Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2024 00:06
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe
-
Size
56KB
-
MD5
b9901d7f5cba3befab569d78accba5dc
-
SHA1
2ff292445144613ffcc9f9fbc9506278db730fb7
-
SHA256
ed9a2b4e0a7e81b8b671a797dc499d8eb112bf42500551607a5d454056e1cdd2
-
SHA512
2d222f1852b3ec8269256d46a61012d86afce22cf55261207ab7cd52ffb5ddf6b404a321c68341a90d8f3d6e572797f440f2341fd48ff2acb1f9ba058170c501
-
SSDEEP
1536:oNeRBl5PT/rx1mzwRMSTdLpJ5+z5ZPDEW6:oQRrmzwR5JMz5ZP
Malware Config
Extracted
C:\info.hta
http://www.w3.org/TR/html4/strict.dtd'>
https://pidgin.im/download/windows/</li>
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
Processes:
bcdedit.exebcdedit.exebcdedit.exebcdedit.exepid process 4520 bcdedit.exe 2168 bcdedit.exe 3180 bcdedit.exe 4656 bcdedit.exe -
Renames multiple (520) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
wbadmin.exewbadmin.exepid process 4516 wbadmin.exe 4308 wbadmin.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 2284 netsh.exe 1616 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe -
Drops startup file 3 IoCs
Processes:
2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[8F45EA37-3540].[[email protected]].faust 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos = "C:\\Users\\Admin\\AppData\\Local\\2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe" 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos = "C:\\Users\\Admin\\AppData\\Local\\2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe" 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exedescription ioc process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Public\Music\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files (x86)\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2860750803-256193626-1801997576-1000\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Public\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2860750803-256193626-1801997576-1000\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe -
Drops file in Program Files directory 64 IoCs
Processes:
2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exedescription ioc process File opened for modification C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\resources.pri 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Video_Msg_Record.m4a 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\Info.png 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jce.jar 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms.id[8F45EA37-3540].[[email protected]].faust 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-phn.xrm-ms 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\SplashScreen.scale-100.png 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\resources.f74ef681.pri 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\cstm_brand_preview.png 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationProvider.resources.dll.id[8F45EA37-3540].[[email protected]].faust 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Primitives.resources.dll.id[8F45EA37-3540].[[email protected]].faust 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.106\dxil.dll.id[8F45EA37-3540].[[email protected]].faust 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-pl.xrm-ms.id[8F45EA37-3540].[[email protected]].faust 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Paint_PDP.xml 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\appstore.png.id[8F45EA37-3540].[[email protected]].faust 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationProvider.resources.dll.id[8F45EA37-3540].[[email protected]].faust 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filterselected-down_32.svg.id[8F45EA37-3540].[[email protected]].faust 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File created C:\Program Files\Mozilla Firefox\browser\crashreporter-override.ini.id[8F45EA37-3540].[[email protected]].faust 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\main.css 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirect3d11_plugin.dll.id[8F45EA37-3540].[[email protected]].faust 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_reject_18.svg.id[8F45EA37-3540].[[email protected]].faust 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\Confirmation.png.id[8F45EA37-3540].[[email protected]].faust 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Mu\Analytics.DATA 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderSplashScreen.contrast-black_scale-200.png 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookWideTile.scale-100.png 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-GoogleCloudCacheMini.scale-150.png 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-pl.xrm-ms.id[8F45EA37-3540].[[email protected]].faust 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeMediumTile.scale-400.png 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\java.settings.cfg 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.SystemEvents.dll.id[8F45EA37-3540].[[email protected]].faust 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-time-l1-1-0.dll.id[8F45EA37-3540].[[email protected]].faust 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\Windows Defender\uk-UA\OfflineScannerShell.exe.mui 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ppd.xrm-ms.id[8F45EA37-3540].[[email protected]].faust 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\PlayStore_icon.svg 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hu-hu\ui-strings.js 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ul-oob.xrm-ms.id[8F45EA37-3540].[[email protected]].faust 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-20_altform-lightunplated.png 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.scale-100.png 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon_hover.png.id[8F45EA37-3540].[[email protected]].faust 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\TinyTile.scale-200_contrast-white.png 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\close.svg.id[8F45EA37-3540].[[email protected]].faust 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.id[8F45EA37-3540].[[email protected]].faust 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\WideTile.scale-100_contrast-black.png 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\A3DUtils.dll 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\it-it\ui-strings.js 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClient.resources.dll.id[8F45EA37-3540].[[email protected]].faust 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordcnvpxy.cnv 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll.id[8F45EA37-3540].[[email protected]].faust 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-72_contrast-white.png 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Design.resources.dll.id[8F45EA37-3540].[[email protected]].faust 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\Microsoft.VisualBasic.Forms.resources.dll 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-20.png 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filter-dark-disabled_32.svg.id[8F45EA37-3540].[[email protected]].faust 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ul-oob.xrm-ms.id[8F45EA37-3540].[[email protected]].faust 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\de-de\ui-strings.js.id[8F45EA37-3540].[[email protected]].faust 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ui-strings.js.id[8F45EA37-3540].[[email protected]].faust 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_transcode_plugin.dll 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vds.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 756 vssadmin.exe 2812 vssadmin.exe -
Modifies registry class 1 IoCs
Processes:
2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000_Classes\Local Settings 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exepid process 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exevssvc.exeWMIC.exewbengine.exeWMIC.exedescription pid process Token: SeDebugPrivilege 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe Token: SeBackupPrivilege 1300 vssvc.exe Token: SeRestorePrivilege 1300 vssvc.exe Token: SeAuditPrivilege 1300 vssvc.exe Token: SeIncreaseQuotaPrivilege 1072 WMIC.exe Token: SeSecurityPrivilege 1072 WMIC.exe Token: SeTakeOwnershipPrivilege 1072 WMIC.exe Token: SeLoadDriverPrivilege 1072 WMIC.exe Token: SeSystemProfilePrivilege 1072 WMIC.exe Token: SeSystemtimePrivilege 1072 WMIC.exe Token: SeProfSingleProcessPrivilege 1072 WMIC.exe Token: SeIncBasePriorityPrivilege 1072 WMIC.exe Token: SeCreatePagefilePrivilege 1072 WMIC.exe Token: SeBackupPrivilege 1072 WMIC.exe Token: SeRestorePrivilege 1072 WMIC.exe Token: SeShutdownPrivilege 1072 WMIC.exe Token: SeDebugPrivilege 1072 WMIC.exe Token: SeSystemEnvironmentPrivilege 1072 WMIC.exe Token: SeRemoteShutdownPrivilege 1072 WMIC.exe Token: SeUndockPrivilege 1072 WMIC.exe Token: SeManageVolumePrivilege 1072 WMIC.exe Token: 33 1072 WMIC.exe Token: 34 1072 WMIC.exe Token: 35 1072 WMIC.exe Token: 36 1072 WMIC.exe Token: SeIncreaseQuotaPrivilege 1072 WMIC.exe Token: SeSecurityPrivilege 1072 WMIC.exe Token: SeTakeOwnershipPrivilege 1072 WMIC.exe Token: SeLoadDriverPrivilege 1072 WMIC.exe Token: SeSystemProfilePrivilege 1072 WMIC.exe Token: SeSystemtimePrivilege 1072 WMIC.exe Token: SeProfSingleProcessPrivilege 1072 WMIC.exe Token: SeIncBasePriorityPrivilege 1072 WMIC.exe Token: SeCreatePagefilePrivilege 1072 WMIC.exe Token: SeBackupPrivilege 1072 WMIC.exe Token: SeRestorePrivilege 1072 WMIC.exe Token: SeShutdownPrivilege 1072 WMIC.exe Token: SeDebugPrivilege 1072 WMIC.exe Token: SeSystemEnvironmentPrivilege 1072 WMIC.exe Token: SeRemoteShutdownPrivilege 1072 WMIC.exe Token: SeUndockPrivilege 1072 WMIC.exe Token: SeManageVolumePrivilege 1072 WMIC.exe Token: 33 1072 WMIC.exe Token: 34 1072 WMIC.exe Token: 35 1072 WMIC.exe Token: 36 1072 WMIC.exe Token: SeBackupPrivilege 4944 wbengine.exe Token: SeRestorePrivilege 4944 wbengine.exe Token: SeSecurityPrivilege 4944 wbengine.exe Token: SeIncreaseQuotaPrivilege 1248 WMIC.exe Token: SeSecurityPrivilege 1248 WMIC.exe Token: SeTakeOwnershipPrivilege 1248 WMIC.exe Token: SeLoadDriverPrivilege 1248 WMIC.exe Token: SeSystemProfilePrivilege 1248 WMIC.exe Token: SeSystemtimePrivilege 1248 WMIC.exe Token: SeProfSingleProcessPrivilege 1248 WMIC.exe Token: SeIncBasePriorityPrivilege 1248 WMIC.exe Token: SeCreatePagefilePrivilege 1248 WMIC.exe Token: SeBackupPrivilege 1248 WMIC.exe Token: SeRestorePrivilege 1248 WMIC.exe Token: SeShutdownPrivilege 1248 WMIC.exe Token: SeDebugPrivilege 1248 WMIC.exe Token: SeSystemEnvironmentPrivilege 1248 WMIC.exe Token: SeRemoteShutdownPrivilege 1248 WMIC.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.execmd.execmd.execmd.exedescription pid process target process PID 1492 wrote to memory of 3432 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe cmd.exe PID 1492 wrote to memory of 3432 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe cmd.exe PID 1492 wrote to memory of 3436 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe cmd.exe PID 1492 wrote to memory of 3436 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe cmd.exe PID 3432 wrote to memory of 2812 3432 cmd.exe vssadmin.exe PID 3432 wrote to memory of 2812 3432 cmd.exe vssadmin.exe PID 3436 wrote to memory of 2284 3436 cmd.exe netsh.exe PID 3436 wrote to memory of 2284 3436 cmd.exe netsh.exe PID 3436 wrote to memory of 1616 3436 cmd.exe netsh.exe PID 3436 wrote to memory of 1616 3436 cmd.exe netsh.exe PID 3432 wrote to memory of 1072 3432 cmd.exe WMIC.exe PID 3432 wrote to memory of 1072 3432 cmd.exe WMIC.exe PID 3432 wrote to memory of 4520 3432 cmd.exe bcdedit.exe PID 3432 wrote to memory of 4520 3432 cmd.exe bcdedit.exe PID 3432 wrote to memory of 2168 3432 cmd.exe bcdedit.exe PID 3432 wrote to memory of 2168 3432 cmd.exe bcdedit.exe PID 3432 wrote to memory of 4516 3432 cmd.exe wbadmin.exe PID 3432 wrote to memory of 4516 3432 cmd.exe wbadmin.exe PID 1492 wrote to memory of 4380 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe mshta.exe PID 1492 wrote to memory of 4380 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe mshta.exe PID 1492 wrote to memory of 4380 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe mshta.exe PID 1492 wrote to memory of 1444 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe mshta.exe PID 1492 wrote to memory of 1444 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe mshta.exe PID 1492 wrote to memory of 1444 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe mshta.exe PID 1492 wrote to memory of 4140 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe mshta.exe PID 1492 wrote to memory of 4140 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe mshta.exe PID 1492 wrote to memory of 4140 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe mshta.exe PID 1492 wrote to memory of 1824 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe mshta.exe PID 1492 wrote to memory of 1824 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe mshta.exe PID 1492 wrote to memory of 1824 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe mshta.exe PID 1492 wrote to memory of 1080 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe cmd.exe PID 1492 wrote to memory of 1080 1492 2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe cmd.exe PID 1080 wrote to memory of 756 1080 cmd.exe vssadmin.exe PID 1080 wrote to memory of 756 1080 cmd.exe vssadmin.exe PID 1080 wrote to memory of 1248 1080 cmd.exe WMIC.exe PID 1080 wrote to memory of 1248 1080 cmd.exe WMIC.exe PID 1080 wrote to memory of 3180 1080 cmd.exe bcdedit.exe PID 1080 wrote to memory of 3180 1080 cmd.exe bcdedit.exe PID 1080 wrote to memory of 4656 1080 cmd.exe bcdedit.exe PID 1080 wrote to memory of 4656 1080 cmd.exe bcdedit.exe PID 1080 wrote to memory of 4308 1080 cmd.exe wbadmin.exe PID 1080 wrote to memory of 4308 1080 cmd.exe wbadmin.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-06_b9901d7f5cba3befab569d78accba5dc_phobos.exe"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Indicator Removal
3File Deletion
3Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id[8F45EA37-3540].[[email protected]].faustFilesize
2.7MB
MD52f95f2b0c3af85ca0ab6a554f388ed60
SHA1da8b578d5c66eadecd839422b4f66c8a840c8b0a
SHA256c8a60fd2e85206a5bad74b2a4245e07bd4f26ec89fd21e44d8ba0777696e3000
SHA5121b873a22870703457812caddc518260d3c50a7be2c80ee73fa8e498980e295a0ab88d91fd4a1d9ef2b7c87a2a2f37db755d5a066c1294b69c5f98afb098ceb6f
-
C:\info.htaFilesize
6KB
MD581e15f4bfaba8522336d77f33ede096d
SHA1453ed863618b453d7e77607a2717bfb7264c1fe8
SHA25699ace72b7388c7b5fd88761da076c01a041482525b83166107484c71aadfe3a1
SHA512db756bcf77b472462d24225aefe72bfde7aab06ffe5a90258ad34fb5ce2f5a21260697096352c9b31fa93f06d3941869404b031ce649b2e0b6776f04fd196f25