Resubmissions
18-04-2024 11:51
240418-n1frmscd22 1018-04-2024 11:51
240418-n1dmaadd8y 1018-04-2024 11:51
240418-n1cpzscc95 1018-04-2024 11:51
240418-n1b4fscc92 1018-04-2024 11:51
240418-n1a66acc85 1018-04-2024 10:01
240418-l19nlsbb31 10Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
18-04-2024 11:51
Behavioral task
behavioral1
Sample
714787dde305a03fe0bf0fe87923f814db1736fdfbb4ad38ec95536f152abfb2.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
714787dde305a03fe0bf0fe87923f814db1736fdfbb4ad38ec95536f152abfb2.exe
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
714787dde305a03fe0bf0fe87923f814db1736fdfbb4ad38ec95536f152abfb2.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
714787dde305a03fe0bf0fe87923f814db1736fdfbb4ad38ec95536f152abfb2.exe
Resource
win10v2004-20240226-en
General
-
Target
714787dde305a03fe0bf0fe87923f814db1736fdfbb4ad38ec95536f152abfb2.exe
-
Size
100KB
-
MD5
a8f401d424c87dbff0dd679c792f8cb0
-
SHA1
b1413e3019c6c201288a238191e5c4baa329b749
-
SHA256
714787dde305a03fe0bf0fe87923f814db1736fdfbb4ad38ec95536f152abfb2
-
SHA512
ab61d78dd7c2979ed97af85ab62f43cd34043e2a31821185c8c09622d6d8d39598813059d775c2195b9c3d03439a29cf261578555d9e86071a90ac048a2f9f31
-
SSDEEP
3072:zhmiYp+ZDI5/azNzMzCnd1B2KkhKQciyY4N6lPxbAFS8CF5:dmiYMluaNzMzCnt2KkhKQciyY4N6dxso
Malware Config
Extracted
phorphiex
http://185.215.113.66/
0xAa3ea4838e8E3F6a1922c6B67E3cD6efD1ff175b
THRUoPK7oYqF7YyKZJvPYwTH35JsPZVPto
1Hw9tx4KyTq4oRoLVhPb4hjDJcLhEa4Tn6
qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
XtxFdsKkRN3oVDXtN2ipcHeNi87basT2sL
LXMNcn9D8FQKzGNLjdSyR9dEM8Rsh9NzyX
rwn7tb5KQjXEjH42GgdHWHec5PPhVgqhSH
ARML6g7zynrwUHJbFJCCzMPiysUFXYBGgQ
48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg
3PL7YCa4akNYzuScqQwiSbtTP9q9E9PLreC
3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3
D9AJWrbYsidS9rAU146ifLRu1fzX9oQYSH
t1gvVWHnjbGTsoWXEyoTFojc2GqEzBgvbEn
bnb1cgttf7t5hu7ud3c436ufhcmy59qnkd09adqczd
bc1q0fusmmgycnhsd5cadsuz2hk8d4maausjfjypqg
bitcoincash:qr89hag2967ef604ud3lw4pq8hmn69n46czwdnx3ut
GAUCC7ZBSU2KJMHXOZD6AP5LOBGKNDPCDNRYP2CO2ACR63YCSUBNT5QE
Signatures
-
Modifies security service 2 TTPs 1 IoCs
Processes:
60322071.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4" 60322071.exe -
Phorphiex payload 1 IoCs
Processes:
resource yara_rule C:\29054243829258\dwm.exe family_phorphiex -
Processes:
60322071.exesylsplvc.exedwm.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 60322071.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 60322071.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 60322071.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" dwm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" dwm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" dwm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" dwm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 60322071.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 60322071.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" dwm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" dwm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 60322071.exe -
Executes dropped EXE 4 IoCs
Processes:
dwm.exe3034717148.exesylsplvc.exe60322071.exepid process 1944 dwm.exe 2532 3034717148.exe 1348 sylsplvc.exe 4804 60322071.exe -
Processes:
dwm.exe60322071.exesylsplvc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" dwm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" dwm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 60322071.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" dwm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" dwm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 60322071.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" 60322071.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" dwm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" dwm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" dwm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 60322071.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 60322071.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 60322071.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" sylsplvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 60322071.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
60322071.exe714787dde305a03fe0bf0fe87923f814db1736fdfbb4ad38ec95536f152abfb2.exe3034717148.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysvpplvcr.exe" 60322071.exe Set value (str) \REGISTRY\USER\S-1-5-21-2516240262-2296879883-3965305654-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Users\\Admin\\sysvpplvcr.exe" 60322071.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Desktop Window Manager = "C:\\29054243829258\\dwm.exe" 714787dde305a03fe0bf0fe87923f814db1736fdfbb4ad38ec95536f152abfb2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2516240262-2296879883-3965305654-1000\Software\Microsoft\Windows\CurrentVersion\Run\Desktop Window Manager = "C:\\29054243829258\\dwm.exe" 714787dde305a03fe0bf0fe87923f814db1736fdfbb4ad38ec95536f152abfb2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sylsplvc.exe" 3034717148.exe -
Drops file in Windows directory 4 IoCs
Processes:
3034717148.exe60322071.exedescription ioc process File created C:\Windows\sylsplvc.exe 3034717148.exe File opened for modification C:\Windows\sylsplvc.exe 3034717148.exe File created C:\Windows\sysvpplvcr.exe 60322071.exe File opened for modification C:\Windows\sysvpplvcr.exe 60322071.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
Processes:
60322071.exepid process 4804 60322071.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
714787dde305a03fe0bf0fe87923f814db1736fdfbb4ad38ec95536f152abfb2.exedwm.exe3034717148.exesylsplvc.exedescription pid process target process PID 540 wrote to memory of 1944 540 714787dde305a03fe0bf0fe87923f814db1736fdfbb4ad38ec95536f152abfb2.exe dwm.exe PID 540 wrote to memory of 1944 540 714787dde305a03fe0bf0fe87923f814db1736fdfbb4ad38ec95536f152abfb2.exe dwm.exe PID 540 wrote to memory of 1944 540 714787dde305a03fe0bf0fe87923f814db1736fdfbb4ad38ec95536f152abfb2.exe dwm.exe PID 1944 wrote to memory of 2532 1944 dwm.exe 3034717148.exe PID 1944 wrote to memory of 2532 1944 dwm.exe 3034717148.exe PID 1944 wrote to memory of 2532 1944 dwm.exe 3034717148.exe PID 2532 wrote to memory of 1348 2532 3034717148.exe sylsplvc.exe PID 2532 wrote to memory of 1348 2532 3034717148.exe sylsplvc.exe PID 2532 wrote to memory of 1348 2532 3034717148.exe sylsplvc.exe PID 1348 wrote to memory of 4804 1348 sylsplvc.exe 60322071.exe PID 1348 wrote to memory of 4804 1348 sylsplvc.exe 60322071.exe PID 1348 wrote to memory of 4804 1348 sylsplvc.exe 60322071.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\714787dde305a03fe0bf0fe87923f814db1736fdfbb4ad38ec95536f152abfb2.exe"C:\Users\Admin\AppData\Local\Temp\714787dde305a03fe0bf0fe87923f814db1736fdfbb4ad38ec95536f152abfb2.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\29054243829258\dwm.exeC:\29054243829258\dwm.exe2⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3034717148.exeC:\Users\Admin\AppData\Local\Temp\3034717148.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\sylsplvc.exeC:\Windows\sylsplvc.exe4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\60322071.exeC:\Users\Admin\AppData\Local\Temp\60322071.exe5⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: SetClipboardViewer
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\29054243829258\dwm.exeFilesize
100KB
MD5a8f401d424c87dbff0dd679c792f8cb0
SHA1b1413e3019c6c201288a238191e5c4baa329b749
SHA256714787dde305a03fe0bf0fe87923f814db1736fdfbb4ad38ec95536f152abfb2
SHA512ab61d78dd7c2979ed97af85ab62f43cd34043e2a31821185c8c09622d6d8d39598813059d775c2195b9c3d03439a29cf261578555d9e86071a90ac048a2f9f31
-
C:\Users\Admin\AppData\Local\Temp\3034717148.exeFilesize
79KB
MD51e8a2ed2e3f35620fb6b8c2a782a57f3
SHA1e924ce6d147ecc8b30b7c7cad02e5c9ae09a743a
SHA2563f16f4550826076b2c8cd7b392ee649aeb06740328658a2d30c3d2002c6b7879
SHA512ce4dc7fdd7f81a7a127d650f9175292b287b4803d815d74b64a4e5125cff66224d75e7ecade1d9c0e42f870bdb49a78e9613b1a49675ab5bc098611b99b49ade
-
C:\Users\Admin\AppData\Local\Temp\60322071.exeFilesize
81KB
MD5f4713c8ac5fc1e4919156157e7bece19
SHA17bd9e35b1d1210183bbb4fe1995895cbc1692c62
SHA2562be2206e079516c8cfa50bbc86f8a431898aa90dd73f7cfc6af1d21573247c4b
SHA512ecff8f3af212f444b5f44fd3bfd922556a49b9156fd7a20e13ebc60b4abe08b9d193a49556d4a8e776ef8083db77ab9667ec537dd44f863719e83cb3899cb46f