Overview

overview

10

Static

static

10

067f997e6f...40.exe

windows7-x64

10

0c0c9a19db...c1.exe

windows7-x64

10

1a8f35d0f2...b9.exe

windows7-x64

2354403f00...3b.exe

windows7-x64

240ac12f9c...0b.exe

windows7-x64

10

276727bfac...36.exe

windows7-x64

10

280a75ca5c...8e.exe

windows7-x64

2e8af1ad4b...51.exe

windows7-x64

10

32c51906c1...ec.exe

windows7-x64

3e84def5ee...96.exe

windows7-x64

403b8f1ce9...40.exe

windows7-x64

4731758b5f...25.exe

windows7-x64

9

4c21b335ba...49.exe

windows7-x64

10

4c99ac9f69...35.exe

windows7-x64

4fbbd67a32...a7.exe

windows7-x64

10

622e2834e5...95.exe

windows7-x64

10

6734e7474c...fd.exe

windows7-x64

67a00565a4...5d.exe

windows7-x64

6e228df5e4...62.exe

windows7-x64

7b93299c45...03.exe

windows7-x64

7c2a9bae3b...c1.exe

windows7-x64

10

7d9c97a133...b5.exe

windows7-x64

10

83b294975e...74.exe

windows7-x64

9b0cfabed9...8e.exe

windows7-x64

10

aa63528bf7...cd.exe

windows7-x64

b54d6dc708...7d.exe

windows7-x64

10

b6b2c1f4bb...00.exe

windows7-x64

10

ba43b2eb48...fb.exe

windows7-x64

cc43fc18d6...e8.exe

windows7-x64

10

d50b23e12c...af.exe

windows7-x64

10

ebb17d81ff...0f.exe

windows7-x64

ec09cfa4a7...da.exe

windows7-x64

10

Resubmissions

16-03-2024 17:17

240316-vtswysfd2y 10

16-03-2024 15:31

240316-syg9xafg39 10

15-03-2024 08:15

240315-j5rmgsbg5z 10

Analysis

  • max time kernel
    151s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15-03-2024 08:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d50b23e12c661bb78fa3cb317e679fabc4178600048572368bec173a520e4aaf.exe

  • Size

    55KB

  • MD5

    498ee5cf9c611ba7ed2379414d0bb010

  • SHA1

    c4f779d08633a53e7a03c702eafbe3314055aa18

  • SHA256

    d50b23e12c661bb78fa3cb317e679fabc4178600048572368bec173a520e4aaf

  • SHA512

    8dad911c0b59485dafd6ddcf879774016f8d63690085d4840e422b44735e82140ad177e9e7663b6cc474214461693219142b55e93fd853a593925752fbaa2761

  • SSDEEP

    1536:KNeRBl5PT/rx1mzwRMSTdLpJYXRBawzpK:KQRrmzwR5J4e

Score
10/10
phobosevasionpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Phobos

    Phobos ransomware appeared at the beginning of 2019.

    ransomwarephobos
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (68) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\d50b23e12c661bb78fa3cb317e679fabc4178600048572368bec173a520e4aaf.exe
    "C:\Users\Admin\AppData\Local\Temp\d50b23e12c661bb78fa3cb317e679fabc4178600048572368bec173a520e4aaf.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1244
    • C:\Users\Admin\AppData\Local\Temp\d50b23e12c661bb78fa3cb317e679fabc4178600048572368bec173a520e4aaf.exe
      "C:\Users\Admin\AppData\Local\Temp\d50b23e12c661bb78fa3cb317e679fabc4178600048572368bec173a520e4aaf.exe"
      2⤵
        PID:2360
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2716
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:2540
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1820
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:2392
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled no
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:868
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          3⤵
          • Deletes backup catalog
          PID:2260
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2984
        • C:\Windows\system32\netsh.exe
          netsh advfirewall set currentprofile state off
          3⤵
          • Modifies Windows Firewall
          PID:2604
        • C:\Windows\system32\netsh.exe
          netsh firewall set opmode mode=disable
          3⤵
          • Modifies Windows Firewall
          PID:788
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2916
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2820
    • C:\Windows\System32\vdsldr.exe
      C:\Windows\System32\vdsldr.exe -Embedding
      1⤵
        PID:1408
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
          PID:1936

        Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Defense Evasion

        Impair Defenses

        1
        T1562

        Disable or Modify System Firewall

        1
        T1562.004

        Indicator Removal

        3
        T1070

        File Deletion

        3
        T1070.004

        Modify Registry

        1
        T1112

        Credential Access

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Query Registry

        1
        T1012

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Inhibit System Recovery

        4
        T1490

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.id[3AD934A8-2874].[[email protected]].eking
          Filesize

          21.7MB

          MD5

          2f25cadfb6d1007a244f93e10bb47f01

          SHA1

          30524691adee178376595c438dc0646658999274

          SHA256

          2efec38d3d809dc40a221d3dc9140daaa8dabd1abbce3ee2159a7b3491b474f3

          SHA512

          c47a3cf1d3cff192393db60de75794d4e38916e0edfbe3c227cb0e7478caf3a33fdfb3252d3ae8efa751a5c2492f21f10d0e99f27a3f999b4a6c31d7f98e6eb6

          Download Submit

        • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Rio_Gallegos
          Filesize

          549B

          MD5

          db10fd32bfe67918ed177579d4be9d76

          SHA1

          44ecf4c5a6fbbd1ace84d0efe91f13d6ba6bb738

          SHA256

          c936ab1da7ef4314182c8edabaeae90f8d51ed45bc48848d35670adf5b470d31

          SHA512

          bb574ef876e7529d4f3c4c52cc54aa1814f2c02030b83a5bd7223d4b31c992668c00e4a7e68d4f1caaa6493db4ac84eb649fe59e98feceb9828119cac1e74b05

          Download Submit

        • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Curacao
          Filesize

          77B

          MD5

          2b62a30906a2b8bf3b68abd2ef9d105b

          SHA1

          9898d25a214dba04ebd7e3030ac9e2e90ea7a369

          SHA256

          075561eff2cd3ad586776fa904f0040282c5f6a261f6a8fd6a0a524d14cd2d2c

          SHA512

          6db5955477a9bb5386c1af03df526496f9e64533e6c3071c8e5c44062541e91e9bb39096da947a91bdfa5e7de53c1e047dcf427c1dfde94554d7458f8f0862ea

          Download Submit

        • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guayaquil
          Filesize

          65B

          MD5

          1ef5e829303a139ce967440e0cdca10c

          SHA1

          f0fa45906bd0f4c3668fcd0d8f68d4b298b30e5b

          SHA256

          98ce42deef51d40269d542f5314bef2c7468d401ad5d85168bfab4c0108f75f7

          SHA512

          19dc6ae12de08b21b36c1ec7f353ce9e7cef73fa4d1354c436234167f0847bc9e2b85e2f36208f773ef324e2d79e6af1beca4470e44b8672b47d077efe33a1f8

          Download Submit

        • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tijuana
          Filesize

          1KB

          MD5

          71c7e24524aea1022361143d0a876c84

          SHA1

          b141efff466f27664599dd2aa91f0b7c50736f1d

          SHA256

          07a692cc9bc920ef8caed75ba9af60ad2d6b144c83bfde3b91a77b5bcce277a3

          SHA512

          4cd51849de464e0139ce77de3003af1ab1b6c639862fb7d5e8362f33ef0a9828f8af9ebd6d4b4ce9dc5a67084bc5c1106fd3b3327fc428e25c75b780e98d37ff

          Download Submit

        • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Karachi
          Filesize

          153B

          MD5

          d13b5ffdeb538f15ee1d30f2788601d5

          SHA1

          8dc4da8e4efca07472b08b618bc059dcbfd03efa

          SHA256

          f1663cceeb67ba35c5a5cbf58b56050ddbe5ec5680ea9e55837b57524f29b876

          SHA512

          58e6b66d1e6a9858e3b2ff1c90333d804d80a98dad358bb666b0332013c0c0c7444d9cb7297eff3aeee7de66d01b3b180629f1b5258af19165abd5e013574b46

          Download Submit

        • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Omsk
          Filesize

          589B

          MD5

          985f599bb4b81c01d5b5d16ad241d5ed

          SHA1

          a90b24a33383273378fc6429b95fdf62c4c2e5d5

          SHA256

          36bce57f9ab26334f370d700cd0a853618cf2051afbe561ba09b0aae5dc371a4

          SHA512

          fd8f3414083a7b4c75e9a5dc043f38db062971dcac022194c274d5f5816867961736dbf0e17b7da19ca9c835f2e11864e0f305895e8c76eee3d0c5ecdf3e0239

          Download Submit

        • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Adelaide
          Filesize

          1KB

          MD5

          0a876dfacfdabc170818581a2e6e6d54

          SHA1

          376fd52e52867f959cb2076fbbc4d214778a7fc0

          SHA256

          e28b98a94e0077340a3aece749f2d400c3f06890cec9447f4c2567bd1e7a5839

          SHA512

          766fb737e92fbd233563887cf8335c9aa4e96d3a970c28b7ddebbd21ca764dc85ee4ebd805538f697ad8b2d59ed0c53bd46d9fb7077d54c136f9c22bedae9cba

          Download Submit

        • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+10
          Filesize

          27B

          MD5

          65435a5d117aa6b052a5f737d9946a7b

          SHA1

          b8b17ad613463c3c9a1fe928819fb30cb853e6b1

          SHA256

          ea49aa9f6f6cf2d53d454e628ba5a339cc000230c4651655d0237711d747f50b

          SHA512

          4f85061ef6c66bf0e030af017af8c7154ed3f7953594ae2cf6f663e8b95ba978a54c171b01f212880e2711c2fd745a12b959ed27e7f6b1847273f70a4010ccde

          Download Submit

        • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Bougainville
          Filesize

          85B

          MD5

          eeb20c9bc165677800b6dc7621a50cc9

          SHA1

          def5026103297fa44a2185104f2ee400cb93329c

          SHA256

          6a3a9301bb8dd782bb5c170bedfa73e9e7c60235e6e1840f14bd14b812127ef2

          SHA512

          d4e72f43c75de83deb0526233423726503354d7112618b44c94e695d159a02b6da4823a2c9a2be8cf71d2c7e42108d0db7edbb54a640579f853e6d110e7599ed

          Download Submit

        • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Enderbury
          Filesize

          89B

          MD5

          335a7c8e767a2dd0ecf3460eaabb0bbd

          SHA1

          111ffd83edcb095d251067456a3a60b754b4c717

          SHA256

          a0bf83b3948dce6afe987c170a5cd711a3d65fcd5c70e3b7bbfeeb1578544609

          SHA512

          bf0772423bdc11a4029439acef8922c6c541519ce98bce97681d1a1da32bbf3a73f506138d494d9cc860b6afb3584094565db7683f6b2a2cb30e3e94430d1933

          Download Submit

        • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8PDT
          Filesize

          2KB

          MD5

          b8d5d64c3ef0b30644898a80682f5121

          SHA1

          bbc7b3902250307a2cdbb314abe98e34795032be

          SHA256

          2f329134686a44ee0362fd0c8b5d071e38bade32a5389e31282f64f565e76759

          SHA512

          f1f90923769648e585f3f38724d203e4bf6a10cab7c6708f7791a83dd6348b3b9948eaf481baa7bef31ff63d75b6fe1ec00cb888dc1acc8b65b90d96bff39638

          Download Submit

        • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf
          Filesize

          57B

          MD5

          ab9d8ef2ffa9145d6c325cefa41d5d4e

          SHA1

          0f2bf6d5e1a0209d19f8f6e7d08b3e2d9cf4c5ab

          SHA256

          65a16cb7861335d5ace3c60718b5052e44660726da4cd13bb745381b235a1785

          SHA512

          904f1892ec5c43c557199325fda79cacaee2e8f1b4a1d41b85c893d967c3209f0c58081c0c9a6083f85fd4866611dfeb490c11f3163c12f4f0579adda2c68100

          Download Submit

        • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF
          Filesize

          133B

          MD5

          b85026155b964b6f3a883c9a8b62dfe3

          SHA1

          5c38290813cd155c68773c19b0dd5371b7b1c337

          SHA256

          57ffc9ca3beb6ee6226c28248ab9c77b2076ef6acffba839cec21fac28a8fd1f

          SHA512

          c6953aea1f31da67d3ac33171617e01252672932a6e6eae0382e68fa9048b0e78871b68467945c6b940f1ea6e815231e0c95fbe97090b53bf2181681ecf6c2dd

          Download Submit