Resubmissions
16-03-2024 17:17
240316-vtswysfd2y 1016-03-2024 15:31
240316-syg9xafg39 1015-03-2024 08:15
240315-j5rmgsbg5z 10Analysis
-
max time kernel
151s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
15-03-2024 08:15
General
-
Target
d50b23e12c661bb78fa3cb317e679fabc4178600048572368bec173a520e4aaf.exe
-
Size
55KB
-
MD5
498ee5cf9c611ba7ed2379414d0bb010
-
SHA1
c4f779d08633a53e7a03c702eafbe3314055aa18
-
SHA256
d50b23e12c661bb78fa3cb317e679fabc4178600048572368bec173a520e4aaf
-
SHA512
8dad911c0b59485dafd6ddcf879774016f8d63690085d4840e422b44735e82140ad177e9e7663b6cc474214461693219142b55e93fd853a593925752fbaa2761
-
SSDEEP
1536:KNeRBl5PT/rx1mzwRMSTdLpJYXRBawzpK:KQRrmzwR5J4e
Malware Config
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Renames multiple (68) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
-
Drops startup file 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 4 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 47 IoCs
-
Suspicious use of WriteProcessMemory 29 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d50b23e12c661bb78fa3cb317e679fabc4178600048572368bec173a520e4aaf.exe"C:\Users\Admin\AppData\Local\Temp\d50b23e12c661bb78fa3cb317e679fabc4178600048572368bec173a520e4aaf.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d50b23e12c661bb78fa3cb317e679fabc4178600048572368bec173a520e4aaf.exe"C:\Users\Admin\AppData\Local\Temp\d50b23e12c661bb78fa3cb317e679fabc4178600048572368bec173a520e4aaf.exe"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.id[3AD934A8-2874].[tolong80@protonmail.ch].ekingFilesize
21.7MB
MD52f25cadfb6d1007a244f93e10bb47f01
SHA130524691adee178376595c438dc0646658999274
SHA2562efec38d3d809dc40a221d3dc9140daaa8dabd1abbce3ee2159a7b3491b474f3
SHA512c47a3cf1d3cff192393db60de75794d4e38916e0edfbe3c227cb0e7478caf3a33fdfb3252d3ae8efa751a5c2492f21f10d0e99f27a3f999b4a6c31d7f98e6eb6
-
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Rio_GallegosFilesize
549B
MD5db10fd32bfe67918ed177579d4be9d76
SHA144ecf4c5a6fbbd1ace84d0efe91f13d6ba6bb738
SHA256c936ab1da7ef4314182c8edabaeae90f8d51ed45bc48848d35670adf5b470d31
SHA512bb574ef876e7529d4f3c4c52cc54aa1814f2c02030b83a5bd7223d4b31c992668c00e4a7e68d4f1caaa6493db4ac84eb649fe59e98feceb9828119cac1e74b05
-
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\CuracaoFilesize
77B
MD52b62a30906a2b8bf3b68abd2ef9d105b
SHA19898d25a214dba04ebd7e3030ac9e2e90ea7a369
SHA256075561eff2cd3ad586776fa904f0040282c5f6a261f6a8fd6a0a524d14cd2d2c
SHA5126db5955477a9bb5386c1af03df526496f9e64533e6c3071c8e5c44062541e91e9bb39096da947a91bdfa5e7de53c1e047dcf427c1dfde94554d7458f8f0862ea
-
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\GuayaquilFilesize
65B
MD51ef5e829303a139ce967440e0cdca10c
SHA1f0fa45906bd0f4c3668fcd0d8f68d4b298b30e5b
SHA25698ce42deef51d40269d542f5314bef2c7468d401ad5d85168bfab4c0108f75f7
SHA51219dc6ae12de08b21b36c1ec7f353ce9e7cef73fa4d1354c436234167f0847bc9e2b85e2f36208f773ef324e2d79e6af1beca4470e44b8672b47d077efe33a1f8
-
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\TijuanaFilesize
1KB
MD571c7e24524aea1022361143d0a876c84
SHA1b141efff466f27664599dd2aa91f0b7c50736f1d
SHA25607a692cc9bc920ef8caed75ba9af60ad2d6b144c83bfde3b91a77b5bcce277a3
SHA5124cd51849de464e0139ce77de3003af1ab1b6c639862fb7d5e8362f33ef0a9828f8af9ebd6d4b4ce9dc5a67084bc5c1106fd3b3327fc428e25c75b780e98d37ff
-
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\KarachiFilesize
153B
MD5d13b5ffdeb538f15ee1d30f2788601d5
SHA18dc4da8e4efca07472b08b618bc059dcbfd03efa
SHA256f1663cceeb67ba35c5a5cbf58b56050ddbe5ec5680ea9e55837b57524f29b876
SHA51258e6b66d1e6a9858e3b2ff1c90333d804d80a98dad358bb666b0332013c0c0c7444d9cb7297eff3aeee7de66d01b3b180629f1b5258af19165abd5e013574b46
-
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\OmskFilesize
589B
MD5985f599bb4b81c01d5b5d16ad241d5ed
SHA1a90b24a33383273378fc6429b95fdf62c4c2e5d5
SHA25636bce57f9ab26334f370d700cd0a853618cf2051afbe561ba09b0aae5dc371a4
SHA512fd8f3414083a7b4c75e9a5dc043f38db062971dcac022194c274d5f5816867961736dbf0e17b7da19ca9c835f2e11864e0f305895e8c76eee3d0c5ecdf3e0239
-
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\AdelaideFilesize
1KB
MD50a876dfacfdabc170818581a2e6e6d54
SHA1376fd52e52867f959cb2076fbbc4d214778a7fc0
SHA256e28b98a94e0077340a3aece749f2d400c3f06890cec9447f4c2567bd1e7a5839
SHA512766fb737e92fbd233563887cf8335c9aa4e96d3a970c28b7ddebbd21ca764dc85ee4ebd805538f697ad8b2d59ed0c53bd46d9fb7077d54c136f9c22bedae9cba
-
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+10Filesize
27B
MD565435a5d117aa6b052a5f737d9946a7b
SHA1b8b17ad613463c3c9a1fe928819fb30cb853e6b1
SHA256ea49aa9f6f6cf2d53d454e628ba5a339cc000230c4651655d0237711d747f50b
SHA5124f85061ef6c66bf0e030af017af8c7154ed3f7953594ae2cf6f663e8b95ba978a54c171b01f212880e2711c2fd745a12b959ed27e7f6b1847273f70a4010ccde
-
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\BougainvilleFilesize
85B
MD5eeb20c9bc165677800b6dc7621a50cc9
SHA1def5026103297fa44a2185104f2ee400cb93329c
SHA2566a3a9301bb8dd782bb5c170bedfa73e9e7c60235e6e1840f14bd14b812127ef2
SHA512d4e72f43c75de83deb0526233423726503354d7112618b44c94e695d159a02b6da4823a2c9a2be8cf71d2c7e42108d0db7edbb54a640579f853e6d110e7599ed
-
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\EnderburyFilesize
89B
MD5335a7c8e767a2dd0ecf3460eaabb0bbd
SHA1111ffd83edcb095d251067456a3a60b754b4c717
SHA256a0bf83b3948dce6afe987c170a5cd711a3d65fcd5c70e3b7bbfeeb1578544609
SHA512bf0772423bdc11a4029439acef8922c6c541519ce98bce97681d1a1da32bbf3a73f506138d494d9cc860b6afb3584094565db7683f6b2a2cb30e3e94430d1933
-
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8PDTFilesize
2KB
MD5b8d5d64c3ef0b30644898a80682f5121
SHA1bbc7b3902250307a2cdbb314abe98e34795032be
SHA2562f329134686a44ee0362fd0c8b5d071e38bade32a5389e31282f64f565e76759
SHA512f1f90923769648e585f3f38724d203e4bf6a10cab7c6708f7791a83dd6348b3b9948eaf481baa7bef31ff63d75b6fe1ec00cb888dc1acc8b65b90d96bff39638
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.infFilesize
57B
MD5ab9d8ef2ffa9145d6c325cefa41d5d4e
SHA10f2bf6d5e1a0209d19f8f6e7d08b3e2d9cf4c5ab
SHA25665a16cb7861335d5ace3c60718b5052e44660726da4cd13bb745381b235a1785
SHA512904f1892ec5c43c557199325fda79cacaee2e8f1b4a1d41b85c893d967c3209f0c58081c0c9a6083f85fd4866611dfeb490c11f3163c12f4f0579adda2c68100
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MFFilesize
133B
MD5b85026155b964b6f3a883c9a8b62dfe3
SHA15c38290813cd155c68773c19b0dd5371b7b1c337
SHA25657ffc9ca3beb6ee6226c28248ab9c77b2076ef6acffba839cec21fac28a8fd1f
SHA512c6953aea1f31da67d3ac33171617e01252672932a6e6eae0382e68fa9048b0e78871b68467945c6b940f1ea6e815231e0c95fbe97090b53bf2181681ecf6c2dd