Overview

overview

10

Static

static

3

698b2a9cf9...JC.exe

windows7-x64

10

698b2a9cf9...JC.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    278s
  • max time network
    320s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    14-10-2023 00:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    698b2a9cf9ce16f1cb5cff4576e902888cb14db7414b8e6ac4eb728f8c87d209_JC.exe

  • Size

    261KB

  • MD5

    8275e1206ae049238705d40536deeb9f

  • SHA1

    78cca7eca6cc621bb23e198b0683a3d96ca76591

  • SHA256

    698b2a9cf9ce16f1cb5cff4576e902888cb14db7414b8e6ac4eb728f8c87d209

  • SHA512

    a3f388f3ed7e675c857378962445d731c806ff1ab2a3ddd99118823584c07c65456ea6d9bd6d21e639275063cc6b27cb7a2180f7655c5a695413b2b3c0d5af0d

  • SSDEEP

    6144:7y7GeVDqMGEHk2YHAtJqG1YzFtwE9Afxcb03SprqYsb1H:m7kMHk9G+nwlxDTH

Score
10/10
phobosevasionpersistenceransomware

Malware Config

Signatures

  • Phobos

    Phobos ransomware appeared at the beginning of 2019.

    ransomwarephobos
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Renames multiple (68) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Modifies Windows Firewall 1 TTPs 2 IoCs
    evasion
  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\698b2a9cf9ce16f1cb5cff4576e902888cb14db7414b8e6ac4eb728f8c87d209_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\698b2a9cf9ce16f1cb5cff4576e902888cb14db7414b8e6ac4eb728f8c87d209_JC.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2552
    • C:\Users\Admin\AppData\Local\Temp\698b2a9cf9ce16f1cb5cff4576e902888cb14db7414b8e6ac4eb728f8c87d209_JC.exe
      C:\Users\Admin\AppData\Local\Temp\698b2a9cf9ce16f1cb5cff4576e902888cb14db7414b8e6ac4eb728f8c87d209_JC.exe
      2⤵
      • Drops startup file
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2572
      • C:\Users\Admin\AppData\Local\Temp\698b2a9cf9ce16f1cb5cff4576e902888cb14db7414b8e6ac4eb728f8c87d209_JC.exe
        "C:\Users\Admin\AppData\Local\Temp\698b2a9cf9ce16f1cb5cff4576e902888cb14db7414b8e6ac4eb728f8c87d209_JC.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2356
        • C:\Users\Admin\AppData\Local\Temp\698b2a9cf9ce16f1cb5cff4576e902888cb14db7414b8e6ac4eb728f8c87d209_JC.exe
          C:\Users\Admin\AppData\Local\Temp\698b2a9cf9ce16f1cb5cff4576e902888cb14db7414b8e6ac4eb728f8c87d209_JC.exe
          4⤵
            PID:1668
          • C:\Users\Admin\AppData\Local\Temp\698b2a9cf9ce16f1cb5cff4576e902888cb14db7414b8e6ac4eb728f8c87d209_JC.exe
            C:\Users\Admin\AppData\Local\Temp\698b2a9cf9ce16f1cb5cff4576e902888cb14db7414b8e6ac4eb728f8c87d209_JC.exe
            4⤵
              PID:1760
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2104
            • C:\Windows\system32\vssadmin.exe
              vssadmin delete shadows /all /quiet
              4⤵
              • Interacts with shadow copies
              PID:2108
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1316
            • C:\Windows\system32\netsh.exe
              netsh advfirewall set currentprofile state off
              4⤵
              • Modifies Windows Firewall
              PID:108
            • C:\Windows\system32\netsh.exe
              netsh firewall set opmode mode=disable
              4⤵
              • Modifies Windows Firewall
              PID:1728
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2268

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW2.cab.id[B5A5F6E9-3483].[[email protected]].8base
        Filesize

        83.8MB

        MD5

        2a909f9504f2eeb885da03619dc724a1

        SHA1

        9f549726a5a45357127a45febca16b9cdd343291

        SHA256

        558d43480e4df507c9e56d3d62211a81a8501d2a0eaf794778e6e7e007bd446d

        SHA512

        3e329f717a009844044980c477afb9c64d9295fbdcae9bfc9362ddba5de0cdf8c4596e347ad9497913b1495f668ad10f8f6168d5fd861fc013a97305a3f1f946

        Download Submit

      • memory/1760-39-0x0000000000401000-0x000000000040A000-memory.dmp

        Filesize

        36KB

        Download

      • memory/1760-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2356-19-0x0000000001030000-0x0000000001078000-memory.dmp

        Filesize

        288KB

        Download

      • memory/2356-38-0x0000000074660000-0x0000000074D4E000-memory.dmp

        Filesize

        6.9MB

        Download

      • memory/2356-20-0x0000000074660000-0x0000000074D4E000-memory.dmp

        Filesize

        6.9MB

        Download

      • memory/2552-16-0x0000000074720000-0x0000000074E0E000-memory.dmp

        Filesize

        6.9MB

        Download

      • memory/2552-0-0x0000000001030000-0x0000000001078000-memory.dmp

        Filesize

        288KB

        Download

      • memory/2552-1-0x0000000074720000-0x0000000074E0E000-memory.dmp

        Filesize

        6.9MB

        Download

      • memory/2552-2-0x0000000000A20000-0x0000000000A66000-memory.dmp

        Filesize

        280KB

        Download

      • memory/2552-3-0x00000000049E0000-0x0000000004A20000-memory.dmp

        Filesize

        256KB

        Download

      • memory/2552-4-0x0000000000A60000-0x0000000000A94000-memory.dmp

        Filesize

        208KB

        Download

      • memory/2552-5-0x0000000000B80000-0x0000000000BCC000-memory.dmp

        Filesize

        304KB

        Download

      • memory/2572-6-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

        Download

      • memory/2572-49-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

        Download

      • memory/2572-17-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

        Download

      • memory/2572-18-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

        Download

      • memory/2572-7-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

        Download

      • memory/2572-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2572-11-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

        Download

      • memory/2572-10-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

        Download

      • memory/2572-9-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

        Download

      • memory/2572-14-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

        Download

      • memory/2572-51-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

        Download

      • memory/2572-53-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

        Download

      • memory/2572-56-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

        Download

      • memory/2572-58-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

        Download

      • memory/2572-61-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

        Download

      • memory/2572-67-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

        Download

      • memory/2572-8-0x0000000000400000-0x0000000000413000-memory.dmp

        Filesize

        76KB

        Download