phorphiex | 7f99d6f0dd72b4b86fa136ed7771fd55dd6b40e8f890d61b90d8a88d117c9858

General

Target

97fdb440587ae6f237203b2e0338a550_JaffaCakes118.exe
Size

77KB
MD5

97fdb440587ae6f237203b2e0338a550
SHA1

a8613ac0c99ea6d5073d7474b278794b50f30b24
SHA256

7f99d6f0dd72b4b86fa136ed7771fd55dd6b40e8f890d61b90d8a88d117c9858
SHA512

e9e339b95128af836f286fbce08f92ee20f492f4d669c1194c8eecaf86b62a9740301714a20c05a70c0b1d8b31119bff120e2146b19906183706783bee0633aa
SSDEEP

768:Nl92s8vjKGxEFVz7PP/UBV7VWzFYIH4Q:bsswjK3Vz7PPXzFLY

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Extracted

Family

phorphiex

C2

http://worm.ws/

http://feuhdeuhduhuehdr.ws/

http://feauhueudughuurr.ws/

http://fheuhdwdzwgzdggr.ws/

http://faugzeazdezgzgfr.ws/

http://wduufbaueeubffgr.ws/

http://okdoekeoehghaoer.ws/

http://efuheruhdehduhgr.ws/

http://eafueudzefverrgr.ws/

http://deauduafzgezzfgr.ws/

http://gaueudbuwdbuguur.ws/

http://efeuafubeubaefur.ws/

http://eafuebdbedbedggr.ws/

http://wdkowdohwodhfhfr.ws/

http://efaeduvedvzfufur.ws/

http://edhuaudhuedugufr.ws/

http://eaffuebudbeudbbr.ws/

http://seuufhehfueughel.to/

http://feuhdeuhduhuehdl.to/

http://feauhueudughuurl.to/

Wallets

19KXPyopGnfZ1dGjLpPPqbo7Jpqki9A9mW

3NShfYPbqkPmPkXEgJ1SGUYgSjxt1Robhs

bc1qf4awd7k76q0tks25ax7q48wmsvslvy64er6n6w

qqe5entlms8sudv7a60dnu5gpttlukmspuk5zxsahe

XjgwEqD6iFf5pHxqSzj4tm8mgs7TsS2kEw

DHvsojZJPxoYYwtVw7voSuv2ga5LGoQpG1

0xA557fe5c21325eB8f6C7d5f2004Db988c8C8D8B5

LYr5qEmeAcpv7JeCEE2HfGPV74DZLYHeT2

42TCgxVg6itTv4v8dvyCQEETmHL5N6i8a8rvcqGWb2QtWUrBpq3SdDnZbhpcg2S3UbNG98Woi6KEH7dWtpnEHQrDEzQbENy

rDs45wyGR5E6sHajNGHeNqvjvXaCJrJ22j

TY59jfEA2xQBk4R8AAJG3tBGQybMm1aSba

t1NBaHW8QgULABaASvzNALmxem8EutnxLtr

GDR62FPKRATKXTLSR3JDCVGDAVF6YC5RVZ2RQ55SNW6C2UWND3KGUHPW

P44ZCLTNESUGZESVC3QMK6LSFY7LYW3N23FKX56UMCEXK6NZBG3BUNPDWI

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36

Signatures

Phorphiex payload 1 IoCs

Processes:

resource	yara_rule
C:\12133283562725\svchost.exe	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	svchost.exe

Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

2036 svchost.exe

pid	process
2036	svchost.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

97fdb440587ae6f237203b2e0338a550_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\12133283562725\\svchost.exe"	97fdb440587ae6f237203b2e0338a550_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\12133283562725\\svchost.exe"	97fdb440587ae6f237203b2e0338a550_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

97fdb440587ae6f237203b2e0338a550_JaffaCakes118.exe

description	pid	process	target process
PID 1360 wrote to memory of 2036	1360	97fdb440587ae6f237203b2e0338a550_JaffaCakes118.exe	svchost.exe
PID 1360 wrote to memory of 2036	1360	97fdb440587ae6f237203b2e0338a550_JaffaCakes118.exe	svchost.exe
PID 1360 wrote to memory of 2036	1360	97fdb440587ae6f237203b2e0338a550_JaffaCakes118.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\97fdb440587ae6f237203b2e0338a550_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\97fdb440587ae6f237203b2e0338a550_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1360
- C:\12133283562725\svchost.exe
  C:\12133283562725\svchost.exe
  2⤵
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\12133283562725\svchost.exe

Filesize
77KB

MD5
97fdb440587ae6f237203b2e0338a550

SHA1
a8613ac0c99ea6d5073d7474b278794b50f30b24

SHA256
7f99d6f0dd72b4b86fa136ed7771fd55dd6b40e8f890d61b90d8a88d117c9858

SHA512
e9e339b95128af836f286fbce08f92ee20f492f4d669c1194c8eecaf86b62a9740301714a20c05a70c0b1d8b31119bff120e2146b19906183706783bee0633aa

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads