Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
17-09-2023 10:15
General
-
Target
f595f91a9966808cc85d11981e66e98043af9aeaaaa3893ef058b9a79c474f17_JC.exe
-
Size
629KB
-
MD5
9b6470fcbb02fa19344e2f3b142f5038
-
SHA1
3307c3ae97ed6be889720949083f93017d1a6675
-
SHA256
f595f91a9966808cc85d11981e66e98043af9aeaaaa3893ef058b9a79c474f17
-
SHA512
f44a6dc0d52bb0cdc5f34a67c608d0ebbcb6e370b2c078095b3a51670a4b07713762c9998949a6c3c451af482ca41a364d2aeb5f6b1bc4a6cedd8a6f8d7586f1
-
SSDEEP
12288:Nwd3Bisv9NE1llpPykGRr9VXbtp/SH6UGk02AmuqpFIFYN9xc:uLv9NU/lyFRVXbniw2AI/0
Score
10/10
Malware Config
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Renames multiple (302) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Modifies Windows Firewall 1 TTPs 2 IoCs
-
Drops startup file 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 41 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 49 IoCs
-
Suspicious use of WriteProcessMemory 51 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f595f91a9966808cc85d11981e66e98043af9aeaaaa3893ef058b9a79c474f17_JC.exe"C:\Users\Admin\AppData\Local\Temp\f595f91a9966808cc85d11981e66e98043af9aeaaaa3893ef058b9a79c474f17_JC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f595f91a9966808cc85d11981e66e98043af9aeaaaa3893ef058b9a79c474f17_JC.exeC:\Users\Admin\AppData\Local\Temp\f595f91a9966808cc85d11981e66e98043af9aeaaaa3893ef058b9a79c474f17_JC.exe2⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f595f91a9966808cc85d11981e66e98043af9aeaaaa3893ef058b9a79c474f17_JC.exe"C:\Users\Admin\AppData\Local\Temp\f595f91a9966808cc85d11981e66e98043af9aeaaaa3893ef058b9a79c474f17_JC.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f595f91a9966808cc85d11981e66e98043af9aeaaaa3893ef058b9a79c474f17_JC.exeC:\Users\Admin\AppData\Local\Temp\f595f91a9966808cc85d11981e66e98043af9aeaaaa3893ef058b9a79c474f17_JC.exe4⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off4⤵
- Modifies Windows Firewall
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable4⤵
- Modifies Windows Firewall
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id[A46E4E60-3483].[[email protected]].8baseFilesize
143.1MB
MD5a3eda09ecd4ea9380f3478acb9cd0a4c
SHA130c39121fc1e6baf44a8f28f76e98a418e0e5133
SHA2565bd843caf9e33b1fc0731aa52857a168c31702a51ebcd5276f7e9e3b2e4ed51e
SHA51285ce8cc40a77e8d7a609b7d62ebdbe131388dc19fec44a8a7246407594661866030a013a29831a2424b8e770775fc897f50fb675bd970a0ba5e93316d26e2b0c
-
memory/1980-19-0x0000000074840000-0x0000000074F2E000-memory.dmpFilesize
6.9MB
-
memory/1980-1-0x0000000001100000-0x00000000011A4000-memory.dmpFilesize
656KB
-
memory/1980-2-0x0000000001000000-0x0000000001040000-memory.dmpFilesize
256KB
-
memory/1980-3-0x00000000006C0000-0x0000000000718000-memory.dmpFilesize
352KB
-
memory/1980-4-0x0000000000730000-0x0000000000776000-memory.dmpFilesize
280KB
-
memory/1980-5-0x0000000001040000-0x0000000001074000-memory.dmpFilesize
208KB
-
memory/1980-6-0x0000000001080000-0x00000000010CC000-memory.dmpFilesize
304KB
-
memory/1980-85-0x0000000001000000-0x0000000001040000-memory.dmpFilesize
256KB
-
memory/1980-0-0x0000000074840000-0x0000000074F2E000-memory.dmpFilesize
6.9MB
-
memory/2340-56-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2340-67-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2340-12-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2340-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2340-15-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2340-17-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2340-10-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2340-18-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2340-7-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2340-91-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2340-8-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2340-76-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2340-73-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2340-61-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2340-11-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2340-52-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2340-54-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2340-9-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2340-58-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2340-59-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2340-60-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2340-63-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2616-42-0x00000000747F0000-0x0000000074EDE000-memory.dmpFilesize
6.9MB
-
memory/2616-23-0x0000000000210000-0x0000000000256000-memory.dmpFilesize
280KB
-
memory/2616-22-0x0000000004990000-0x00000000049D0000-memory.dmpFilesize
256KB
-
memory/2616-20-0x0000000001100000-0x00000000011A4000-memory.dmpFilesize
656KB
-
memory/2616-21-0x00000000747F0000-0x0000000074EDE000-memory.dmpFilesize
6.9MB
-
memory/2680-41-0x0000000000401000-0x000000000040A000-memory.dmpFilesize
36KB
-
memory/2680-36-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB