phorphiex | 4b332741c9b18814b397445cf93d10515ca4d2b95fde05686e6583a42de37fc3

General

Target

85b28f9c06352d426df83b6f25a957f3_JaffaCakes118.exe
Size

451KB
MD5

85b28f9c06352d426df83b6f25a957f3
SHA1

d11ed3bee7fef2d60b6de1fbc539ef4d2c9265e9
SHA256

4b332741c9b18814b397445cf93d10515ca4d2b95fde05686e6583a42de37fc3
SHA512

370361dc0fee6f1aeea25fc1af732d4971ee1aee6d7de188c01b587c3135f0801b88ae6258ada95a397ecbc3bfa9b2087728bf5887580b0c41656c0b044e5435
SSDEEP

12288:wtQsjr1agUc7iGBDZyRrvgpTsdiIhSSyE/24v99P:a9jrQQuGirgp4diIhiPmH

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

Wallets

0xAa3ea4838e8E3F6a1922c6B67E3cD6efD1ff175b

THRUoPK7oYqF7YyKZJvPYwTH35JsPZVPto

1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6

qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut

XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL

LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX

rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH

ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ

48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg

3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC

3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3

D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH

t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn

bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd

bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg

bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut

GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE

Signatures

Phorphiex
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Phorphiex payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\685720135.exe	family_phorphiex

Windows security bypass 2 TTPs 18 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

sylsplvc.exe685720135.exe299315072.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	685720135.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	685720135.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	685720135.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	299315072.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	299315072.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	299315072.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	685720135.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	685720135.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	685720135.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	299315072.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	299315072.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	299315072.exe

Downloads MZ/PE file
Executes dropped EXE 6 IoCs

Processes:

36DF.exesylsplvc.exe685720135.exe299315072.exe2819721746.exe2625612144.exe

pid process

3812 36DF.exe
3248 sylsplvc.exe
1048 685720135.exe
4484 299315072.exe
4344 2819721746.exe
4508 2625612144.exe

pid	process
3812	36DF.exe
3248	sylsplvc.exe
1048	685720135.exe
4484	299315072.exe
4344	2819721746.exe
4508	2625612144.exe

Windows security modification 2 TTPs 21 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

685720135.exe299315072.exesylsplvc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	685720135.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	685720135.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	299315072.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	299315072.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	685720135.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	299315072.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	299315072.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	685720135.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	299315072.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	299315072.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	685720135.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	685720135.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sylsplvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	685720135.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	299315072.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

299315072.exe36DF.exe685720135.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Users\\Admin\\sysdinrdvs.exe"	299315072.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sylsplvc.exe"	36DF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Windows\\winknavrso.exe"	685720135.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Users\\Admin\\winknavrso.exe"	685720135.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysdinrdvs.exe"	299315072.exe

Drops file in Windows directory 6 IoCs

Processes:

299315072.exe36DF.exe685720135.exe

description	ioc	process
File opened for modification	C:\Windows\sysdinrdvs.exe	299315072.exe
File created	C:\Windows\sylsplvc.exe	36DF.exe
File opened for modification	C:\Windows\sylsplvc.exe	36DF.exe
File created	C:\Windows\winknavrso.exe	685720135.exe
File opened for modification	C:\Windows\winknavrso.exe	685720135.exe
File created	C:\Windows\sysdinrdvs.exe	299315072.exe

Suspicious behavior: SetClipboardViewer 2 IoCs

Processes:

685720135.exe299315072.exe

pid process

1048 685720135.exe
4484 299315072.exe

pid	process
1048	685720135.exe
4484	299315072.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

85b28f9c06352d426df83b6f25a957f3_JaffaCakes118.exe36DF.exesylsplvc.exe299315072.exe

description	pid	process	target process
PID 4896 wrote to memory of 3812	4896	85b28f9c06352d426df83b6f25a957f3_JaffaCakes118.exe	36DF.exe
PID 4896 wrote to memory of 3812	4896	85b28f9c06352d426df83b6f25a957f3_JaffaCakes118.exe	36DF.exe
PID 4896 wrote to memory of 3812	4896	85b28f9c06352d426df83b6f25a957f3_JaffaCakes118.exe	36DF.exe
PID 3812 wrote to memory of 3248	3812	36DF.exe	sylsplvc.exe
PID 3812 wrote to memory of 3248	3812	36DF.exe	sylsplvc.exe
PID 3812 wrote to memory of 3248	3812	36DF.exe	sylsplvc.exe
PID 3248 wrote to memory of 1048	3248	sylsplvc.exe	685720135.exe
PID 3248 wrote to memory of 1048	3248	sylsplvc.exe	685720135.exe
PID 3248 wrote to memory of 1048	3248	sylsplvc.exe	685720135.exe
PID 3248 wrote to memory of 4484	3248	sylsplvc.exe	299315072.exe
PID 3248 wrote to memory of 4484	3248	sylsplvc.exe	299315072.exe
PID 3248 wrote to memory of 4484	3248	sylsplvc.exe	299315072.exe
PID 4484 wrote to memory of 4344	4484	299315072.exe	2819721746.exe
PID 4484 wrote to memory of 4344	4484	299315072.exe	2819721746.exe
PID 4484 wrote to memory of 4344	4484	299315072.exe	2819721746.exe
PID 4484 wrote to memory of 4508	4484	299315072.exe	2625612144.exe
PID 4484 wrote to memory of 4508	4484	299315072.exe	2625612144.exe
PID 4484 wrote to memory of 4508	4484	299315072.exe	2625612144.exe

C:\Users\Admin\AppData\Local\Temp\85b28f9c06352d426df83b6f25a957f3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\85b28f9c06352d426df83b6f25a957f3_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4896

C:\Users\Admin\AppData\Local\Temp\36DF.exe
"C:\Users\Admin\AppData\Local\Temp\36DF.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3812

C:\Windows\sylsplvc.exe
C:\Windows\sylsplvc.exe
3⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:3248

C:\Users\Admin\AppData\Local\Temp\685720135.exe
C:\Users\Admin\AppData\Local\Temp\685720135.exe
4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: SetClipboardViewer
PID:1048

C:\Users\Admin\AppData\Local\Temp\299315072.exe
C:\Users\Admin\AppData\Local\Temp\299315072.exe
4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: SetClipboardViewer
- Suspicious use of WriteProcessMemory
PID:4484

C:\Users\Admin\AppData\Local\Temp\2819721746.exe
C:\Users\Admin\AppData\Local\Temp\2819721746.exe
5⤵
- Executes dropped EXE
PID:4344

C:\Users\Admin\AppData\Local\Temp\2625612144.exe
C:\Users\Admin\AppData\Local\Temp\2625612144.exe
5⤵
- Executes dropped EXE
PID:4508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0ZA3FRO8\2[1]
Filesize
84KB

MD5
b464b1ac75172e05db725d17b9bb9044

SHA1
cc8689ef9f70be7210520bd68b9767e3c6f1e363

SHA256
c1b2b4d052f98028e6b32955ed052881591bbaa57f11279b7745cc26566f8268

SHA512
9adab953f44c68cd0eb37873a51d18827a06bf4d99d4d354053e16bd4c3bb272b9c9290cc4190919f9d89bfe6d304546ddffc460f8ee2ed8e75a9bd3e13294e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J3U83TL1\1[1]
Filesize
23KB

MD5
07d8d1886e9515653645a06317888a14

SHA1
50efdfb1b292bb28b9177e19e898d8b4ec59ec09

SHA256
4ecc3858eb5f437af29b9a7ed8fce1b2b6650573f06df09e551e77b1e599195b

SHA512
09d51a4ddb2d7e772547f5af7987cbd79c907b5cdcb13e6e3562d81a1a097c3a38f9f1b7c6b98ca81687990dcefdccb2b025ce2b253981dd94ecb554184e6894

Download Submit
C:\Users\Admin\AppData\Local\Temp\299315072.exe
Filesize
84KB

MD5
41d55c23d79fc0c0c322db16c6ce6af8

SHA1
e4bbdf2a983a11975a7ab6dcba41cb60676ec780

SHA256
93f3f99a6d6dc69b907a3da8596bd850c1e3ce53be9bf1c6edfdb00e90579e6f

SHA512
06680eb47802659dc2e28cd9a839052a8536112056db49f7179f1b53cf2dba0e9cfd9d8bbdeb446ecb8a2f4a58f7b0f100d0526660d4afd8540a4db091cf621f

Download Submit
C:\Users\Admin\AppData\Local\Temp\36DF.exe
Filesize
79KB

MD5
1e8a2ed2e3f35620fb6b8c2a782a57f3

SHA1
e924ce6d147ecc8b30b7c7cad02e5c9ae09a743a

SHA256
3f16f4550826076b2c8cd7b392ee649aeb06740328658a2d30c3d2002c6b7879

SHA512
ce4dc7fdd7f81a7a127d650f9175292b287b4803d815d74b64a4e5125cff66224d75e7ecade1d9c0e42f870bdb49a78e9613b1a49675ab5bc098611b99b49ade

Download Submit
C:\Users\Admin\AppData\Local\Temp\685720135.exe
Filesize
23KB

MD5
9d2b22562b9a3958dfd7e6e6fa7bd66f

SHA1
1941c24958ac09cf518f4124225b2d0b5d874cf0

SHA256
84daa9d52f759af343741880a3b66a3abb886310de7f552743d99e69741c6450

SHA512
8c0b54e01f62207edaaf8f967fe83eacd3e278660c1764feb3fde68bfd376ba875012849f969d8b5922bd6b791a231bf75dc76eade227e2fd25f4791163d9dd1

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads