Resubmissions
09-04-2024 12:52
240409-p4kqfaaf9y 1009-04-2024 12:52
240409-p35zzsaf81 1009-04-2024 12:52
240409-p35dfsfd58 1009-04-2024 12:52
240409-p343paaf8z 1014-05-2021 19:03
210514-4yv41mgcte 10Analysis
-
max time kernel
153s -
max time network
161s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
14-04-2024 08:58
Behavioral task
behavioral1
Sample
4c80e5212c71b86274b03c7e90df62a6.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4c80e5212c71b86274b03c7e90df62a6.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
4c80e5212c71b86274b03c7e90df62a6.exe
Resource
win10v2004-20240412-en
General
-
Target
4c80e5212c71b86274b03c7e90df62a6.exe
-
Size
100KB
-
MD5
4c80e5212c71b86274b03c7e90df62a6
-
SHA1
27fb49e915fba0537c26f2e3643c8ed079cd5e45
-
SHA256
552ac0917f936b6075b045c778da6f150cde88ebd89c8dd98ab8d0f2bf6a9e17
-
SHA512
4135fc58ae7e2b6ad2ca82d955d2028f12dcdb97ac8388811f5e7687b0fa8e1845f383862ba2afd1170c1832f47536c615c4817ead432e2773fe0d18b4684453
-
SSDEEP
3072:/3G8xswGZTYJWTbJPjMdhS3kxi/jrKwcNHjo86r8wLFS85F:/G8xo1qupjMrS3kxi/jrKwcNHjo86r8Q
Malware Config
Signatures
-
Phorphiex payload 1 IoCs
Processes:
resource yara_rule C:\1302358811081\wininet.exe family_phorphiex -
Processes:
wininet.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" wininet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" wininet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" wininet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" wininet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" wininet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" wininet.exe -
Executes dropped EXE 1 IoCs
Processes:
wininet.exepid process 1776 wininet.exe -
Processes:
wininet.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" wininet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" wininet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" wininet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" wininet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" wininet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" wininet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" wininet.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
4c80e5212c71b86274b03c7e90df62a6.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\1302358811081\\wininet.exe" 4c80e5212c71b86274b03c7e90df62a6.exe Set value (str) \REGISTRY\USER\S-1-5-21-825860316-2493133627-3905166409-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\1302358811081\\wininet.exe" 4c80e5212c71b86274b03c7e90df62a6.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
4c80e5212c71b86274b03c7e90df62a6.exedescription pid process target process PID 3984 wrote to memory of 1776 3984 4c80e5212c71b86274b03c7e90df62a6.exe wininet.exe PID 3984 wrote to memory of 1776 3984 4c80e5212c71b86274b03c7e90df62a6.exe wininet.exe PID 3984 wrote to memory of 1776 3984 4c80e5212c71b86274b03c7e90df62a6.exe wininet.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c80e5212c71b86274b03c7e90df62a6.exe"C:\Users\Admin\AppData\Local\Temp\4c80e5212c71b86274b03c7e90df62a6.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\1302358811081\wininet.exeC:\1302358811081\wininet.exe2⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\1302358811081\wininet.exeFilesize
100KB
MD54c80e5212c71b86274b03c7e90df62a6
SHA127fb49e915fba0537c26f2e3643c8ed079cd5e45
SHA256552ac0917f936b6075b045c778da6f150cde88ebd89c8dd98ab8d0f2bf6a9e17
SHA5124135fc58ae7e2b6ad2ca82d955d2028f12dcdb97ac8388811f5e7687b0fa8e1845f383862ba2afd1170c1832f47536c615c4817ead432e2773fe0d18b4684453