Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
-
submitted
25-10-2023 21:11
General
-
Target
c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec.exe
-
Size
2.6MB
-
MD5
f4d64c9ae825a8b1e0db64c93d37eb2a
-
SHA1
03d03b2fcafc1fc36b960b6351e951fe40fb0c66
-
SHA256
c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec
-
SHA512
5bc061c49628d4c72114366ef81b451f44f14d2ab8a8dedb9699d894156091dab2dca4f04f810651397876959139e8a28d6acba81da803b3e723c834d88749fa
-
SSDEEP
49152:NuAar4jDBSIFF/eqdjsAk5LNzL5FQaNFofpoVZ8W0gXZBY/e4AtYOoUqNxmgMm:NuA4MFvBoIAycZomgH
Malware Config
Extracted
C:\info.hta
class='mark'>[email protected]</span></div>
http://www.w3.org/TR/html4/strict.dtd'>
Extracted
C:\Users\Admin\Desktop\info.hta
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
-
Renames multiple (436) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes backup catalog 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Modifies Windows Firewall 1 TTPs 2 IoCs
-
Drops startup file 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 64 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 62 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec.exe"C:\Users\Admin\AppData\Local\Temp\c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec.exeC:\Users\Admin\AppData\Local\Temp\c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec.exe2⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec.exe"C:\Users\Admin\AppData\Local\Temp\c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec.exeC:\Users\Admin\AppData\Local\Temp\c83894f6f01a0d4a492c2e05966816e27dac6b9093f83b499b6a5b2f28b53cec.exe4⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off4⤵
- Modifies Windows Firewall
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD51e4afb0ac2bdc8aea3673c32136b4d0b
SHA11b5d5adfc10e3e7c91fd51bd740b12248858471a
SHA2566195c6ce5186c2fb63c0ba8c2321450fa0665673abce1d15bc8ad0fb13dbab4f
SHA5129bb3269787ae0743269ba2d90563d40fdcfd6f7e5fe9a8fae875b511589e014d33b54fb4f7b8cace6d7c147a4e544721e926e7d85dad8779503220d94a0d0c68
-
Filesize
1016B
MD5eb3e72abb586428b38f41d71484f335d
SHA18375215687670327b15c0d3f063f19e6e2021a09
SHA2565a9f35944e264977518dc3433c80e3098247bb0909306a1e9c50d924e7b03ada
SHA51270864b63590ac683e98885818d759fdc3ea9363a5bfc44ded834f6921c9ec8e7df479e8807652ba72c32e2414517c304da03bc1e0fb3d9342469c8e6a6ab288c
-
Filesize
5KB
MD58177d0ef9533ac9801790d3ce03a90e3
SHA1b4a6b4efbaa8611c96eff5f89a2c86ac28f6a4ee
SHA25600f8ed5b75b194c40f5087867629be80ebe8acc885c97c93cfb26d53a79836c5
SHA512334efb9faa8e3930634f7a4a4892ca823e83cd4b00d10f8a25d14b95e268a828216faea11750ce23ef10eb1ea34f447852cec664bfab1e77a2f22d5a6e192b88
-
Filesize
5KB
MD58177d0ef9533ac9801790d3ce03a90e3
SHA1b4a6b4efbaa8611c96eff5f89a2c86ac28f6a4ee
SHA25600f8ed5b75b194c40f5087867629be80ebe8acc885c97c93cfb26d53a79836c5
SHA512334efb9faa8e3930634f7a4a4892ca823e83cd4b00d10f8a25d14b95e268a828216faea11750ce23ef10eb1ea34f447852cec664bfab1e77a2f22d5a6e192b88
-
Filesize
5KB
MD58177d0ef9533ac9801790d3ce03a90e3
SHA1b4a6b4efbaa8611c96eff5f89a2c86ac28f6a4ee
SHA25600f8ed5b75b194c40f5087867629be80ebe8acc885c97c93cfb26d53a79836c5
SHA512334efb9faa8e3930634f7a4a4892ca823e83cd4b00d10f8a25d14b95e268a828216faea11750ce23ef10eb1ea34f447852cec664bfab1e77a2f22d5a6e192b88
-
Filesize
5KB
MD58177d0ef9533ac9801790d3ce03a90e3
SHA1b4a6b4efbaa8611c96eff5f89a2c86ac28f6a4ee
SHA25600f8ed5b75b194c40f5087867629be80ebe8acc885c97c93cfb26d53a79836c5
SHA512334efb9faa8e3930634f7a4a4892ca823e83cd4b00d10f8a25d14b95e268a828216faea11750ce23ef10eb1ea34f447852cec664bfab1e77a2f22d5a6e192b88
-
Filesize
5KB
MD58177d0ef9533ac9801790d3ce03a90e3
SHA1b4a6b4efbaa8611c96eff5f89a2c86ac28f6a4ee
SHA25600f8ed5b75b194c40f5087867629be80ebe8acc885c97c93cfb26d53a79836c5
SHA512334efb9faa8e3930634f7a4a4892ca823e83cd4b00d10f8a25d14b95e268a828216faea11750ce23ef10eb1ea34f447852cec664bfab1e77a2f22d5a6e192b88
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
1.1MB
-
Filesize
2.6MB
-
Filesize
304KB
-
Filesize
216KB
-
Filesize
6.9MB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
208KB
-
Filesize
6.9MB
-
Filesize
5.0MB
-
Filesize
312KB
-
Filesize
76KB
-
Filesize
6.9MB
-
Filesize
64KB
-
Filesize
6.9MB