phobos | 97a4d094f86b757b3fb0e189f2843a7af8d0ec43f9805214e89992528e83b5d7 | Triage

Sharing

General

Target

0a2f0447233fa3f8c754fc8142ab6f7a.exe
Size

270KB
Sample

231011-lfbwvafg36
MD5

0a2f0447233fa3f8c754fc8142ab6f7a
SHA1

57ad4363343ac0ac26e953bf5473e50327ce3994
SHA256

97a4d094f86b757b3fb0e189f2843a7af8d0ec43f9805214e89992528e83b5d7
SHA512

764a1f3b939efa5f1e1e1794064bc3f8de14787c27802f75e352f7c62b4ef8822716c81a6ef32c9eb4100f8e4ae0eb7df9283a3beee3e190d548a472bb8c1117
SSDEEP

6144:Vnc5VNMxG6QK8HwEFd2PTwwfyb2lMIw6Ou6AiC:VgN2G6v8HwQd2PleKVONBC

Score

10^/10

phobos evasion persistence ransomware

Malware Config

Targets

- Target
  
  0a2f0447233fa3f8c754fc8142ab6f7a.exe
- Size
  
  270KB
- MD5
  
  0a2f0447233fa3f8c754fc8142ab6f7a
- SHA1
  
  57ad4363343ac0ac26e953bf5473e50327ce3994
- SHA256
  
  97a4d094f86b757b3fb0e189f2843a7af8d0ec43f9805214e89992528e83b5d7
- SHA512
  
  764a1f3b939efa5f1e1e1794064bc3f8de14787c27802f75e352f7c62b4ef8822716c81a6ef32c9eb4100f8e4ae0eb7df9283a3beee3e190d548a472bb8c1117
- SSDEEP
  
  6144:Vnc5VNMxG6QK8HwEFd2PTwwfyb2lMIw6Ou6AiC:VgN2G6v8HwQd2PleKVONBC
Score

10^/10

phobos evasion persistence ransomware
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies Windows Firewall
  evasion
- Drops startup file
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

behavioral2

phobosevasionpersistenceransomware