Overview

overview

10

Static

static

3

NEAS.NEASN...JC.exe

windows7-x64

10

NEAS.NEASN...JC.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    13-10-2023 17:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NEAS.NEASNEAS7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8exeexeexe_JC.exe

  • Size

    549KB

  • MD5

    40a2a330dece024db63f275748eb3d7a

  • SHA1

    97508bbbff47aa06a381ff80428b8578d4daafb5

  • SHA256

    7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8

  • SHA512

    dcec48482463a960d47ea93b655dfec3ca88561fab3648b5ab8a8e7253a59d282c7cd4392daec9d3c95ebe9fb5265961705433c2374f6ffe2348123e586ed0a4

  • SSDEEP

    12288:yVthvdMSOXfbbOPFErVy0MRRp1o6tD5B:k3FMFXfXOPmRy0Wp1Ft

Score
10/10
phobosevasionpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Phobos

    Phobos ransomware appeared at the beginning of 2019.

    ransomwarephobos
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (140) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Modifies Windows Firewall 1 TTPs 2 IoCs
    evasion
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 11 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEAS7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8exeexeexe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEAS7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8exeexeexe_JC.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2116
    • C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEAS7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8exeexeexe_JC.exe
      C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEAS7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8exeexeexe_JC.exe
      2⤵
      • Drops startup file
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2464
      • C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEAS7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8exeexeexe_JC.exe
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEAS7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8exeexeexe_JC.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2352
        • C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEAS7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8exeexeexe_JC.exe
          C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEAS7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8exeexeexe_JC.exe
          4⤵
            PID:2764
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2532
          • C:\Windows\system32\netsh.exe
            netsh advfirewall set currentprofile state off
            4⤵
            • Modifies Windows Firewall
            PID:3048
          • C:\Windows\system32\netsh.exe
            netsh firewall set opmode mode=disable
            4⤵
            • Modifies Windows Firewall
            PID:2072
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2536
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            4⤵
            • Interacts with shadow copies
            PID:3056
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic shadowcopy delete
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2440
          • C:\Windows\system32\bcdedit.exe
            bcdedit /set {default} bootstatuspolicy ignoreallfailures
            4⤵
            • Modifies boot configuration data using bcdedit
            PID:2952
          • C:\Windows\system32\bcdedit.exe
            bcdedit /set {default} recoveryenabled no
            4⤵
            • Modifies boot configuration data using bcdedit
            PID:2060
          • C:\Windows\system32\wbadmin.exe
            wbadmin delete catalog -quiet
            4⤵
            • Deletes backup catalog
            PID:432
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1800
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1788
    • C:\Windows\System32\vdsldr.exe
      C:\Windows\System32\vdsldr.exe -Embedding
      1⤵
        PID:1996
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
          PID:1176

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        Persistence

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Privilege Escalation

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Defense Evasion

        Indicator Removal

        3
        T1070

        File Deletion

        3
        T1070.004

        Modify Registry

        1
        T1112

        Credential Access

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Query Registry

        1
        T1012

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Exfiltration

        Command and Control

        Impact

        Inhibit System Recovery

        4
        T1490

        Resource Development

        Reconnaissance

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id[293F7CBA-3483].[[email protected]].8base
          Filesize

          143.1MB

          MD5

          9e6081f109d83b1baa3c8105f6cea33f

          SHA1

          568fc7a0ceda37ce8cebcb3af3a37abd64ec73f4

          SHA256

          41ee4876ce93a6e508cdaf310fa4d102adcfe7d93092bcf43e74889c8fd7ae17

          SHA512

          b120cc8051260df0986baa8c50f47eb33ec5c387b7dc844575ea23aee581c7e6dc45912203e7252c30ea388f547e730ce2fde76da194f0d80fcd7bc2ee21ee55

          Download Submit
        • memory/2116-22-0x0000000074420000-0x0000000074B0E000-memory.dmp
          Filesize

          6.9MB

          Download
        • memory/2116-0-0x0000000000F10000-0x0000000000FA0000-memory.dmp
          Filesize

          576KB

          Download
        • memory/2116-2-0x00000000003D0000-0x0000000000416000-memory.dmp
          Filesize

          280KB

          Download
        • memory/2116-3-0x0000000004940000-0x0000000004980000-memory.dmp
          Filesize

          256KB

          Download
        • memory/2116-4-0x00000000004B0000-0x00000000004E4000-memory.dmp
          Filesize

          208KB

          Download
        • memory/2116-5-0x0000000000C60000-0x0000000000CAC000-memory.dmp
          Filesize

          304KB

          Download
        • memory/2116-1-0x0000000074420000-0x0000000074B0E000-memory.dmp
          Filesize

          6.9MB

          Download
        • memory/2352-44-0x00000000743D0000-0x0000000074ABE000-memory.dmp
          Filesize

          6.9MB

          Download
        • memory/2352-27-0x00000000009F0000-0x0000000000A36000-memory.dmp
          Filesize

          280KB

          Download
        • memory/2352-25-0x0000000000F10000-0x0000000000FA0000-memory.dmp
          Filesize

          576KB

          Download
        • memory/2352-26-0x00000000743D0000-0x0000000074ABE000-memory.dmp
          Filesize

          6.9MB

          Download
        • memory/2464-24-0x0000000000400000-0x0000000000413000-memory.dmp
          Filesize

          76KB

          Download
        • memory/2464-56-0x0000000000400000-0x0000000000413000-memory.dmp
          Filesize

          76KB

          Download
        • memory/2464-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
          Filesize

          4KB

          Download
        • memory/2464-23-0x0000000000400000-0x0000000000413000-memory.dmp
          Filesize

          76KB

          Download
        • memory/2464-16-0x0000000000400000-0x0000000000413000-memory.dmp
          Filesize

          76KB

          Download
        • memory/2464-14-0x0000000000400000-0x0000000000413000-memory.dmp
          Filesize

          76KB

          Download
        • memory/2464-12-0x0000000000400000-0x0000000000413000-memory.dmp
          Filesize

          76KB

          Download
        • memory/2464-10-0x0000000000400000-0x0000000000413000-memory.dmp
          Filesize

          76KB

          Download
        • memory/2464-234-0x0000000000400000-0x0000000000413000-memory.dmp
          Filesize

          76KB

          Download
        • memory/2464-8-0x0000000000400000-0x0000000000413000-memory.dmp
          Filesize

          76KB

          Download
        • memory/2464-6-0x0000000000400000-0x0000000000413000-memory.dmp
          Filesize

          76KB

          Download
        • memory/2464-20-0x0000000000400000-0x0000000000413000-memory.dmp
          Filesize

          76KB

          Download
        • memory/2464-58-0x0000000000400000-0x0000000000413000-memory.dmp
          Filesize

          76KB

          Download
        • memory/2464-59-0x0000000000400000-0x0000000000413000-memory.dmp
          Filesize

          76KB

          Download
        • memory/2464-60-0x0000000000400000-0x0000000000413000-memory.dmp
          Filesize

          76KB

          Download
        • memory/2464-61-0x0000000000400000-0x0000000000413000-memory.dmp
          Filesize

          76KB

          Download
        • memory/2464-62-0x0000000000400000-0x0000000000413000-memory.dmp
          Filesize

          76KB

          Download
        • memory/2464-75-0x0000000000400000-0x0000000000413000-memory.dmp
          Filesize

          76KB

          Download
        • memory/2464-79-0x0000000000400000-0x0000000000413000-memory.dmp
          Filesize

          76KB

          Download
        • memory/2464-81-0x0000000000400000-0x0000000000413000-memory.dmp
          Filesize

          76KB

          Download
        • memory/2464-80-0x0000000000400000-0x0000000000413000-memory.dmp
          Filesize

          76KB

          Download
        • memory/2764-46-0x0000000000401000-0x000000000040A000-memory.dmp
          Filesize

          36KB

          Download
        • memory/2764-40-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
          Filesize

          4KB

          Download