Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
17-04-2024 15:36
General
-
Target
2024-04-17_8e4ab089f8ee00854a714b627482e8b7_phobos.exe
-
Size
56KB
-
MD5
8e4ab089f8ee00854a714b627482e8b7
-
SHA1
992055ecd82ec51f9d5693dc2bfe83801df2dfc6
-
SHA256
16ed08cf0be590a0cf11648f1efee344cb49fdb4df1278a4277976d857823df3
-
SHA512
668a460e191ceba91e340937085fbbbecd78d89e12f5bdccd185535ca80ba182c41eac191e57884bd2a5c37234f9d29a302c40c1a57203fc3d3b9f5cd94a4754
-
SSDEEP
1536:ANeRBl5PT/rx1mzwRMSTdLpJkxhGQj+EAh4ymMG:AQRrmzwR5J3Q6EAO
Malware Config
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Renames multiple (72) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
-
Drops startup file 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 4 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 47 IoCs
-
Suspicious use of WriteProcessMemory 29 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-17_8e4ab089f8ee00854a714b627482e8b7_phobos.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-17_8e4ab089f8ee00854a714b627482e8b7_phobos.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-04-17_8e4ab089f8ee00854a714b627482e8b7_phobos.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-17_8e4ab089f8ee00854a714b627482e8b7_phobos.exe"2⤵
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23.5MB
MD5ca6c77f334857a3fa5c4598782aa2b3a
SHA1fdb95fb5152368acb26f2c729472da90a176d22b
SHA25620e0b9cad737307a4fa75f345f144e76aa451f56e5f84bf976e72ab0b94b3097
SHA5124938f9a716ac21f29367764eba6fdd0c5f893894f2be32f4df0d3eac6d624e73ee02c4009d04cc3008af9ad22f4a8c5e101722aa89c73a2bfd039c042a933f3a
-
Filesize
549B
MD5db10fd32bfe67918ed177579d4be9d76
SHA144ecf4c5a6fbbd1ace84d0efe91f13d6ba6bb738
SHA256c936ab1da7ef4314182c8edabaeae90f8d51ed45bc48848d35670adf5b470d31
SHA512bb574ef876e7529d4f3c4c52cc54aa1814f2c02030b83a5bd7223d4b31c992668c00e4a7e68d4f1caaa6493db4ac84eb649fe59e98feceb9828119cac1e74b05
-
Filesize
77B
MD52b62a30906a2b8bf3b68abd2ef9d105b
SHA19898d25a214dba04ebd7e3030ac9e2e90ea7a369
SHA256075561eff2cd3ad586776fa904f0040282c5f6a261f6a8fd6a0a524d14cd2d2c
SHA5126db5955477a9bb5386c1af03df526496f9e64533e6c3071c8e5c44062541e91e9bb39096da947a91bdfa5e7de53c1e047dcf427c1dfde94554d7458f8f0862ea
-
Filesize
65B
MD51ef5e829303a139ce967440e0cdca10c
SHA1f0fa45906bd0f4c3668fcd0d8f68d4b298b30e5b
SHA25698ce42deef51d40269d542f5314bef2c7468d401ad5d85168bfab4c0108f75f7
SHA51219dc6ae12de08b21b36c1ec7f353ce9e7cef73fa4d1354c436234167f0847bc9e2b85e2f36208f773ef324e2d79e6af1beca4470e44b8672b47d077efe33a1f8
-
Filesize
1KB
MD571c7e24524aea1022361143d0a876c84
SHA1b141efff466f27664599dd2aa91f0b7c50736f1d
SHA25607a692cc9bc920ef8caed75ba9af60ad2d6b144c83bfde3b91a77b5bcce277a3
SHA5124cd51849de464e0139ce77de3003af1ab1b6c639862fb7d5e8362f33ef0a9828f8af9ebd6d4b4ce9dc5a67084bc5c1106fd3b3327fc428e25c75b780e98d37ff
-
Filesize
153B
MD5d13b5ffdeb538f15ee1d30f2788601d5
SHA18dc4da8e4efca07472b08b618bc059dcbfd03efa
SHA256f1663cceeb67ba35c5a5cbf58b56050ddbe5ec5680ea9e55837b57524f29b876
SHA51258e6b66d1e6a9858e3b2ff1c90333d804d80a98dad358bb666b0332013c0c0c7444d9cb7297eff3aeee7de66d01b3b180629f1b5258af19165abd5e013574b46
-
Filesize
589B
MD5985f599bb4b81c01d5b5d16ad241d5ed
SHA1a90b24a33383273378fc6429b95fdf62c4c2e5d5
SHA25636bce57f9ab26334f370d700cd0a853618cf2051afbe561ba09b0aae5dc371a4
SHA512fd8f3414083a7b4c75e9a5dc043f38db062971dcac022194c274d5f5816867961736dbf0e17b7da19ca9c835f2e11864e0f305895e8c76eee3d0c5ecdf3e0239
-
Filesize
1KB
MD50a876dfacfdabc170818581a2e6e6d54
SHA1376fd52e52867f959cb2076fbbc4d214778a7fc0
SHA256e28b98a94e0077340a3aece749f2d400c3f06890cec9447f4c2567bd1e7a5839
SHA512766fb737e92fbd233563887cf8335c9aa4e96d3a970c28b7ddebbd21ca764dc85ee4ebd805538f697ad8b2d59ed0c53bd46d9fb7077d54c136f9c22bedae9cba
-
Filesize
27B
MD565435a5d117aa6b052a5f737d9946a7b
SHA1b8b17ad613463c3c9a1fe928819fb30cb853e6b1
SHA256ea49aa9f6f6cf2d53d454e628ba5a339cc000230c4651655d0237711d747f50b
SHA5124f85061ef6c66bf0e030af017af8c7154ed3f7953594ae2cf6f663e8b95ba978a54c171b01f212880e2711c2fd745a12b959ed27e7f6b1847273f70a4010ccde
-
Filesize
85B
MD5eeb20c9bc165677800b6dc7621a50cc9
SHA1def5026103297fa44a2185104f2ee400cb93329c
SHA2566a3a9301bb8dd782bb5c170bedfa73e9e7c60235e6e1840f14bd14b812127ef2
SHA512d4e72f43c75de83deb0526233423726503354d7112618b44c94e695d159a02b6da4823a2c9a2be8cf71d2c7e42108d0db7edbb54a640579f853e6d110e7599ed
-
Filesize
89B
MD5335a7c8e767a2dd0ecf3460eaabb0bbd
SHA1111ffd83edcb095d251067456a3a60b754b4c717
SHA256a0bf83b3948dce6afe987c170a5cd711a3d65fcd5c70e3b7bbfeeb1578544609
SHA512bf0772423bdc11a4029439acef8922c6c541519ce98bce97681d1a1da32bbf3a73f506138d494d9cc860b6afb3584094565db7683f6b2a2cb30e3e94430d1933
-
Filesize
2KB
MD5b8d5d64c3ef0b30644898a80682f5121
SHA1bbc7b3902250307a2cdbb314abe98e34795032be
SHA2562f329134686a44ee0362fd0c8b5d071e38bade32a5389e31282f64f565e76759
SHA512f1f90923769648e585f3f38724d203e4bf6a10cab7c6708f7791a83dd6348b3b9948eaf481baa7bef31ff63d75b6fe1ec00cb888dc1acc8b65b90d96bff39638
-
Filesize
57B
MD5ab9d8ef2ffa9145d6c325cefa41d5d4e
SHA10f2bf6d5e1a0209d19f8f6e7d08b3e2d9cf4c5ab
SHA25665a16cb7861335d5ace3c60718b5052e44660726da4cd13bb745381b235a1785
SHA512904f1892ec5c43c557199325fda79cacaee2e8f1b4a1d41b85c893d967c3209f0c58081c0c9a6083f85fd4866611dfeb490c11f3163c12f4f0579adda2c68100
-
Filesize
133B
MD5b85026155b964b6f3a883c9a8b62dfe3
SHA15c38290813cd155c68773c19b0dd5371b7b1c337
SHA25657ffc9ca3beb6ee6226c28248ab9c77b2076ef6acffba839cec21fac28a8fd1f
SHA512c6953aea1f31da67d3ac33171617e01252672932a6e6eae0382e68fa9048b0e78871b68467945c6b940f1ea6e815231e0c95fbe97090b53bf2181681ecf6c2dd
-
Filesize
138B
MD5a2bb242dc046bacdc58e7fbbe03cce85
SHA1052ab788f1646b958e0ea2c0ef47d00141fc1004
SHA256486a8212c0d6860840d883981ca52daaad3bf3b2ab5be56cdc47ed9b42daba22
SHA512d9bb4c0658f79fbcf22697c24bc32f4ef27ddf934e8f41cf73a2990d18cdb38379f6b61e50edef8ebdf5a2f59a0f8fa40e000b24f1c55a06cfa161db658326ad
-
Filesize
453B
MD5118db038cff249fc1b96f7a8f2b27620
SHA16f804438c7a4af3c57191138510a644d24bde92b
SHA2568d43407158818d7f3e03cc0a6ae6d789e9e393467ba847a998214eb4e292b989
SHA5124ee3a5d2c49d50ecd97193828389d3339661f90d8b8d41bea5fc4ffedb26578c738016fc772217f3f5049adadcf744273f6b9f60ba379a8e39fc60188be5dde5
-
Filesize
437B
MD5ceb1e6764a28b208d51a7801052118d7
SHA12719eea8bde44ff35dd7b274df167c103483b895
SHA25699d48b66d590c07b14f4cd68adac79e92616afcf00503a846b6bf4599bfeabc0
SHA512f4a2df6229bca6c6ef9ef9f432847683238715eddcb1f89c291da5f5900c9a3461204d8495c3450c8bae1c1a661424089554d316468ba1b039a2c50d6e69bf29
-
Filesize
431B
MD52c16868331f82ff43059dcb0ea178af3
SHA1983589535e05c495ffeae4b0b31ddcfafe92a763
SHA256be9ceb4464b22203feffd3700c5570b7d6d44c5d0d357148e1e6d5be5e694376
SHA512184653d3e40df84cd0052e5d9477201f276ce0e8cbb5e4b7bfac86fc7da325eef476982910be24c20725a6db6617fffd88998d6053c1b694718bc7ab0bde9ea1
-
Filesize
411B
MD5f7c78514872f9cb5585f8d69532cd2d0
SHA1ff9dfbb62a3b48c85b6434ee831fb33a8dba9526
SHA2565f7bcd85900e62abb00ce739eaad53d80170a4a6152d951b6825110d2fc17965
SHA51250ee6ae916ea0e806b73c2e5bb727f6ee4837a696c5bd8559ede78148b40a5d5cdd135e28c8b5153a8fef568fd21ef0708ca198ace89e7120ffb84fd9bc91c01
-
Filesize
1KB
MD58b550761ab80413c9c09f7fb472dbfaf
SHA167122822562203c17dd3f762194e470f90ddfa97
SHA256f5ea79165516de2e7e1efb53d016983f5d18c3184413f044a4002f4b751c918b
SHA5129546013cf4d45a2c4c609524b7ed4adecc7dc2fecded7c3b7085415a1bcd1c25db5d88bb591ac05fa5a6313763a8e8d5d8fc6ee6610b454cf7696b647e7781fe
