phorphiex | 50cc1437b22ae5b3fdf4ee19967b1f3478a42022ece7517e2441cfb57d784bb1

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2024 10:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50cc1437b22ae5b3fdf4ee19967b1f3478a42022ece7517e2441cfb57d784bb1.exe
Size

62KB
MD5

9a8acd4b7119f050506bcaf22e4ddcb9
SHA1

d2a450504119fd5d5d54d925f5e1799e320e2c33
SHA256

50cc1437b22ae5b3fdf4ee19967b1f3478a42022ece7517e2441cfb57d784bb1
SHA512

c0cb3e704016376316ffe459595b07f13d3dea53b117845dd3c752c88a3d03829aacb695b589385e809fcecea0987f3c2a09295aaaae7e55a53f97a9ba0a8668
SSDEEP

1536:IzQjJuw3c6hqh1kJaJrNKx5tzzevaCpzqFFzWcXdqu7mOYhngYFD:eQduF60Q0X036aCBqXcY6tgYFD

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Signatures

Phorphiex payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1684-0-0x0000000000400000-0x0000000000419000-memory.dmp	family_phorphiex
behavioral2/memory/1684-4-0x0000000000400000-0x0000000000419000-memory.dmp	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

50cc1437b22ae5b3fdf4ee19967b1f3478a42022ece7517e2441cfb57d784bb1.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	50cc1437b22ae5b3fdf4ee19967b1f3478a42022ece7517e2441cfb57d784bb1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	50cc1437b22ae5b3fdf4ee19967b1f3478a42022ece7517e2441cfb57d784bb1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	50cc1437b22ae5b3fdf4ee19967b1f3478a42022ece7517e2441cfb57d784bb1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	50cc1437b22ae5b3fdf4ee19967b1f3478a42022ece7517e2441cfb57d784bb1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	50cc1437b22ae5b3fdf4ee19967b1f3478a42022ece7517e2441cfb57d784bb1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	50cc1437b22ae5b3fdf4ee19967b1f3478a42022ece7517e2441cfb57d784bb1.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

50cc1437b22ae5b3fdf4ee19967b1f3478a42022ece7517e2441cfb57d784bb1.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	50cc1437b22ae5b3fdf4ee19967b1f3478a42022ece7517e2441cfb57d784bb1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	50cc1437b22ae5b3fdf4ee19967b1f3478a42022ece7517e2441cfb57d784bb1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	50cc1437b22ae5b3fdf4ee19967b1f3478a42022ece7517e2441cfb57d784bb1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	50cc1437b22ae5b3fdf4ee19967b1f3478a42022ece7517e2441cfb57d784bb1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	50cc1437b22ae5b3fdf4ee19967b1f3478a42022ece7517e2441cfb57d784bb1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	50cc1437b22ae5b3fdf4ee19967b1f3478a42022ece7517e2441cfb57d784bb1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	50cc1437b22ae5b3fdf4ee19967b1f3478a42022ece7517e2441cfb57d784bb1.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

50cc1437b22ae5b3fdf4ee19967b1f3478a42022ece7517e2441cfb57d784bb1.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Update Service = "C:\\Users\\Admin\\winupdsvcs.exe"	50cc1437b22ae5b3fdf4ee19967b1f3478a42022ece7517e2441cfb57d784bb1.exe

C:\Users\Admin\AppData\Local\Temp\50cc1437b22ae5b3fdf4ee19967b1f3478a42022ece7517e2441cfb57d784bb1.exe
"C:\Users\Admin\AppData\Local\Temp\50cc1437b22ae5b3fdf4ee19967b1f3478a42022ece7517e2441cfb57d784bb1.exe"
1⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
PID:1684

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1684-4-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download