phorphiex | 7f99d6f0dd72b4b86fa136ed7771fd55dd6b40e8f890d61b90d8a88d117c9858

General

Target

97fdb440587ae6f237203b2e0338a550_JaffaCakes118.exe
Size

77KB
MD5

97fdb440587ae6f237203b2e0338a550
SHA1

a8613ac0c99ea6d5073d7474b278794b50f30b24
SHA256

7f99d6f0dd72b4b86fa136ed7771fd55dd6b40e8f890d61b90d8a88d117c9858
SHA512

e9e339b95128af836f286fbce08f92ee20f492f4d669c1194c8eecaf86b62a9740301714a20c05a70c0b1d8b31119bff120e2146b19906183706783bee0633aa
SSDEEP

768:Nl92s8vjKGxEFVz7PP/UBV7VWzFYIH4Q:bsswjK3Vz7PPXzFLY

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Extracted

Family

phorphiex

C2

http://worm.ws/

http://feuhdeuhduhuehdr.ws/

http://feauhueudughuurr.ws/

http://fheuhdwdzwgzdggr.ws/

http://faugzeazdezgzgfr.ws/

http://wduufbaueeubffgr.ws/

http://okdoekeoehghaoer.ws/

http://efuheruhdehduhgr.ws/

http://eafueudzefverrgr.ws/

http://deauduafzgezzfgr.ws/

http://gaueudbuwdbuguur.ws/

http://efeuafubeubaefur.ws/

http://eafuebdbedbedggr.ws/

http://wdkowdohwodhfhfr.ws/

http://efaeduvedvzfufur.ws/

http://edhuaudhuedugufr.ws/

http://eaffuebudbeudbbr.ws/

http://seuufhehfueughel.to/

http://feuhdeuhduhuehdl.to/

http://feauhueudughuurl.to/

Wallets

19KXPyopGnfZ1dGjLpPPqbo7Jpqki9A9mW

3NShfYPbqkPmPkXEgJ1SGUYgSjxt1Robhs

bc1qf4awd7k76q0tks25ax7q48wmsvslvy64er6n6w

qqe5entlms8sudv7a60dnu5gpttlukmspuk5zxsahe

XjgwEqD6iFf5pHxqSzj4tm8mgs7TsS2kEw

DHvsojZJPxoYYwtVw7voSuv2ga5LGoQpG1

0xA557fe5c21325eB8f6C7d5f2004Db988c8C8D8B5

LYr5qEmeAcpv7JeCEE2HfGPV74DZLYHeT2

42TCgxVg6itTv4v8dvyCQEETmHL5N6i8a8rvcqGWb2QtWUrBpq3SdDnZbhpcg2S3UbNG98Woi6KEH7dWtpnEHQrDEzQbENy

rDs45wyGR5E6sHajNGHeNqvjvXaCJrJ22j

TY59jfEA2xQBk4R8AAJG3tBGQybMm1aSba

t1NBaHW8QgULABaASvzNALmxem8EutnxLtr

GDR62FPKRATKXTLSR3JDCVGDAVF6YC5RVZ2RQ55SNW6C2UWND3KGUHPW

P44ZCLTNESUGZESVC3QMK6LSFY7LYW3N23FKX56UMCEXK6NZBG3BUNPDWI

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36

Signatures

Phorphiex payload 1 IoCs

Processes:

resource	yara_rule
\147152847921720\svchost.exe	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	svchost.exe

Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

2588 svchost.exe
Loads dropped DLL 1 IoCs

Processes:

97fdb440587ae6f237203b2e0338a550_JaffaCakes118.exe

pid process

2356 97fdb440587ae6f237203b2e0338a550_JaffaCakes118.exe

pid	process
2588	svchost.exe

pid	process
2356	97fdb440587ae6f237203b2e0338a550_JaffaCakes118.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

97fdb440587ae6f237203b2e0338a550_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\147152847921720\\svchost.exe"	97fdb440587ae6f237203b2e0338a550_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\147152847921720\\svchost.exe"	97fdb440587ae6f237203b2e0338a550_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

97fdb440587ae6f237203b2e0338a550_JaffaCakes118.exe

description	pid	process	target process
PID 2356 wrote to memory of 2588	2356	97fdb440587ae6f237203b2e0338a550_JaffaCakes118.exe	svchost.exe
PID 2356 wrote to memory of 2588	2356	97fdb440587ae6f237203b2e0338a550_JaffaCakes118.exe	svchost.exe
PID 2356 wrote to memory of 2588	2356	97fdb440587ae6f237203b2e0338a550_JaffaCakes118.exe	svchost.exe
PID 2356 wrote to memory of 2588	2356	97fdb440587ae6f237203b2e0338a550_JaffaCakes118.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\97fdb440587ae6f237203b2e0338a550_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\97fdb440587ae6f237203b2e0338a550_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2356
- C:\147152847921720\svchost.exe
  C:\147152847921720\svchost.exe
  2⤵
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\147152847921720\svchost.exe

Filesize
77KB

MD5
97fdb440587ae6f237203b2e0338a550

SHA1
a8613ac0c99ea6d5073d7474b278794b50f30b24

SHA256
7f99d6f0dd72b4b86fa136ed7771fd55dd6b40e8f890d61b90d8a88d117c9858

SHA512
e9e339b95128af836f286fbce08f92ee20f492f4d669c1194c8eecaf86b62a9740301714a20c05a70c0b1d8b31119bff120e2146b19906183706783bee0633aa

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads