Overview

overview

10

Static

static

10

629fba91ff...18.exe

windows7-x64

10

629fba91ff...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    629fba91ff579f1e890e489a028d7eb1_JaffaCakes118

  • Size

    32KB

  • Sample

    240521-j5vzxaeb73

  • MD5

    629fba91ff579f1e890e489a028d7eb1

  • SHA1

    c6871d6ce30d012e79412761bd6c0c75be37d084

  • SHA256

    6cda2e78e02e7b2d195868d9d47a127e4b7dedd76c95f7f44d5b7fc8ac485078

  • SHA512

    5e5786f841a6581879c929374e848d55525ad73e136fbb8690c5d89587c431ef60c2f666203bb216cd8271fc27274119025e315156cb7b24cf1bb4d59f611183

  • SSDEEP

    384:UOFl9ooXxUDs/uG67GRtA2ZmQF1szUQIENIay2vWpQVGq71BV7ISlDqzhr1zFz:U0l9GDs/uGTNnggERZBV7VWzFDz

Score
10/10
phorphiexevasionloaderpersistencetrojanworm

Malware Config

Extracted

Family

phorphiex

C2

http://worm.ws/

http://seuufhehfueugheh.ws/

http://feuhdeuhduhuehdh.ws/

http://feauhueudughuurh.ws/

http://fheuhdwdzwgzdggh.ws/

http://faugzeazdezgzgfh.ws/

http://wduufbaueeubffgh.ws/

http://okdoekeoehghaoeh.ws/

http://efuheruhdehduhgh.ws/

http://eafueudzefverrgh.ws/

http://deauduafzgezzfgh.ws/

http://gaueudbuwdbuguuh.ws/

http://efeuafubeubaefuh.ws/

http://eafuebdbedbedggh.ws/

http://wdkowdohwodhfhfh.ws/

http://efaeduvedvzfufuh.ws/

http://edhuaudhuedugufh.ws/

http://eaffuebudbeudbbh.ws/

http://seuufhehfueughet.to/

http://feuhdeuhduhuehdt.to/
Wallets

19KXPyopGnfZ1dGjLpPPqbo7Jpqki9A9mW

3NShfYPbqkPmPkXEgJ1SGUYgSjxt1Robhs

bc1qf4awd7k76q0tks25ax7q48wmsvslvy64er6n6w

qqe5entlms8sudv7a60dnu5gpttlukmspuk5zxsahe

XjgwEqD6iFf5pHxqSzj4tm8mgs7TsS2kEw

DHvsojZJPxoYYwtVw7voSuv2ga5LGoQpG1

0xA557fe5c21325eB8f6C7d5f2004Db988c8C8D8B5

LYr5qEmeAcpv7JeCEE2HfGPV74DZLYHeT2

42TCgxVg6itTv4v8dvyCQEETmHL5N6i8a8rvcqGWb2QtWUrBpq3SdDnZbhpcg2S3UbNG98Woi6KEH7dWtpnEHQrDEzQbENy

rDs45wyGR5E6sHajNGHeNqvjvXaCJrJ22j

TY59jfEA2xQBk4R8AAJG3tBGQybMm1aSba

t1NBaHW8QgULABaASvzNALmxem8EutnxLtr

GDR62FPKRATKXTLSR3JDCVGDAVF6YC5RVZ2RQ55SNW6C2UWND3KGUHPW

P44ZCLTNESUGZESVC3QMK6LSFY7LYW3N23FKX56UMCEXK6NZBG3BUNPDWI

Targets

    • Target

      629fba91ff579f1e890e489a028d7eb1_JaffaCakes118

    • Size

      32KB

    • MD5

      629fba91ff579f1e890e489a028d7eb1

    • SHA1

      c6871d6ce30d012e79412761bd6c0c75be37d084

    • SHA256

      6cda2e78e02e7b2d195868d9d47a127e4b7dedd76c95f7f44d5b7fc8ac485078

    • SHA512

      5e5786f841a6581879c929374e848d55525ad73e136fbb8690c5d89587c431ef60c2f666203bb216cd8271fc27274119025e315156cb7b24cf1bb4d59f611183

    • SSDEEP

      384:UOFl9ooXxUDs/uG67GRtA2ZmQF1szUQIENIay2vWpQVGq71BV7ISlDqzhr1zFz:U0l9GDs/uGTNnggERZBV7VWzFDz

    Score
    10/10
    phorphiexevasionloaderpersistencetrojanworm

    • Phorphiex

      Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

      wormtrojanloaderphorphiex

    • Phorphiex payload

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Modify Registry

3
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks