Overview

overview

10

Static

static

3

388b85eb5e...18.exe

windows7-x64

10

388b85eb5e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    388b85eb5ecd9320a1064d7074248253_JaffaCakes118

  • Size

    643KB

  • Sample

    240512-gewgmsbc6v

  • MD5

    388b85eb5ecd9320a1064d7074248253

  • SHA1

    f863380c12b20e8a61c506dc02f6861b66093aa4

  • SHA256

    68657be04f5b550fec4671437e5dc5849408eada96f5ff44cb0972b0e28ca5be

  • SHA512

    ed095b0e047aeadf7df97ca8b41807feff70c34e3c256e4cd0336235811fd1102514da133810dd364a4473cb0085cf7f6dce254b5a0b95f254f2728185dcb465

  • SSDEEP

    6144:szEVDCe1/nxlwa7WAj095ZnV/0Aw2zoYOqrW54aUsN4nNkDB8qU9xyuB+B:szUDD/xlwKWA4Vg5q2UsN49qU9KB

Score
10/10
phorphiexevasionloaderpersistencetrojanworm

Malware Config

Extracted

Family

phorphiex

C2

http://88.218.16.27/

http://tldrbox.top/

http://ghiehigeahghehg.ru/

http://aeouhefuehfuehf.ru/

http://uefuueahhfuuaht.ru/

http://afheaufuehafhhg.ru/

http://afaeufuegfugfug.ru/

http://fahfihhefihaehf.ru/

http://fuegufaefuegfgr.ru/

http://feufhuehfhufuhg.ru/

http://efieifihihdihhg.ru/

http://aefihiehfheihfh.ru/

http://aefihaeifhefihh.ru/

http://eafuefiuaihfief.ru/

http://egesgshretteztz.ru/

http://egohoshgsrhoror.ru/

http://eihehgeojfurrie.ru/

http://etehteirhehrihh.ru/

http://wegihwehwhhirht.ru/

http://wiiwurtiwrutiut.ru/
Wallets

1DhR14ZJtGzfdeemj49Jje6D3ZHEZQh6P3

3EzR2S3wTiiyokZE9bvY82FZiPA5m45SAC

qz95vtk4m2rw0lh7dqzlte7yasxrun47svq32p2w08

Xj2wdxqZ1pBadtPkc1mmF24QExHrZASNj6

DDhtw2BZwE12tVyQrrHFWA7u1aeD4bfa58

0xAc9A31bB9E9A3887FfC9513a93dd6da7EC648345

MJU87911Csqcutpza84nEQ2wZNn6X2b7iV

t1Lp6Cy2d63yV5H1n2LQrJwEgLXuVho43PA

Targets

    • Target

      388b85eb5ecd9320a1064d7074248253_JaffaCakes118

    • Size

      643KB

    • MD5

      388b85eb5ecd9320a1064d7074248253

    • SHA1

      f863380c12b20e8a61c506dc02f6861b66093aa4

    • SHA256

      68657be04f5b550fec4671437e5dc5849408eada96f5ff44cb0972b0e28ca5be

    • SHA512

      ed095b0e047aeadf7df97ca8b41807feff70c34e3c256e4cd0336235811fd1102514da133810dd364a4473cb0085cf7f6dce254b5a0b95f254f2728185dcb465

    • SSDEEP

      6144:szEVDCe1/nxlwa7WAj095ZnV/0Aw2zoYOqrW54aUsN4nNkDB8qU9xyuB+B:szUDD/xlwKWA4Vg5q2UsN49qU9KB

    Score
    10/10
    phorphiexevasionloaderpersistencetrojanworm

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Phorphiex

      Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

      wormtrojanloaderphorphiex

    • Phorphiex payload

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

4
T1112

Impair Defenses

3
T1562

Disable or Modify Tools

3
T1562.001

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks