phorphiex | 042fb580d253d7525231cbe7a2fb30f931c8a59bb51115e98fba3fe1d2f48a29

General

Target

e1af1ba1edb943b838456f57bd564d01.exe
Size

105KB
MD5

e1af1ba1edb943b838456f57bd564d01
SHA1

489760f1f57a35591020f1f82e54740d76fa97e7
SHA256

042fb580d253d7525231cbe7a2fb30f931c8a59bb51115e98fba3fe1d2f48a29
SHA512

982417c1f742e2624c1da543058ccb2b3e9b5f46cedcbba242d13717a2f6c56cd186ba186767542bf68e0e38d0894b3ac027874f33f5bd5a94c3dac542916155
SSDEEP

3072:gEbJSw745FIlbt/d6WruEPJZDTS7MJCAc2BEUzWndAstTIgFpW:rbJSgkkcWruEhZDTS7MJCAc2BEUzWndw

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Signatures

Phorphiex
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Phorphiex payload 1 IoCs

Processes:

resource	yara_rule
\2917090593118\lsass.exe	family_phorphiex

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

lsass.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	lsass.exe

Executes dropped EXE 1 IoCs

Processes:

lsass.exe

pid process

2672 lsass.exe
Loads dropped DLL 1 IoCs

Processes:

e1af1ba1edb943b838456f57bd564d01.exe

pid process

2144 e1af1ba1edb943b838456f57bd564d01.exe

pid	process
2672	lsass.exe

pid	process
2144	e1af1ba1edb943b838456f57bd564d01.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

lsass.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	lsass.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

e1af1ba1edb943b838456f57bd564d01.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\2917090593118\\lsass.exe"	e1af1ba1edb943b838456f57bd564d01.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\2917090593118\\lsass.exe"	e1af1ba1edb943b838456f57bd564d01.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e1af1ba1edb943b838456f57bd564d01.exe

description	pid	process	target process
PID 2144 wrote to memory of 2672	2144	e1af1ba1edb943b838456f57bd564d01.exe	lsass.exe
PID 2144 wrote to memory of 2672	2144	e1af1ba1edb943b838456f57bd564d01.exe	lsass.exe
PID 2144 wrote to memory of 2672	2144	e1af1ba1edb943b838456f57bd564d01.exe	lsass.exe
PID 2144 wrote to memory of 2672	2144	e1af1ba1edb943b838456f57bd564d01.exe	lsass.exe

C:\Users\Admin\AppData\Local\Temp\e1af1ba1edb943b838456f57bd564d01.exe
"C:\Users\Admin\AppData\Local\Temp\e1af1ba1edb943b838456f57bd564d01.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2144

C:\2917090593118\lsass.exe
C:\2917090593118\lsass.exe
2⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\2917090593118\lsass.exe
Filesize
105KB

MD5
e1af1ba1edb943b838456f57bd564d01

SHA1
489760f1f57a35591020f1f82e54740d76fa97e7

SHA256
042fb580d253d7525231cbe7a2fb30f931c8a59bb51115e98fba3fe1d2f48a29

SHA512
982417c1f742e2624c1da543058ccb2b3e9b5f46cedcbba242d13717a2f6c56cd186ba186767542bf68e0e38d0894b3ac027874f33f5bd5a94c3dac542916155

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads