Overview

overview

10

Static

static

3

aedbddbf74...63.exe

windows7-x64

10

aedbddbf74...63.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-10-2023 22:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    aedbddbf7494baaaf759a720d9cd17540d3c171b9cc52a02e0ef9a592bd9cd63.exe

  • Size

    630KB

  • MD5

    af682568d545d56f405e1e476421467c

  • SHA1

    be54c56243fd37e288825bd1c01880fcc487d322

  • SHA256

    aedbddbf7494baaaf759a720d9cd17540d3c171b9cc52a02e0ef9a592bd9cd63

  • SHA512

    e9f4a7d6491f60b2ad2e3844813451838c4d548af2400713007cb8d0a768fde2edaea7b18404afcfc6c3d6fcfea27fe7ed521a7a5cefedc4a64b55ac5fda9cb3

  • SSDEEP

    12288:LxAF9CSqpcfzoiBYrJyc/eJDVAb76UP66iK:6F9C6zXOrJEJDA75d

Score
10/10
phobosevasionpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Phobos

    Phobos ransomware appeared at the beginning of 2019.

    ransomwarephobos
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (206) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Modifies Windows Firewall 1 TTPs 2 IoCs
    evasion
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\aedbddbf7494baaaf759a720d9cd17540d3c171b9cc52a02e0ef9a592bd9cd63.exe
    "C:\Users\Admin\AppData\Local\Temp\aedbddbf7494baaaf759a720d9cd17540d3c171b9cc52a02e0ef9a592bd9cd63.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2508
    • C:\Users\Admin\AppData\Local\Temp\aedbddbf7494baaaf759a720d9cd17540d3c171b9cc52a02e0ef9a592bd9cd63.exe
      C:\Users\Admin\AppData\Local\Temp\aedbddbf7494baaaf759a720d9cd17540d3c171b9cc52a02e0ef9a592bd9cd63.exe
      2⤵
      • Drops startup file
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4168
      • C:\Users\Admin\AppData\Local\Temp\aedbddbf7494baaaf759a720d9cd17540d3c171b9cc52a02e0ef9a592bd9cd63.exe
        "C:\Users\Admin\AppData\Local\Temp\aedbddbf7494baaaf759a720d9cd17540d3c171b9cc52a02e0ef9a592bd9cd63.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4052
        • C:\Users\Admin\AppData\Local\Temp\aedbddbf7494baaaf759a720d9cd17540d3c171b9cc52a02e0ef9a592bd9cd63.exe
          C:\Users\Admin\AppData\Local\Temp\aedbddbf7494baaaf759a720d9cd17540d3c171b9cc52a02e0ef9a592bd9cd63.exe
          4⤵
            PID:248
          • C:\Users\Admin\AppData\Local\Temp\aedbddbf7494baaaf759a720d9cd17540d3c171b9cc52a02e0ef9a592bd9cd63.exe
            C:\Users\Admin\AppData\Local\Temp\aedbddbf7494baaaf759a720d9cd17540d3c171b9cc52a02e0ef9a592bd9cd63.exe
            4⤵
              PID:648
            • C:\Users\Admin\AppData\Local\Temp\aedbddbf7494baaaf759a720d9cd17540d3c171b9cc52a02e0ef9a592bd9cd63.exe
              C:\Users\Admin\AppData\Local\Temp\aedbddbf7494baaaf759a720d9cd17540d3c171b9cc52a02e0ef9a592bd9cd63.exe
              4⤵
                PID:1624
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1028
              • C:\Windows\system32\netsh.exe
                netsh advfirewall set currentprofile state off
                4⤵
                • Modifies Windows Firewall
                PID:2344
              • C:\Windows\system32\netsh.exe
                netsh firewall set opmode mode=disable
                4⤵
                • Modifies Windows Firewall
                PID:3008
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1864
              • C:\Windows\system32\vssadmin.exe
                vssadmin delete shadows /all /quiet
                4⤵
                • Interacts with shadow copies
                PID:4140
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic shadowcopy delete
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:4644
              • C:\Windows\system32\bcdedit.exe
                bcdedit /set {default} bootstatuspolicy ignoreallfailures
                4⤵
                • Modifies boot configuration data using bcdedit
                PID:3252
              • C:\Windows\system32\bcdedit.exe
                bcdedit /set {default} recoveryenabled no
                4⤵
                • Modifies boot configuration data using bcdedit
                PID:4768
              • C:\Windows\system32\wbadmin.exe
                wbadmin delete catalog -quiet
                4⤵
                • Deletes backup catalog
                PID:3256
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3680
        • C:\Windows\system32\wbengine.exe
          "C:\Windows\system32\wbengine.exe"
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4460
        • C:\Windows\System32\vdsldr.exe
          C:\Windows\System32\vdsldr.exe -Embedding
          1⤵
            PID:2508
          • C:\Windows\System32\vds.exe
            C:\Windows\System32\vds.exe
            1⤵
            • Checks SCSI registry key(s)
            PID:5040

          Network

          MITRE ATT&CK Matrix ATT&CK v13

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          Persistence

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Privilege Escalation

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Defense Evasion

          Indicator Removal

          3
          T1070

          File Deletion

          3
          T1070.004

          Modify Registry

          1
          T1112

          Credential Access

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Query Registry

          2
          T1012

          Peripheral Device Discovery

          1
          T1120

          System Information Discovery

          1
          T1082

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Exfiltration

          Command and Control

          Impact

          Inhibit System Recovery

          4
          T1490

          Resource Development

          Reconnaissance

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[097C1327-3483].[[email protected]].8base
            Filesize

            3.2MB

            MD5

            7281c1a502787a749a65076473e6201b

            SHA1

            a63ec06a7a1c1ab501df215ca8183d9ee6f1e0db

            SHA256

            cc5bf0a33ddf930a195f05998f9d8694c363a93c99c8197e8ba4d4e53dc7be95

            SHA512

            35d419016deacea8b42bb4f9a12170567bdb656021e8e4b0b275b60e70269de7990a4cdcd2203be4bb0dce72ac7365efe1edd9a8ee66fc0baf8cf8f80145dfea

            Download Submit
          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\aedbddbf7494baaaf759a720d9cd17540d3c171b9cc52a02e0ef9a592bd9cd63.exe.log
            Filesize

            927B

            MD5

            ff27e87d4bf1330435001e57e8244d60

            SHA1

            b22264ed3cd4d35f8236278edd2512c3b7ecb355

            SHA256

            7e9adf70ba438f8a38feac34e1b25bb4261fa506d00361ea7e5cde784651474e

            SHA512

            d678aa2b42032ea0d811f9783abff7c94a6d674bd3dee74df706b7f95da7e51d84207320ea36226da4f8651e6ec618ea12d99d2d6d371bd1e98395518b8956e0

            Download Submit
          • memory/1624-769-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download
          • memory/1624-20-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download
          • memory/2508-13-0x00000000749D0000-0x0000000075180000-memory.dmp
            Filesize

            7.7MB

            Download
          • memory/2508-3-0x00000000059B0000-0x00000000059C0000-memory.dmp
            Filesize

            64KB

            Download
          • memory/2508-6-0x0000000005C50000-0x0000000005C84000-memory.dmp
            Filesize

            208KB

            Download
          • memory/2508-7-0x0000000005C90000-0x0000000005CDC000-memory.dmp
            Filesize

            304KB

            Download
          • memory/2508-0-0x0000000000FF0000-0x0000000001094000-memory.dmp
            Filesize

            656KB

            Download
          • memory/2508-2-0x0000000005FE0000-0x0000000006584000-memory.dmp
            Filesize

            5.6MB

            Download
          • memory/2508-5-0x0000000005B00000-0x0000000005B46000-memory.dmp
            Filesize

            280KB

            Download
          • memory/2508-1-0x00000000749D0000-0x0000000075180000-memory.dmp
            Filesize

            7.7MB

            Download
          • memory/2508-4-0x0000000005A30000-0x0000000005A88000-memory.dmp
            Filesize

            352KB

            Download
          • memory/4052-15-0x0000000074A70000-0x0000000075220000-memory.dmp
            Filesize

            7.7MB

            Download
          • memory/4052-16-0x0000000005010000-0x0000000005020000-memory.dmp
            Filesize

            64KB

            Download
          • memory/4052-21-0x0000000074A70000-0x0000000075220000-memory.dmp
            Filesize

            7.7MB

            Download
          • memory/4168-384-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download
          • memory/4168-225-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download
          • memory/4168-33-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download
          • memory/4168-36-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download
          • memory/4168-34-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download
          • memory/4168-51-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download
          • memory/4168-12-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download
          • memory/4168-43-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download
          • memory/4168-39-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download
          • memory/4168-133-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download
          • memory/4168-186-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download
          • memory/4168-184-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download
          • memory/4168-185-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download
          • memory/4168-32-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download
          • memory/4168-258-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download
          • memory/4168-237-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download
          • memory/4168-239-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download
          • memory/4168-11-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download
          • memory/4168-187-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download
          • memory/4168-137-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download
          • memory/4168-277-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download
          • memory/4168-361-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download
          • memory/4168-42-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download
          • memory/4168-714-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download
          • memory/4168-8-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download
          • memory/4168-2137-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download
          • memory/4168-2147-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download
          • memory/4168-2170-0x0000000000400000-0x0000000000413000-memory.dmp
            Filesize

            76KB

            Download