phorphiex | 8cd916321f1c8a63bd9fafb52a478ac65b3e86a33966bbfce60f5e46ffee6b8c

General

Target
8cd916321f1c8a63bd9fafb52a478ac65b3e86a33966bbfce60f5e46ffee6b8cexe.exe
Size 112KB
Sample240111-v9edhadacm
SHA256 8cd916321f1c8a63bd9fafb52a478ac65b3e86a33966bbfce60f5e46ffee6b8c
MD5 2d5e7babf1b2d92b56fda0b9044f889a
SHA1 d2f1f6a1e267172fc183a0d1a2affdd26145f59d
SHA512 68167664fc5e957b9aee18713ddf975823a73713d6c2fe31f532dcb53bee280a7fbfda68961a514d049558c602d74e91b24995fc1153e3f376cea5ebc7f93688
SSDEEP 3072:8q7DiX2FNAVWllSP8QLZwgtTIFFjB/0SA:N7DiQWTlZw3FjJA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Signatures

Phorphiex
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Phorphiex payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023221-4.dat	family_phorphiex
behavioral2/files/0x0008000000023221-3.dat	family_phorphiex

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
2148	lsass.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	lsass.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\6206101859001\\lsass.exe"	8cd916321f1c8a63bd9fafb52a478ac65b3e86a33966bbfce60f5e46ffee6b8cexe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\6206101859001\\lsass.exe"	8cd916321f1c8a63bd9fafb52a478ac65b3e86a33966bbfce60f5e46ffee6b8cexe.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 2148	5096	8cd916321f1c8a63bd9fafb52a478ac65b3e86a33966bbfce60f5e46ffee6b8cexe.exe	97
PID 5096 wrote to memory of 2148	5096	8cd916321f1c8a63bd9fafb52a478ac65b3e86a33966bbfce60f5e46ffee6b8cexe.exe	97
PID 5096 wrote to memory of 2148	5096	8cd916321f1c8a63bd9fafb52a478ac65b3e86a33966bbfce60f5e46ffee6b8cexe.exe	97

C:\Users\Admin\AppData\Local\Temp\8cd916321f1c8a63bd9fafb52a478ac65b3e86a33966bbfce60f5e46ffee6b8cexe.exe
"C:\Users\Admin\AppData\Local\Temp\8cd916321f1c8a63bd9fafb52a478ac65b3e86a33966bbfce60f5e46ffee6b8cexe.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5096
- C:\6206101859001\lsass.exe
  C:\6206101859001\lsass.exe
  2⤵
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\6206101859001\lsass.exe
Size 54KB
SHA256 e84d9ff4688244e0a1cdee440c59995195f6d7fe522cb2b6811006e4c00c3843
MD5 fc04bf46c9699853cbfd0cf00c48e8bb
SHA1 5823bbed017ddcf1460c8a6dc60f5328cbd21438
SHA512 ea19dc175d8525e13e8cc753241c840164474151175e6eaf18fbe87ad0a20f3f2fb6ff6cd070c9a91bdd5aa959de8f4babf4e3334ca6f67440864bae71c75c7c
SSDEEP 1536:8q3Yc9PthkHQ7/Z33cpy2X2rxNAVy90aL:8q7DiX2FNAVm
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\6206101859001\lsass.exe
Size 90KB
SHA256 854124eada7ccb348af91dc0aec3a65be6b591932dd96c61694520cf60795737
MD5 787fd950067a6cccd4507ff13fb20d40
SHA1 72817b96cd74f5b950817cb9d1a25e8b166a134d
SHA512 2a6fc36e0d31d6952a6ecebd2cbc5f6c9fa9de4b4c2c15717775bdeb6437b327b5145c37c02c5b1867a1502d30e5bc6430ae6602b95a9734f0def70a2ca441d9
SSDEEP 1536:8q3Yc9PthkHQ7/Z33cpy2X2rxNAVy90avllSP/xGZtHZWLZwLnrAtTyJ7:8q7DiX2FNAVWllSP8QLZwgtTI7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads