Analysis
-
max time kernel
37s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-04-2024 03:41
Static task
static1
Behavioral task
behavioral1
Sample
c6345103a35d24c7d95125242dc80f1acf8147b8bacf264f35c13c50b0774dd1.exe
Resource
win7-20240221-en
General
-
Target
c6345103a35d24c7d95125242dc80f1acf8147b8bacf264f35c13c50b0774dd1.exe
-
Size
25KB
-
MD5
3c9ec41a12836d639bf41bbeaa9605bf
-
SHA1
7f9850219d7cc8ce2bc135da51d98128fd909834
-
SHA256
c6345103a35d24c7d95125242dc80f1acf8147b8bacf264f35c13c50b0774dd1
-
SHA512
9cff60e3ab3a6abf8fcbdaa94f72aef722eb6bcb00b0d2d85b1500da798c7e33dd5a781bd6477c00e31ce194a1299286c4810ced810053489cf6ef99c519ebbd
-
SSDEEP
384:jjwIUV+B6zzmgXddjyEk5dTx1jk5av8U9cNpIP:LgHp2EKd/sa0UfP
Malware Config
Extracted
phorphiex
http://185.215.113.66/
0xCa90599132C4D88907Bd8E046540284aa468a035
TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6
qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
XryzFMFVpDUvU7famUGf214EXD3xNUSmQf
LLeT2zkStY3cvxMBFhoWXkG5VuZPoezduv
rwc4LVd9ABpULQ1CuCpDkgX2xVB1fUijyb
48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg
15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC
17hgMFyLDwMjxWqw5GhijhnPdJDyFDqecY
ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp
3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc
3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3
DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA
t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh
stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj
bnb1epx67ne4vckqmaj4gwke8m322f4yjr6eh52wqw
bc1qmpkehfffkr6phuklsksnd7nhgx0369sxu772m3
bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3
Signatures
-
Modifies security service 2 TTPs 1 IoCs
Processes:
799618997.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" 799618997.exe -
Processes:
799618997.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 799618997.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 799618997.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 799618997.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 799618997.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" 799618997.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 799618997.exe -
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
Processes:
7781.exe799618997.exe1435924182.exe1463415357.exe115217638.exepid process 2668 7781.exe 2700 799618997.exe 788 1435924182.exe 2604 1463415357.exe 1052 115217638.exe -
Loads dropped DLL 6 IoCs
Processes:
c6345103a35d24c7d95125242dc80f1acf8147b8bacf264f35c13c50b0774dd1.exe7781.exe799618997.exepid process 2660 c6345103a35d24c7d95125242dc80f1acf8147b8bacf264f35c13c50b0774dd1.exe 2668 7781.exe 2668 7781.exe 2700 799618997.exe 2700 799618997.exe 2700 799618997.exe -
Processes:
799618997.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 799618997.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 799618997.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 799618997.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" 799618997.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 799618997.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 799618997.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" 799618997.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
799618997.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\systrvltns.exe" 799618997.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Users\\Admin\\systrvltns.exe" 799618997.exe -
Drops file in Windows directory 2 IoCs
Processes:
799618997.exedescription ioc process File created C:\Windows\systrvltns.exe 799618997.exe File opened for modification C:\Windows\systrvltns.exe 799618997.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
c6345103a35d24c7d95125242dc80f1acf8147b8bacf264f35c13c50b0774dd1.exe7781.exe799618997.exedescription pid process target process PID 2660 wrote to memory of 2668 2660 c6345103a35d24c7d95125242dc80f1acf8147b8bacf264f35c13c50b0774dd1.exe 7781.exe PID 2660 wrote to memory of 2668 2660 c6345103a35d24c7d95125242dc80f1acf8147b8bacf264f35c13c50b0774dd1.exe 7781.exe PID 2660 wrote to memory of 2668 2660 c6345103a35d24c7d95125242dc80f1acf8147b8bacf264f35c13c50b0774dd1.exe 7781.exe PID 2660 wrote to memory of 2668 2660 c6345103a35d24c7d95125242dc80f1acf8147b8bacf264f35c13c50b0774dd1.exe 7781.exe PID 2668 wrote to memory of 2700 2668 7781.exe 799618997.exe PID 2668 wrote to memory of 2700 2668 7781.exe 799618997.exe PID 2668 wrote to memory of 2700 2668 7781.exe 799618997.exe PID 2668 wrote to memory of 2700 2668 7781.exe 799618997.exe PID 2700 wrote to memory of 788 2700 799618997.exe 1435924182.exe PID 2700 wrote to memory of 788 2700 799618997.exe 1435924182.exe PID 2700 wrote to memory of 788 2700 799618997.exe 1435924182.exe PID 2700 wrote to memory of 788 2700 799618997.exe 1435924182.exe PID 2700 wrote to memory of 2604 2700 799618997.exe 1463415357.exe PID 2700 wrote to memory of 2604 2700 799618997.exe 1463415357.exe PID 2700 wrote to memory of 2604 2700 799618997.exe 1463415357.exe PID 2700 wrote to memory of 2604 2700 799618997.exe 1463415357.exe PID 2700 wrote to memory of 1052 2700 799618997.exe 115217638.exe PID 2700 wrote to memory of 1052 2700 799618997.exe 115217638.exe PID 2700 wrote to memory of 1052 2700 799618997.exe 115217638.exe PID 2700 wrote to memory of 1052 2700 799618997.exe 115217638.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6345103a35d24c7d95125242dc80f1acf8147b8bacf264f35c13c50b0774dd1.exe"C:\Users\Admin\AppData\Local\Temp\c6345103a35d24c7d95125242dc80f1acf8147b8bacf264f35c13c50b0774dd1.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7781.exe"C:\Users\Admin\AppData\Local\Temp\7781.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\799618997.exeC:\Users\Admin\AppData\Local\Temp\799618997.exe3⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1435924182.exeC:\Users\Admin\AppData\Local\Temp\1435924182.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1463415357.exeC:\Users\Admin\AppData\Local\Temp\1463415357.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\115217638.exeC:\Users\Admin\AppData\Local\Temp\115217638.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\2369810443.exeC:\Users\Admin\AppData\Local\Temp\2369810443.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\2157920043.exeC:\Users\Admin\AppData\Local\Temp\2157920043.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\240372026.exeC:\Users\Admin\AppData\Local\Temp\240372026.exe4⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9M0HR0P6\3[1]Filesize
8KB
MD53ff539a40348bc9538fe5aa7bc8a5f90
SHA12be2a53f3dccab031a2a1b75e5e7720b01090d9f
SHA256c0f2e629bb66e02826f90b4b3cc0cbf0ced13b0bfa75bb85a7f7bf54b884d9db
SHA512fc7d650cfdec82ac836765e2357a27b4bc4b56605e756eeb20707a7d5dd0c3fdd6225c6ef6b25d83138f5f9199f4f49c619c18365053648bab331bd94cfc322b
-
\Users\Admin\AppData\Local\Temp\1435924182.exeFilesize
8KB
MD51f67e154ee8f9cb2372ca55ad3b686a4
SHA1e5bab1de98ce0cf50662879f1d471c044df4ba56
SHA256cca1aaba753027dd75974fcfeda7921c75ba5df3026eba32749c2328778ec32f
SHA5125b004e534502a9b18e0db449b5233e6076a720cd36b0756a531295eb52c00678ee193ed5b8d42e05819fca24a06cb92f29526e8ea12d840299a2d7951541c1a5
-
\Users\Admin\AppData\Local\Temp\2157920043.exeFilesize
21KB
MD57d9dc721e4c9a9b8446680c38fa05aa0
SHA1369918d1b61732afaf681d5aacbd6084b619fcfe
SHA256ccaa697d2cec06fe87e2800ef282bbdd85d59647910914645eaca9cf38f801c4
SHA51259ed84f40b480579f2a37bebdf4ceec89f5167507197c8afff61b808dbdb2f5d50723a842253b83269e30d3626525c461350a11fcc2db6d4c4329541d1b95d34
-
\Users\Admin\AppData\Local\Temp\2369810443.exeFilesize
14KB
MD5f1de323203015e6d6b88037061440c3f
SHA1d5dade311a734838078895ca14332a5bebc35422
SHA256b891ef7526290c5c64a24627cdfaab792493b8b7d3c39ce05ee35b5dc5a22f8a
SHA512d68d116b787e643c15ebbe0317f39b00897bf24683592e95bcff712f3d1560aec5abb7633b58f5a6184faf6dfc589f0e56f811ae9aee40521e0a8dcbf0756708
-
\Users\Admin\AppData\Local\Temp\7781.exeFilesize
9KB
MD562b97cf4c0abafeda36e3fc101a5a022
SHA1328fae9acff3f17df6e9dc8d6ef1cec679d4eb2b
SHA256e172537adcee1fcdc8f16c23e43a5ac82c56a0347fa0197c08be979438a534ab
SHA51232bd7062aabd25205471cec8d292b820fc2fd2479da6fb723332887fc47036570bb2d25829acb7c883ccaaab272828c8effbc78f02a3deeabb47656f4b64eb24
-
\Users\Admin\AppData\Local\Temp\799618997.exeFilesize
89KB
MD51fc572a5f87e088c94099b27308be46e
SHA14332ffb3d6deff6bbf8949e4a6a8a3de4ce3bbe1
SHA25662942deb42d82e02e4c32a8ab377eb034d2124eb527ff14a9e60dc24b03cb3da
SHA512fa54590ba38cac9ff18b074bc55671ac1086c76cb03db42871d2a6086df99a7ab49f505eee45dfefc033b222e10f829adf22b45408913835aafa253eef7eeaeb