27b1b47f6df4da377c85e4b7c1486deb3579465205d8b114b56c8b