Analysis

  • max time kernel
    151s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-10-2023 21:37

General

  • Target

    f595f91a9966808cc85d11981e66e98043af9aeaaaa3893ef058b9a79c474f17_JC.exe

  • Size

    629KB

  • MD5

    9b6470fcbb02fa19344e2f3b142f5038

  • SHA1

    3307c3ae97ed6be889720949083f93017d1a6675

  • SHA256

    f595f91a9966808cc85d11981e66e98043af9aeaaaa3893ef058b9a79c474f17

  • SHA512

    f44a6dc0d52bb0cdc5f34a67c608d0ebbcb6e370b2c078095b3a51670a4b07713762c9998949a6c3c451af482ca41a364d2aeb5f6b1bc4a6cedd8a6f8d7586f1

  • SSDEEP

    12288:Nwd3Bisv9NE1llpPykGRr9VXbtp/SH6UGk02AmuqpFIFYN9xc:uLv9NU/lyFRVXbniw2AI/0

Malware Config

Signatures

  • Phobos

    Phobos ransomware appeared at the beginning of 2019.

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
  • Renames multiple (454) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

  • Modifies Windows Firewall 1 TTPs 2 IoCs
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops desktop.ini file(s) 16 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\f595f91a9966808cc85d11981e66e98043af9aeaaaa3893ef058b9a79c474f17_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\f595f91a9966808cc85d11981e66e98043af9aeaaaa3893ef058b9a79c474f17_JC.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1680
    • C:\Users\Admin\AppData\Local\Temp\f595f91a9966808cc85d11981e66e98043af9aeaaaa3893ef058b9a79c474f17_JC.exe
      C:\Users\Admin\AppData\Local\Temp\f595f91a9966808cc85d11981e66e98043af9aeaaaa3893ef058b9a79c474f17_JC.exe
      2⤵
        PID:1376
      • C:\Users\Admin\AppData\Local\Temp\f595f91a9966808cc85d11981e66e98043af9aeaaaa3893ef058b9a79c474f17_JC.exe
        C:\Users\Admin\AppData\Local\Temp\f595f91a9966808cc85d11981e66e98043af9aeaaaa3893ef058b9a79c474f17_JC.exe
        2⤵
        • Drops startup file
        • Adds Run key to start application
        • Drops desktop.ini file(s)
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1336
        • C:\Users\Admin\AppData\Local\Temp\f595f91a9966808cc85d11981e66e98043af9aeaaaa3893ef058b9a79c474f17_JC.exe
          "C:\Users\Admin\AppData\Local\Temp\f595f91a9966808cc85d11981e66e98043af9aeaaaa3893ef058b9a79c474f17_JC.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1788
          • C:\Users\Admin\AppData\Local\Temp\f595f91a9966808cc85d11981e66e98043af9aeaaaa3893ef058b9a79c474f17_JC.exe
            C:\Users\Admin\AppData\Local\Temp\f595f91a9966808cc85d11981e66e98043af9aeaaaa3893ef058b9a79c474f17_JC.exe
            4⤵
              PID:4468
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1568
            • C:\Windows\system32\vssadmin.exe
              vssadmin delete shadows /all /quiet
              4⤵
              • Interacts with shadow copies
              PID:264
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic shadowcopy delete
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1636
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set {default} bootstatuspolicy ignoreallfailures
              4⤵
              • Modifies boot configuration data using bcdedit
              PID:492
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set {default} recoveryenabled no
              4⤵
              • Modifies boot configuration data using bcdedit
              PID:1608
            • C:\Windows\system32\wbadmin.exe
              wbadmin delete catalog -quiet
              4⤵
              • Deletes backup catalog
              PID:5108
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3376
            • C:\Windows\system32\netsh.exe
              netsh advfirewall set currentprofile state off
              4⤵
              • Modifies Windows Firewall
              PID:3548
            • C:\Windows\system32\netsh.exe
              netsh firewall set opmode mode=disable
              4⤵
              • Modifies Windows Firewall
              PID:2816
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:232
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1380
      • C:\Windows\System32\vdsldr.exe
        C:\Windows\System32\vdsldr.exe -Embedding
        1⤵
          PID:4484
        • C:\Windows\System32\vds.exe
          C:\Windows\System32\vds.exe
          1⤵
          • Checks SCSI registry key(s)
          PID:984

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[BEF44EB0-3483].[[email protected]].8base

          Filesize

          3.2MB

          MD5

          6c0bd02524c46d0b4cf9d1251b57f4df

          SHA1

          21211ac29ddc0d3f4f4ca948aefc796509ac5528

          SHA256

          6e21f19a27674395ed2b66978355f6e6c564674388a09e8d687cb728dcaff4f3

          SHA512

          6513b2ea3ca02042fdf37bcea6099e651959b0e85b9e5c615c72c1789ac3d43905cb2bf6ba04b6b42f9006159c7dacd5e527ae3857b23d51291d0049f8bfd7c3

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\f595f91a9966808cc85d11981e66e98043af9aeaaaa3893ef058b9a79c474f17_JC.exe.log

          Filesize

          927B

          MD5

          ff27e87d4bf1330435001e57e8244d60

          SHA1

          b22264ed3cd4d35f8236278edd2512c3b7ecb355

          SHA256

          7e9adf70ba438f8a38feac34e1b25bb4261fa506d00361ea7e5cde784651474e

          SHA512

          d678aa2b42032ea0d811f9783abff7c94a6d674bd3dee74df706b7f95da7e51d84207320ea36226da4f8651e6ec618ea12d99d2d6d371bd1e98395518b8956e0

        • memory/1336-230-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/1336-261-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/1336-179-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/1336-1873-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/1336-1883-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/1336-685-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/1336-8-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/1336-115-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/1336-12-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/1336-547-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/1336-290-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/1336-269-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/1336-42-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/1336-233-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/1336-255-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/1336-31-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/1336-33-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/1336-35-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/1336-38-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/1336-64-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/1336-239-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/1336-11-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/1336-194-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/1336-104-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/1336-50-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/1336-37-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/1336-198-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/1336-237-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/1680-0-0x0000000074670000-0x0000000074E20000-memory.dmp

          Filesize

          7.7MB

        • memory/1680-13-0x0000000074670000-0x0000000074E20000-memory.dmp

          Filesize

          7.7MB

        • memory/1680-4-0x00000000050C0000-0x0000000005118000-memory.dmp

          Filesize

          352KB

        • memory/1680-3-0x0000000005160000-0x0000000005170000-memory.dmp

          Filesize

          64KB

        • memory/1680-1-0x00000000006C0000-0x0000000000764000-memory.dmp

          Filesize

          656KB

        • memory/1680-5-0x00000000051E0000-0x0000000005226000-memory.dmp

          Filesize

          280KB

        • memory/1680-6-0x0000000005220000-0x0000000005254000-memory.dmp

          Filesize

          208KB

        • memory/1680-7-0x0000000005380000-0x00000000053CC000-memory.dmp

          Filesize

          304KB

        • memory/1680-2-0x0000000005830000-0x0000000005DD4000-memory.dmp

          Filesize

          5.6MB

        • memory/1788-16-0x00000000050D0000-0x00000000050E0000-memory.dmp

          Filesize

          64KB

        • memory/1788-15-0x0000000074710000-0x0000000074EC0000-memory.dmp

          Filesize

          7.7MB

        • memory/1788-21-0x0000000074710000-0x0000000074EC0000-memory.dmp

          Filesize

          7.7MB

        • memory/4468-291-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/4468-20-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB