Overview

overview

10

Static

static

3

NEAS.NEASN...JC.exe

windows7-x64

10

NEAS.NEASN...JC.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    152s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-10-2023 17:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NEAS.NEASNEAS7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8exeexeexe_JC.exe

  • Size

    549KB

  • MD5

    40a2a330dece024db63f275748eb3d7a

  • SHA1

    97508bbbff47aa06a381ff80428b8578d4daafb5

  • SHA256

    7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8

  • SHA512

    dcec48482463a960d47ea93b655dfec3ca88561fab3648b5ab8a8e7253a59d282c7cd4392daec9d3c95ebe9fb5265961705433c2374f6ffe2348123e586ed0a4

  • SSDEEP

    12288:yVthvdMSOXfbbOPFErVy0MRRp1o6tD5B:k3FMFXfXOPmRy0Wp1Ft

Score
10/10
phobosevasionpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Phobos

    Phobos ransomware appeared at the beginning of 2019.

    ransomwarephobos
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (378) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Modifies Windows Firewall 1 TTPs 2 IoCs
    evasion
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEAS7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8exeexeexe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEAS7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8exeexeexe_JC.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4420
    • C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEAS7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8exeexeexe_JC.exe
      C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEAS7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8exeexeexe_JC.exe
      2⤵
      • Drops startup file
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1788
      • C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEAS7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8exeexeexe_JC.exe
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEAS7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8exeexeexe_JC.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4404
        • C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEAS7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8exeexeexe_JC.exe
          C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEAS7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8exeexeexe_JC.exe
          4⤵
            PID:3628
          • C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEAS7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8exeexeexe_JC.exe
            C:\Users\Admin\AppData\Local\Temp\NEAS.NEASNEAS7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8exeexeexe_JC.exe
            4⤵
              PID:4596
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4228
            • C:\Windows\system32\vssadmin.exe
              vssadmin delete shadows /all /quiet
              4⤵
              • Interacts with shadow copies
              PID:4144
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic shadowcopy delete
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4832
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set {default} bootstatuspolicy ignoreallfailures
              4⤵
              • Modifies boot configuration data using bcdedit
              PID:1972
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set {default} recoveryenabled no
              4⤵
              • Modifies boot configuration data using bcdedit
              PID:400
            • C:\Windows\system32\wbadmin.exe
              wbadmin delete catalog -quiet
              4⤵
              • Deletes backup catalog
              PID:3744
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4800
            • C:\Windows\system32\netsh.exe
              netsh advfirewall set currentprofile state off
              4⤵
              • Modifies Windows Firewall
              PID:2872
            • C:\Windows\system32\netsh.exe
              netsh firewall set opmode mode=disable
              4⤵
              • Modifies Windows Firewall
              PID:972
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4644
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4132
      • C:\Windows\System32\vdsldr.exe
        C:\Windows\System32\vdsldr.exe -Embedding
        1⤵
          PID:4976
        • C:\Windows\System32\vds.exe
          C:\Windows\System32\vds.exe
          1⤵
          • Checks SCSI registry key(s)
          PID:3096

        Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Defense Evasion

        Indicator Removal

        3
        T1070

        File Deletion

        3
        T1070.004

        Modify Registry

        1
        T1112

        Credential Access

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        2
        T1012

        System Information Discovery

        1
        T1082

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Inhibit System Recovery

        4
        T1490

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[EA9BE824-3483].[[email protected]].8base
          Filesize

          3.2MB

          MD5

          27c1ec158d7aef31ad25173920e23344

          SHA1

          bb36ba98c408d36126e44a8ba1c56bfbf2e3c85a

          SHA256

          8b205306a9eea5e92b9829950ea394e4d3e80ec61ae462d2b690fbe44ca9e0ba

          SHA512

          d2484bbdb179c41fd3c4db0184042987e7a3e264c3ee28671a0814a73cd6e9342abfd813eed9817e83502998fe9fc67697cb3e3adc9b46d1aa0693a35dc193e2

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NEAS.NEASNEAS7e18ff461e3fc159c9b6634c9250600ea4c62da604885697c95d9bac794109b8exeexeexe_JC.exe.log
          Filesize

          927B

          MD5

          4a911455784f74e368a4c2c7876d76f4

          SHA1

          a1700a0849ffb4f26671eb76da2489946b821c34

          SHA256

          264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c

          SHA512

          4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

          Download Submit

        • memory/1788-34-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

          Download

        • memory/1788-216-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

          Download

        • memory/1788-1794-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

          Download

        • memory/1788-66-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

          Download

        • memory/1788-1773-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

          Download

        • memory/1788-7-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

          Download

        • memory/1788-10-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

          Download

        • memory/1788-922-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

          Download

        • memory/1788-412-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

          Download

        • memory/1788-287-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

          Download

        • memory/1788-184-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

          Download

        • memory/1788-255-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

          Download

        • memory/1788-230-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

          Download

        • memory/1788-219-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

          Download

        • memory/1788-117-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

          Download

        • memory/1788-31-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

          Download

        • memory/1788-33-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

          Download

        • memory/1788-36-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

          Download

        • memory/1788-11-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

          Download

        • memory/1788-1786-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

          Download

        • memory/1788-185-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

          Download

        • memory/1788-89-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

          Download

        • memory/1788-44-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

          Download

        • memory/1788-40-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

          Download

        • memory/1788-136-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

          Download

        • memory/4404-15-0x0000000074EE0000-0x0000000075690000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/4404-19-0x0000000074EE0000-0x0000000075690000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/4404-16-0x0000000002D70000-0x0000000002D80000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4404-14-0x0000000005500000-0x0000000005546000-memory.dmp

          Filesize

          280KB

          Download

        • memory/4420-3-0x0000000004E20000-0x0000000004E30000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4420-1-0x0000000074E40000-0x00000000755F0000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/4420-12-0x0000000074E40000-0x00000000755F0000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/4420-0-0x0000000000460000-0x00000000004F0000-memory.dmp

          Filesize

          576KB

          Download

        • memory/4420-2-0x0000000004DE0000-0x0000000004E26000-memory.dmp

          Filesize

          280KB

          Download

        • memory/4420-6-0x0000000005570000-0x0000000005B14000-memory.dmp

          Filesize

          5.6MB

          Download

        • memory/4420-5-0x0000000004F00000-0x0000000004F4C000-memory.dmp

          Filesize

          304KB

          Download

        • memory/4420-4-0x0000000004EC0000-0x0000000004EF4000-memory.dmp

          Filesize

          208KB

          Download

        • memory/4596-21-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

          Download