Analysis
-
max time kernel
154s -
max time network
126s -
platform
windows10-1703_x64 -
resource
win10-20230831-en -
resource tags
-
submitted
12-10-2023 07:28
General
-
Target
7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8.exe
-
Size
549KB
-
MD5
40a2a330dece024db63f275748eb3d7a
-
SHA1
97508bbbff47aa06a381ff80428b8578d4daafb5
-
SHA256
7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8
-
SHA512
dcec48482463a960d47ea93b655dfec3ca88561fab3648b5ab8a8e7253a59d282c7cd4392daec9d3c95ebe9fb5265961705433c2374f6ffe2348123e586ed0a4
-
SSDEEP
12288:yVthvdMSOXfbbOPFErVy0MRRp1o6tD5B:k3FMFXfXOPmRy0Wp1Ft
Malware Config
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Renames multiple (90) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Modifies Windows Firewall 1 TTPs 2 IoCs
-
Drops startup file 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 4 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 51 IoCs
-
Suspicious use of WriteProcessMemory 47 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8.exe"C:\Users\Admin\AppData\Local\Temp\7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8.exeC:\Users\Admin\AppData\Local\Temp\7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8.exe2⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8.exe"C:\Users\Admin\AppData\Local\Temp\7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8.exeC:\Users\Admin\AppData\Local\Temp\7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8.exeC:\Users\Admin\AppData\Local\Temp\7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8.exeC:\Users\Admin\AppData\Local\Temp\7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8.exeC:\Users\Admin\AppData\Local\Temp\7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8.exe4⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off4⤵
- Modifies Windows Firewall
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable4⤵
- Modifies Windows Firewall
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id[28251170-3483].[[email protected]].8baseFilesize
2.7MB
MD527d1e75891f3bb16ec40fc98361d3532
SHA134daf0f1e675acb053e9c351ea53b58f1505a1a1
SHA256039f6741881023fc6f4d271067ceb1ba59fb006bb09e082deb7c73f748e0f7e7
SHA512a5cc9192cef87454d6e93eb8e344d812860f034c4339053f7ecf5492122483a26960622648023170458f20f81dc881d47c6d5ed752d09a94796c66c39e4502d9
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8.exe.logFilesize
927B
MD5ffe7bf10728fcdc9cfc28d6c2320a6f8
SHA1af407275e9830d40889da2e672d2e6af118c8cb8
SHA25672653cc5191f40cf26bcabcb5e0e41e53f23463f725007f74da78e36f9ec1522
SHA512766753516d36ef1065d29dd982e0b6ee4e84c0c17eb2b0a6ca056f6c8e2a908e53c169bbcb01ab8b9ba1be1463fdd4007398d964aed59de761c1a6213842776c
-
memory/2268-20-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3016-19-0x0000000073820000-0x0000000073F0E000-memory.dmpFilesize
6.9MB
-
memory/3016-15-0x00000000056A0000-0x00000000056B0000-memory.dmpFilesize
64KB
-
memory/3016-14-0x0000000073820000-0x0000000073F0E000-memory.dmpFilesize
6.9MB
-
memory/3440-34-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3440-32-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3440-10-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3440-11-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3440-1904-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3440-1901-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3440-595-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3440-578-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3440-7-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3440-272-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3440-30-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3440-222-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3440-263-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3440-37-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3440-36-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3440-52-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3440-49-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3440-39-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3440-58-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3440-55-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3440-66-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3440-156-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3440-245-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/3440-196-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/4420-3-0x0000000005560000-0x0000000005570000-memory.dmpFilesize
64KB
-
memory/4420-1-0x0000000073780000-0x0000000073E6E000-memory.dmpFilesize
6.9MB
-
memory/4420-0-0x0000000000CC0000-0x0000000000D50000-memory.dmpFilesize
576KB
-
memory/4420-2-0x0000000005510000-0x0000000005556000-memory.dmpFilesize
280KB
-
memory/4420-4-0x0000000005590000-0x00000000055C4000-memory.dmpFilesize
208KB
-
memory/4420-5-0x00000000055D0000-0x000000000561C000-memory.dmpFilesize
304KB
-
memory/4420-6-0x0000000005B80000-0x000000000607E000-memory.dmpFilesize
5.0MB
-
memory/4420-12-0x0000000073780000-0x0000000073E6E000-memory.dmpFilesize
6.9MB