Analysis

  • max time kernel
    153s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    03-10-2023 17:58

General

  • Target

    9bb98f2989a73a1e3d8d490669462422.exe

  • Size

    570KB

  • MD5

    9bb98f2989a73a1e3d8d490669462422

  • SHA1

    480b65fe568acd420dacd4b935529f2505e94151

  • SHA256

    790b64a5860a5069fedcb660efdffce2b5ab2195086100a6079697b662f0c198

  • SHA512

    f84fe96c065c214d3ae623d81da9e0aacc0fdfb3751baa02505b4348d89e6c4a6d29703e579aef5f48ddbb1956c154e228b2337657b135b0a973cc9907e1651e

  • SSDEEP

    12288:MTQp8eHRevUGXTYJ0M8SbYrAwhLtaczsQc0TwmqyAAJtT:cc82RGFj80pwY5aczXTNqyz

Malware Config

Extracted

Path

C:\info.hta

Ransom Note
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'> <html> <head> <meta charset='windows-1251'> <title>cartilage</title> <HTA:APPLICATION ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu="no"> <script language='JScript'> window.moveTo(50, 50); window.resizeTo(screen.width - 100, screen.height - 100); </script> <style type='text/css'> body { font: 15px Tahoma, sans-serif; margin: 10px; line-height: 25px; background: #C6B5C4; } img { display:inline-block; } .bold { font-weight: bold; } .mark { background: #B5CC8E; padding: 2px 5px; } .header { text-align: center; font-size: 30px; line-height: 50px; font-weight: bold; margin-bottom:20px; } .info { background: #e6ecf2; border-left: 10px solid #B58CB2; } .alert { background: #FFE4E4; border-left: 10px solid #FFA07A; } .private { border: 1px dashed #000; background: #FFFFEF; } .note { height: auto; padding-bottom: 1px; margin: 15px 0; } .note .title { font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; } .note .mark { background: #A2A2B5; } .note ul { margin-top: 0; } .note pre { margin-left: 15px; line-height: 13px; font-size: 13px; } .footer { position:fixed; bottom:0; right:0; text-align: right; } </style> </head> <body> <div class='header'> <img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII='> <div>All your files have been encrypted!</div> </div> <div class='bold'>All your files have been encrypted due to a security problem with your PC.</div> <div class='bold'>If you want to restore them, write us to the e-mail <span class='mark'>[email protected]</span></div> <div class='bold'>Or write us to the Tox: <span class='mark'>78E21CFF7AA85F713C1530AEF2E74E62830BEE77238F4B0A73E5E3251EAD56427BF9F7A1A074</span></div> <div class='bold'>Write this ID in the title of your message <span class='mark'>775014DB-3483</span></div> <div> You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files. </div> <div class='note info'> <div class='title'>Free decryption as guarantee</div> <ul>Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) </ul> </div> <div class='note info'> <div class='title'>How to obtain Bitcoins</div> <ul> The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. <br><a href='https://localbitcoins.com/buy_bitcoins'>https://localbitcoins.com/buy_bitcoins</a> <br> Also you can find other places to buy Bitcoins and beginners guide here: <br><a href='http://www.coindesk.com/information/how-can-i-buy-bitcoins/'>http://www.coindesk.com/information/how-can-i-buy-bitcoins/</a> </ul> </div> <div class='note alert'> <div class='title'>Attention!</div> <ul> <li>Do not rename encrypted files.</li> <li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li> <li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li> </ul> </div> </body> </html>
Emails

class='mark'>[email protected]</span></div>

URLs

http://www.w3.org/TR/html4/strict.dtd'>

Extracted

Path

F:\info.hta

Ransom Note
All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Or write us to the Tox: 78E21CFF7AA85F713C1530AEF2E74E62830BEE77238F4B0A73E5E3251EAD56427BF9F7A1A074 Write this ID in the title of your message 775014DB-3483 You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Phobos

    Phobos ransomware appeared at the beginning of 2019.

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
  • Renames multiple (311) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Deletes backup catalog 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

  • Modifies Windows Firewall 1 TTPs 2 IoCs
  • Drops startup file 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops desktop.ini file(s) 64 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\9bb98f2989a73a1e3d8d490669462422.exe
    "C:\Users\Admin\AppData\Local\Temp\9bb98f2989a73a1e3d8d490669462422.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2620
    • C:\Users\Admin\AppData\Local\Temp\9bb98f2989a73a1e3d8d490669462422.exe
      C:\Users\Admin\AppData\Local\Temp\9bb98f2989a73a1e3d8d490669462422.exe
      2⤵
        PID:2684
      • C:\Users\Admin\AppData\Local\Temp\9bb98f2989a73a1e3d8d490669462422.exe
        C:\Users\Admin\AppData\Local\Temp\9bb98f2989a73a1e3d8d490669462422.exe
        2⤵
          PID:2788
        • C:\Users\Admin\AppData\Local\Temp\9bb98f2989a73a1e3d8d490669462422.exe
          C:\Users\Admin\AppData\Local\Temp\9bb98f2989a73a1e3d8d490669462422.exe
          2⤵
          • Drops startup file
          • Adds Run key to start application
          • Drops desktop.ini file(s)
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2792
          • C:\Users\Admin\AppData\Local\Temp\9bb98f2989a73a1e3d8d490669462422.exe
            "C:\Users\Admin\AppData\Local\Temp\9bb98f2989a73a1e3d8d490669462422.exe"
            3⤵
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2864
            • C:\Users\Admin\AppData\Local\Temp\9bb98f2989a73a1e3d8d490669462422.exe
              C:\Users\Admin\AppData\Local\Temp\9bb98f2989a73a1e3d8d490669462422.exe
              4⤵
                PID:2556
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1732
              • C:\Windows\system32\vssadmin.exe
                vssadmin delete shadows /all /quiet
                4⤵
                • Interacts with shadow copies
                PID:3060
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic shadowcopy delete
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:596
              • C:\Windows\system32\bcdedit.exe
                bcdedit /set {default} bootstatuspolicy ignoreallfailures
                4⤵
                • Modifies boot configuration data using bcdedit
                PID:2896
              • C:\Windows\system32\bcdedit.exe
                bcdedit /set {default} recoveryenabled no
                4⤵
                • Modifies boot configuration data using bcdedit
                PID:892
              • C:\Windows\system32\wbadmin.exe
                wbadmin delete catalog -quiet
                4⤵
                • Deletes backup catalog
                PID:572
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2496
              • C:\Windows\system32\netsh.exe
                netsh advfirewall set currentprofile state off
                4⤵
                • Modifies Windows Firewall
                PID:1232
              • C:\Windows\system32\netsh.exe
                netsh firewall set opmode mode=disable
                4⤵
                • Modifies Windows Firewall
                PID:488
            • C:\Windows\SysWOW64\mshta.exe
              "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"
              3⤵
              • Modifies Internet Explorer settings
              PID:2968
            • C:\Windows\SysWOW64\mshta.exe
              "C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"
              3⤵
              • Modifies Internet Explorer settings
              PID:1100
            • C:\Windows\SysWOW64\mshta.exe
              "C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"
              3⤵
              • Modifies Internet Explorer settings
              PID:2444
            • C:\Windows\SysWOW64\mshta.exe
              "C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"
              3⤵
              • Modifies Internet Explorer settings
              PID:2612
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe"
              3⤵
                PID:968
                • C:\Windows\system32\vssadmin.exe
                  vssadmin delete shadows /all /quiet
                  4⤵
                  • Interacts with shadow copies
                  PID:2616
                • C:\Windows\System32\Wbem\WMIC.exe
                  wmic shadowcopy delete
                  4⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2700
                • C:\Windows\system32\bcdedit.exe
                  bcdedit /set {default} bootstatuspolicy ignoreallfailures
                  4⤵
                  • Modifies boot configuration data using bcdedit
                  PID:208
                • C:\Windows\system32\bcdedit.exe
                  bcdedit /set {default} recoveryenabled no
                  4⤵
                  • Modifies boot configuration data using bcdedit
                  PID:2748
                • C:\Windows\system32\wbadmin.exe
                  wbadmin delete catalog -quiet
                  4⤵
                  • Deletes backup catalog
                  PID:1412
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2124
          • C:\Windows\system32\wbengine.exe
            "C:\Windows\system32\wbengine.exe"
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2032
          • C:\Windows\System32\vdsldr.exe
            C:\Windows\System32\vdsldr.exe -Embedding
            1⤵
              PID:240
            • C:\Windows\System32\vds.exe
              C:\Windows\System32\vds.exe
              1⤵
                PID:1284

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id[775014DB-3483].[[email protected]].8base

                Filesize

                143.1MB

                MD5

                a0b90f715fbd0b912b213d8a06c5d49f

                SHA1

                c187e027f62426431a1f2e68d9c86cebe63545e3

                SHA256

                68737e474ab0e914d9d461d97d03398c8cb209ac52e077b70e31157dc2ce84f6

                SHA512

                84d3452484c3dd9b1ddf17ead981a2ffbdc4c416a273f5ab19ea74c947b6fc3e38b8dacdb77536023eb232340e9feab05b0d58cf50bec361e859353cbbb54e04

              • C:\Users\Admin\Desktop\info.hta

                Filesize

                5KB

                MD5

                2cf99fc93127bcbf1f482f3e1cda1cd9

                SHA1

                9d7ccb1fc8c71bc40bf44e53cc4e217542966079

                SHA256

                ad75b57b7d1620fb55d462b1e8a8e2767d7b37e9aea93f0613907a255c3aae26

                SHA512

                25930658cc4e53e86deaef3620ebc2cc58cc354db1ecd86a94932f27329abdfedab11aa7a10264a4de5a599419b695526d179b84611603e18eef842d95a44e39

              • C:\info.hta

                Filesize

                5KB

                MD5

                2cf99fc93127bcbf1f482f3e1cda1cd9

                SHA1

                9d7ccb1fc8c71bc40bf44e53cc4e217542966079

                SHA256

                ad75b57b7d1620fb55d462b1e8a8e2767d7b37e9aea93f0613907a255c3aae26

                SHA512

                25930658cc4e53e86deaef3620ebc2cc58cc354db1ecd86a94932f27329abdfedab11aa7a10264a4de5a599419b695526d179b84611603e18eef842d95a44e39

              • C:\info.hta

                Filesize

                5KB

                MD5

                2cf99fc93127bcbf1f482f3e1cda1cd9

                SHA1

                9d7ccb1fc8c71bc40bf44e53cc4e217542966079

                SHA256

                ad75b57b7d1620fb55d462b1e8a8e2767d7b37e9aea93f0613907a255c3aae26

                SHA512

                25930658cc4e53e86deaef3620ebc2cc58cc354db1ecd86a94932f27329abdfedab11aa7a10264a4de5a599419b695526d179b84611603e18eef842d95a44e39

              • C:\users\public\desktop\info.hta

                Filesize

                5KB

                MD5

                2cf99fc93127bcbf1f482f3e1cda1cd9

                SHA1

                9d7ccb1fc8c71bc40bf44e53cc4e217542966079

                SHA256

                ad75b57b7d1620fb55d462b1e8a8e2767d7b37e9aea93f0613907a255c3aae26

                SHA512

                25930658cc4e53e86deaef3620ebc2cc58cc354db1ecd86a94932f27329abdfedab11aa7a10264a4de5a599419b695526d179b84611603e18eef842d95a44e39

              • F:\info.hta

                Filesize

                5KB

                MD5

                2cf99fc93127bcbf1f482f3e1cda1cd9

                SHA1

                9d7ccb1fc8c71bc40bf44e53cc4e217542966079

                SHA256

                ad75b57b7d1620fb55d462b1e8a8e2767d7b37e9aea93f0613907a255c3aae26

                SHA512

                25930658cc4e53e86deaef3620ebc2cc58cc354db1ecd86a94932f27329abdfedab11aa7a10264a4de5a599419b695526d179b84611603e18eef842d95a44e39

              • memory/2556-36-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                Filesize

                4KB

              • memory/2556-48-0x0000000000400000-0x0000000000413000-memory.dmp

                Filesize

                76KB

              • memory/2620-5-0x0000000001F00000-0x0000000001F34000-memory.dmp

                Filesize

                208KB

              • memory/2620-6-0x0000000001FF0000-0x000000000203C000-memory.dmp

                Filesize

                304KB

              • memory/2620-4-0x0000000000530000-0x0000000000576000-memory.dmp

                Filesize

                280KB

              • memory/2620-3-0x00000000004E0000-0x000000000052A000-memory.dmp

                Filesize

                296KB

              • memory/2620-2-0x0000000004B40000-0x0000000004B80000-memory.dmp

                Filesize

                256KB

              • memory/2620-1-0x0000000074190000-0x000000007487E000-memory.dmp

                Filesize

                6.9MB

              • memory/2620-0-0x00000000002E0000-0x0000000000374000-memory.dmp

                Filesize

                592KB

              • memory/2620-17-0x0000000074190000-0x000000007487E000-memory.dmp

                Filesize

                6.9MB

              • memory/2792-64-0x0000000000400000-0x0000000000413000-memory.dmp

                Filesize

                76KB

              • memory/2792-94-0x0000000000400000-0x0000000000413000-memory.dmp

                Filesize

                76KB

              • memory/2792-7-0x0000000000400000-0x0000000000413000-memory.dmp

                Filesize

                76KB

              • memory/2792-8-0x0000000000400000-0x0000000000413000-memory.dmp

                Filesize

                76KB

              • memory/2792-9-0x0000000000400000-0x0000000000413000-memory.dmp

                Filesize

                76KB

              • memory/2792-10-0x0000000000400000-0x0000000000413000-memory.dmp

                Filesize

                76KB

              • memory/2792-18-0x0000000000400000-0x0000000000413000-memory.dmp

                Filesize

                76KB

              • memory/2792-11-0x0000000000400000-0x0000000000413000-memory.dmp

                Filesize

                76KB

              • memory/2792-15-0x0000000000400000-0x0000000000413000-memory.dmp

                Filesize

                76KB

              • memory/2792-52-0x0000000000400000-0x0000000000413000-memory.dmp

                Filesize

                76KB

              • memory/2792-56-0x0000000000400000-0x0000000000413000-memory.dmp

                Filesize

                76KB

              • memory/2792-58-0x0000000000400000-0x0000000000413000-memory.dmp

                Filesize

                76KB

              • memory/2792-60-0x0000000000400000-0x0000000000413000-memory.dmp

                Filesize

                76KB

              • memory/2792-63-0x0000000000400000-0x0000000000413000-memory.dmp

                Filesize

                76KB

              • memory/2792-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                Filesize

                4KB

              • memory/2792-70-0x0000000000400000-0x0000000000413000-memory.dmp

                Filesize

                76KB

              • memory/2792-12-0x0000000000400000-0x0000000000413000-memory.dmp

                Filesize

                76KB

              • memory/2792-84-0x0000000000400000-0x0000000000413000-memory.dmp

                Filesize

                76KB

              • memory/2792-86-0x0000000000400000-0x0000000000413000-memory.dmp

                Filesize

                76KB

              • memory/2792-19-0x0000000000400000-0x0000000000413000-memory.dmp

                Filesize

                76KB

              • memory/2792-105-0x0000000000400000-0x0000000000413000-memory.dmp

                Filesize

                76KB

              • memory/2864-40-0x00000000740E0000-0x00000000747CE000-memory.dmp

                Filesize

                6.9MB

              • memory/2864-22-0x00000000047F0000-0x0000000004830000-memory.dmp

                Filesize

                256KB

              • memory/2864-23-0x0000000000590000-0x00000000005D6000-memory.dmp

                Filesize

                280KB

              • memory/2864-20-0x00000000002E0000-0x0000000000374000-memory.dmp

                Filesize

                592KB

              • memory/2864-21-0x00000000740E0000-0x00000000747CE000-memory.dmp

                Filesize

                6.9MB