Overview

overview

10

Static

static

3

d7cb8a2d60...d7.exe

windows7-x64

5

d7cb8a2d60...d7.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    175s
  • max time network
    180s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-10-2023 03:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe

  • Size

    312KB

  • MD5

    9824d07cea51069c0042eff0e46d1ad2

  • SHA1

    70ef130a8f88076dc671ab9873b2a3a3c45818fc

  • SHA256

    d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7

  • SHA512

    6d38269e1c93c7e8bd6668cd26947cb821043c9bcbcb19d586795e0fb3d52b8a492e3817eef912bae165973c001c205fd879bbca9810339e6b45bda1651e3bb9

  • SSDEEP

    6144:XAo4v3KmeRDWs0cSsm42PWB1vEtf8h81dZgjvxbtIGnWSPgYYshfnmU3H1l5Fy4:XGimeAs0cuvuB14I9JWfWnNl

Score
10/10
phobosevasionpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Phobos

    Phobos ransomware appeared at the beginning of 2019.

    ransomwarephobos
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (165) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Modifies Windows Firewall 1 TTPs 2 IoCs
    evasion
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
    "C:\Users\Admin\AppData\Local\Temp\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3412
    • C:\Users\Admin\AppData\Local\Temp\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
      C:\Users\Admin\AppData\Local\Temp\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
      2⤵
        PID:5036
      • C:\Users\Admin\AppData\Local\Temp\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
        C:\Users\Admin\AppData\Local\Temp\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
        2⤵
          PID:5112
        • C:\Users\Admin\AppData\Local\Temp\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
          C:\Users\Admin\AppData\Local\Temp\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
          2⤵
          • Drops startup file
          • Adds Run key to start application
          • Drops desktop.ini file(s)
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1896
          • C:\Users\Admin\AppData\Local\Temp\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
            "C:\Users\Admin\AppData\Local\Temp\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe"
            3⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4384
            • C:\Users\Admin\AppData\Local\Temp\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
              C:\Users\Admin\AppData\Local\Temp\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
              4⤵
                PID:1164
              • C:\Users\Admin\AppData\Local\Temp\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
                C:\Users\Admin\AppData\Local\Temp\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe
                4⤵
                  PID:688
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1148
                • C:\Windows\system32\vssadmin.exe
                  vssadmin delete shadows /all /quiet
                  4⤵
                  • Interacts with shadow copies
                  PID:5000
                • C:\Windows\System32\Wbem\WMIC.exe
                  wmic shadowcopy delete
                  4⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2524
                • C:\Windows\system32\bcdedit.exe
                  bcdedit /set {default} bootstatuspolicy ignoreallfailures
                  4⤵
                  • Modifies boot configuration data using bcdedit
                  PID:1948
                • C:\Windows\system32\bcdedit.exe
                  bcdedit /set {default} recoveryenabled no
                  4⤵
                  • Modifies boot configuration data using bcdedit
                  PID:2952
                • C:\Windows\system32\wbadmin.exe
                  wbadmin delete catalog -quiet
                  4⤵
                  • Deletes backup catalog
                  PID:1292
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:632
                • C:\Windows\system32\netsh.exe
                  netsh advfirewall set currentprofile state off
                  4⤵
                  • Modifies Windows Firewall
                  PID:1820
                • C:\Windows\system32\netsh.exe
                  netsh firewall set opmode mode=disable
                  4⤵
                  • Modifies Windows Firewall
                  PID:3736
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4384
          • C:\Windows\system32\wbengine.exe
            "C:\Windows\system32\wbengine.exe"
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:288
          • C:\Windows\System32\vdsldr.exe
            C:\Windows\System32\vdsldr.exe -Embedding
            1⤵
              PID:4848
            • C:\Windows\System32\vds.exe
              C:\Windows\System32\vds.exe
              1⤵
              • Checks SCSI registry key(s)
              PID:60

            Network

            MITRE ATT&CK Matrix ATT&CK v13

            Initial Access

            Execution

            Command and Scripting Interpreter

            1
            T1059

            Persistence

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Privilege Escalation

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Defense Evasion

            Indicator Removal

            3
            T1070

            File Deletion

            3
            T1070.004

            Modify Registry

            1
            T1112

            Credential Access

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Query Registry

            2
            T1012

            Peripheral Device Discovery

            1
            T1120

            System Information Discovery

            1
            T1082

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Exfiltration

            Command and Control

            Impact

            Inhibit System Recovery

            4
            T1490

            Resource Development

            Reconnaissance

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[1EB07303-3483].[[email protected]].8base
              Filesize

              3.2MB

              MD5

              d4055a8fc1eea8d85c42b61bc11cca11

              SHA1

              4d642d792b062da3ad22f5adf3a934b7fdf282b8

              SHA256

              32148b6bee09d639aa1ba25a13b0aa2056d7cfc47e0d6d352b3d17847d9c5766

              SHA512

              e14282915ebce5a3d6abe62337efae3775a353e37a52702585f6e249e8fa2b427a7a725d00c03a29403aaa61105165a4467607e42eceae6c425b8fdd571e201a

              Download Submit
            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\d7cb8a2d60e1818d0638a4c38cd6fae475dc83ab7b2bde9827ecc4e4a7ce6ed7.exe.log
              Filesize

              927B

              MD5

              ff27e87d4bf1330435001e57e8244d60

              SHA1

              b22264ed3cd4d35f8236278edd2512c3b7ecb355

              SHA256

              7e9adf70ba438f8a38feac34e1b25bb4261fa506d00361ea7e5cde784651474e

              SHA512

              d678aa2b42032ea0d811f9783abff7c94a6d674bd3dee74df706b7f95da7e51d84207320ea36226da4f8651e6ec618ea12d99d2d6d371bd1e98395518b8956e0

              Download Submit
            • memory/688-18-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-53-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-35-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-1919-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-59-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-7-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-36-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-11-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-37-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-906-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-576-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-335-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-196-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-30-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-31-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-33-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-194-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-43-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-46-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-54-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-248-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-251-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-173-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-10-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-86-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-87-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-99-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-76-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-97-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-170-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-171-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/1896-193-0x0000000000400000-0x0000000000413000-memory.dmp
              Filesize

              76KB

              Download
            • memory/3412-12-0x0000000074F50000-0x0000000075700000-memory.dmp
              Filesize

              7.7MB

              Download
            • memory/3412-1-0x00000000009B0000-0x0000000000A04000-memory.dmp
              Filesize

              336KB

              Download
            • memory/3412-4-0x00000000053B0000-0x00000000053C0000-memory.dmp
              Filesize

              64KB

              Download
            • memory/3412-6-0x00000000055D0000-0x000000000561C000-memory.dmp
              Filesize

              304KB

              Download
            • memory/3412-0-0x0000000074F50000-0x0000000075700000-memory.dmp
              Filesize

              7.7MB

              Download
            • memory/3412-2-0x0000000005990000-0x0000000005F34000-memory.dmp
              Filesize

              5.6MB

              Download
            • memory/3412-3-0x0000000005450000-0x0000000005496000-memory.dmp
              Filesize

              280KB

              Download
            • memory/3412-5-0x0000000005590000-0x00000000055C4000-memory.dmp
              Filesize

              208KB

              Download
            • memory/4384-19-0x0000000074FF0000-0x00000000757A0000-memory.dmp
              Filesize

              7.7MB

              Download
            • memory/4384-14-0x0000000074FF0000-0x00000000757A0000-memory.dmp
              Filesize

              7.7MB

              Download