phobos | 1c1eed8f9b2c44bb7290690521cc5f4e02929d5eeb3cc8fc2bf042cf3b789b8e | Triage

Sharing

General

Target

MsMpEng.exe
Size

58KB
Sample

231012-rg619sff27
MD5

d3de0bbab0f4ed0e4e964f71355b4546
SHA1

58ab950e6581ec8a9db754218704a726ef28c958
SHA256

1c1eed8f9b2c44bb7290690521cc5f4e02929d5eeb3cc8fc2bf042cf3b789b8e
SHA512

9139fc316213ca21a0a353f50095fc9bd55504c5e71b0648f4584468ad63333902f6163842d1baad682b1ca12b049ebf5f2ddd42d74d2031a0f6162592fadc91
SSDEEP

1536:jNeRBl5PT/rx1mzwRMSTdLpJUY/M97L0Ziaai:jQRrmzwR5JL/Vi+

Score

10^/10

phobos evasion persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  MsMpEng.exe
- Size
  
  58KB
- MD5
  
  d3de0bbab0f4ed0e4e964f71355b4546
- SHA1
  
  58ab950e6581ec8a9db754218704a726ef28c958
- SHA256
  
  1c1eed8f9b2c44bb7290690521cc5f4e02929d5eeb3cc8fc2bf042cf3b789b8e
- SHA512
  
  9139fc316213ca21a0a353f50095fc9bd55504c5e71b0648f4584468ad63333902f6163842d1baad682b1ca12b049ebf5f2ddd42d74d2031a0f6162592fadc91
- SSDEEP
  
  1536:jNeRBl5PT/rx1mzwRMSTdLpJUY/M97L0Ziaai:jQRrmzwR5JL/Vi+
Score

10^/10

phobos evasion persistence ransomware spyware stealer
- Phobos
  Phobos ransomware appeared at the beginning of 2019.
  ransomware phobos
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (119) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies Windows Firewall
  evasion
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Indicator Removal

File Deletion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

phobosevasionpersistenceransomwarespywarestealer