Overview

overview

10

Static

static

3

2adc3512b5...43.exe

windows7-x64

10

2adc3512b5...43.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-08-2023 02:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2adc3512b51b70e8a5d6093aa342e5c12fa13e60bc4587e311f504709895c043.exe

  • Size

    343KB

  • MD5

    5bcdc56c88b5ed743ebeebb0bda7e034

  • SHA1

    d04fc0c54d725943faa976cab0a9ea9a576d6d9c

  • SHA256

    2adc3512b51b70e8a5d6093aa342e5c12fa13e60bc4587e311f504709895c043

  • SHA512

    1537da4fb37c9c22c7e298e575c333734d7e3f4532bde1a1dfb52501d0b6033188f860ba99df9fa2779e50c2e0769a80ebe566e3ea9a6b5e7ba47766ca33b1c7

  • SSDEEP

    6144:SCGaECnpAoDO1A8dg3iTPJLMfgQZX+tJs0dx+b6a:DGHCnaomAEg3uPdkgOX+tZdxJa

Score
10/10
phobosevasionpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\info.hta

Ransom Note
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'> <html> <head> <meta charset='windows-1251'> <title>encrypted</title> <HTA:APPLICATION ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu="no"> <script language='JScript'> window.moveTo(50, 50); window.resizeTo(screen.width - 100, screen.height - 100); </script> <style type='text/css'> body { font: 15px Tahoma, sans-serif; margin: 10px; line-height: 25px; background: #EDEDED; } img { display:inline-block; } .bold { font-weight: bold; } .mark { background: #D0D0E8; padding: 2px 5px; } .header { text-align: center; font-size: 30px; line-height: 50px; font-weight: bold; margin-bottom:20px; } .info { background: #D0D0E8; border-left: 10px solid #00008B; } .alert { background: #FFE4E4; border-left: 10px solid #FF0000; } .private { border: 1px dashed #000; background: #FFFFEF; } .note { height: auto; padding-bottom: 1px; margin: 15px 0; } .note .title { font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; } .note .mark { background: #A2A2B5; } .note ul { margin-top: 0; } .note pre { margin-left: 15px; line-height: 13px; font-size: 13px; } .footer { position:fixed; bottom:0; right:0; text-align: right; } </style> </head> <body> <div class='header'> <img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII='> <div>ATTENTION!!!!</div> </div> <div class='bold'>Unfortunately for you, a major IT security weakness left you open to attack, your files have been encrypted with ciphers more advanced than those used for diplomatic communications, you can spend days and months searching for a magical way to decrypt your files, but rest assured we are the only people who can help you recover your files, there is no free tool</div> <div class='bold'>If you want to restore them, install ICQ software on your PC <span class='mark'><a href='https://icq.com/windows/'>https://icq.com/windows/</a></span> or on your mobile phone search in Appstore / Google market "ICQ"</div> <div class='bold'>Write to our ICQ @FIREYOURITGUY <span class='mark'><a href='https://icq.im/FIREYOURITGUY'>https://icq.im/FIREYOURITGUY</a></span></div> <div class='bold'>Write this ID in the title of your message <span class='mark'>F581A117-2797</span></div> <div class='note info'> <div class='title'>Free decryption as guarantee</div> <ul>Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) </ul> </div> <div class='note alert'> <div class='title'>Attention!</div> <ul> <li>Do not rename encrypted files.</li> <li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li> <li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li> </ul> </div> </body> </html>
URLs

http://www.w3.org/TR/html4/strict.dtd'>

Extracted

Path

C:\Users\Admin\Desktop\info.hta

Ransom Note
ATTENTION!!!! Unfortunately for you, a major IT security weakness left you open to attack, your files have been encrypted with ciphers more advanced than those used for diplomatic communications, you can spend days and months searching for a magical way to decrypt your files, but rest assured we are the only people who can help you recover your files, there is no free tool If you want to restore them, install ICQ software on your PC https://icq.com/windows/ or on your mobile phone search in Appstore / Google market "ICQ" Write to our ICQ @FIREYOURITGUY https://icq.im/FIREYOURITGUY Write this ID in the title of your message F581A117-2797 Free decryption as guarantee Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
URLs

https://icq.com/windows/

https://icq.im/FIREYOURITGUY

Signatures

  • Phobos

    Phobos ransomware appeared at the beginning of 2019.

    ransomwarephobos
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
    ransomwareevasion
  • Renames multiple (473) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes backup catalog 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Modifies Windows Firewall 1 TTPs 2 IoCs
    evasion
  • Drops startup file 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2adc3512b51b70e8a5d6093aa342e5c12fa13e60bc4587e311f504709895c043.exe
    "C:\Users\Admin\AppData\Local\Temp\2adc3512b51b70e8a5d6093aa342e5c12fa13e60bc4587e311f504709895c043.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4668
    • C:\Windows\Temp\update.exe
      "C:\Windows\Temp\update.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2456
      • C:\Windows\Temp\update.exe
        "C:\Windows\Temp\update.exe"
        3⤵
        • Executes dropped EXE
        PID:920
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5040
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:3864
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2552
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:2004
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled no
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:2328
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          4⤵
          • Deletes backup catalog
          PID:948
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4248
        • C:\Windows\system32\netsh.exe
          netsh advfirewall set currentprofile state off
          4⤵
          • Modifies Windows Firewall
          PID:4760
        • C:\Windows\system32\netsh.exe
          netsh firewall set opmode mode=disable
          4⤵
          • Modifies Windows Firewall
          PID:4428
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        3⤵
          PID:2100
        • C:\Windows\SysWOW64\mshta.exe
          "C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
          3⤵
            PID:4632
          • C:\Windows\SysWOW64\mshta.exe
            "C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
            3⤵
              PID:2592
            • C:\Windows\SysWOW64\mshta.exe
              "C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
              3⤵
                PID:4312
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:5028
                • C:\Windows\system32\vssadmin.exe
                  vssadmin delete shadows /all /quiet
                  4⤵
                  • Interacts with shadow copies
                  PID:4104
                • C:\Windows\System32\Wbem\WMIC.exe
                  wmic shadowcopy delete
                  4⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4240
                • C:\Windows\system32\bcdedit.exe
                  bcdedit /set {default} bootstatuspolicy ignoreallfailures
                  4⤵
                  • Modifies boot configuration data using bcdedit
                  PID:3964
                • C:\Windows\system32\bcdedit.exe
                  bcdedit /set {default} recoveryenabled no
                  4⤵
                  • Modifies boot configuration data using bcdedit
                  PID:5000
                • C:\Windows\system32\wbadmin.exe
                  wbadmin delete catalog -quiet
                  4⤵
                  • Deletes backup catalog
                  PID:1716
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3856
          • C:\Windows\system32\wbengine.exe
            "C:\Windows\system32\wbengine.exe"
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1812
          • C:\Windows\System32\vdsldr.exe
            C:\Windows\System32\vdsldr.exe -Embedding
            1⤵
              PID:1892
            • C:\Windows\System32\vds.exe
              C:\Windows\System32\vds.exe
              1⤵
                PID:3468

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[F581A117-2797].[ICQ@FIREYOURITGUY].messedup
                Filesize

                3.2MB

                MD5

                fa2402efa82d4118d8aaba7e1bb9dfc1

                SHA1

                da1d05c0da0ae89f900d7c47d3986fd9a0503b58

                SHA256

                9061e05236ba2ca05dd35be404837e066a29b278c6fbabc9de7fe1dd64c534fb

                SHA512

                306b4c8943447cc4ac96e41944085db1f364d84606aee05e23b4509778ae97b7c730f178a97efd12bf7f15b0675b7e8cb5a2e0c4caac6f6fbe14c5d7b425b231

                Download Submit

              • C:\Users\Admin\Desktop\info.hta
                Filesize

                4KB

                MD5

                312d80ead4a93902ca36a6f487028e83

                SHA1

                b08119b858b146bd0d17439d3707dd48aa59454b

                SHA256

                e10528125dc0ac2077293b5b7f5d85350145de9c1754e36ac84069b29da894ba

                SHA512

                6e01d2a6c4b6789fc15ce15b8c160cd3296e3fcae02a15484a6c93f57c21c8eac0bb101d2d4d201af56023ebbcd2deba1eca938a2e00bc0929d5676840bf29b0

                Download Submit

              • C:\Windows\Temp\update.exe
                Filesize

                55KB

                MD5

                af5f882e78ea88b41b0dfbe327cdfdb9

                SHA1

                62b65def66d9ef39f1b11b8c987e71cad07b9837

                SHA256

                3d4a18a66658bdae299d2334de4043b54cb6ae06f776362831eba6669e9a962b

                SHA512

                831d65eb65c4b26f1db5fd6a9512af004113566bfac933b21cd326d8df2f329216c90f1db8f23bb72f3a3c229f00b7bf005277deaed8579cfe81f27221b9d934

                Download Submit

              • C:\Windows\Temp\update.exe
                Filesize

                55KB

                MD5

                af5f882e78ea88b41b0dfbe327cdfdb9

                SHA1

                62b65def66d9ef39f1b11b8c987e71cad07b9837

                SHA256

                3d4a18a66658bdae299d2334de4043b54cb6ae06f776362831eba6669e9a962b

                SHA512

                831d65eb65c4b26f1db5fd6a9512af004113566bfac933b21cd326d8df2f329216c90f1db8f23bb72f3a3c229f00b7bf005277deaed8579cfe81f27221b9d934

                Download Submit

              • C:\Windows\Temp\update.exe
                Filesize

                55KB

                MD5

                af5f882e78ea88b41b0dfbe327cdfdb9

                SHA1

                62b65def66d9ef39f1b11b8c987e71cad07b9837

                SHA256

                3d4a18a66658bdae299d2334de4043b54cb6ae06f776362831eba6669e9a962b

                SHA512

                831d65eb65c4b26f1db5fd6a9512af004113566bfac933b21cd326d8df2f329216c90f1db8f23bb72f3a3c229f00b7bf005277deaed8579cfe81f27221b9d934

                Download Submit

              • C:\Windows\Temp\update.exe
                Filesize

                55KB

                MD5

                af5f882e78ea88b41b0dfbe327cdfdb9

                SHA1

                62b65def66d9ef39f1b11b8c987e71cad07b9837

                SHA256

                3d4a18a66658bdae299d2334de4043b54cb6ae06f776362831eba6669e9a962b

                SHA512

                831d65eb65c4b26f1db5fd6a9512af004113566bfac933b21cd326d8df2f329216c90f1db8f23bb72f3a3c229f00b7bf005277deaed8579cfe81f27221b9d934

                Download Submit

              • C:\info.hta
                Filesize

                4KB

                MD5

                312d80ead4a93902ca36a6f487028e83

                SHA1

                b08119b858b146bd0d17439d3707dd48aa59454b

                SHA256

                e10528125dc0ac2077293b5b7f5d85350145de9c1754e36ac84069b29da894ba

                SHA512

                6e01d2a6c4b6789fc15ce15b8c160cd3296e3fcae02a15484a6c93f57c21c8eac0bb101d2d4d201af56023ebbcd2deba1eca938a2e00bc0929d5676840bf29b0

                Download Submit

              • C:\info.hta
                Filesize

                4KB

                MD5

                312d80ead4a93902ca36a6f487028e83

                SHA1

                b08119b858b146bd0d17439d3707dd48aa59454b

                SHA256

                e10528125dc0ac2077293b5b7f5d85350145de9c1754e36ac84069b29da894ba

                SHA512

                6e01d2a6c4b6789fc15ce15b8c160cd3296e3fcae02a15484a6c93f57c21c8eac0bb101d2d4d201af56023ebbcd2deba1eca938a2e00bc0929d5676840bf29b0

                Download Submit

              • C:\users\public\desktop\info.hta
                Filesize

                4KB

                MD5

                312d80ead4a93902ca36a6f487028e83

                SHA1

                b08119b858b146bd0d17439d3707dd48aa59454b

                SHA256

                e10528125dc0ac2077293b5b7f5d85350145de9c1754e36ac84069b29da894ba

                SHA512

                6e01d2a6c4b6789fc15ce15b8c160cd3296e3fcae02a15484a6c93f57c21c8eac0bb101d2d4d201af56023ebbcd2deba1eca938a2e00bc0929d5676840bf29b0

                Download Submit

              • F:\info.hta
                Filesize

                4KB

                MD5

                312d80ead4a93902ca36a6f487028e83

                SHA1

                b08119b858b146bd0d17439d3707dd48aa59454b

                SHA256

                e10528125dc0ac2077293b5b7f5d85350145de9c1754e36ac84069b29da894ba

                SHA512

                6e01d2a6c4b6789fc15ce15b8c160cd3296e3fcae02a15484a6c93f57c21c8eac0bb101d2d4d201af56023ebbcd2deba1eca938a2e00bc0929d5676840bf29b0

                Download Submit