General
-
Target
2024-07-02_7b23d3e6e6528012c98dda612c3dc821_phobos
-
Size
58KB
-
Sample
240702-y5nyxs1gln
-
MD5
7b23d3e6e6528012c98dda612c3dc821
-
SHA1
503797e90bb66fa58307dae22b4e025330398fb0
-
SHA256
f1e2b5685035903fca89cd8f05b7b5ca922a1b23f9587cfa6db938cf59a9c15d
-
SHA512
7113d70e7a71799fbe810d184cb9804e77280588b037093e05b9741f23977411c85e3ee14eeeb7a4d89adcc0ff48acaf4586b10741be08b15c1e8d1b1fc66762
-
SSDEEP
768:bvrNNeRBl5JFTXqwXrkgrn/9/HiDKGwRj4RcTdyH4pYT3nPKVU1EiN9qJcFVAuNZ:VNeRBl5PT/rx1mzwRMSTdLpJiNTFVRZ
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-02_7b23d3e6e6528012c98dda612c3dc821_phobos.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-07-02_7b23d3e6e6528012c98dda612c3dc821_phobos.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
C:\info.hta
http://www.w3.org/TR/html4/strict.dtd'>
Extracted
C:\info.hta
http://www.w3.org/TR/html4/strict.dtd'>
Targets
-
-
Target
2024-07-02_7b23d3e6e6528012c98dda612c3dc821_phobos
-
Size
58KB
-
MD5
7b23d3e6e6528012c98dda612c3dc821
-
SHA1
503797e90bb66fa58307dae22b4e025330398fb0
-
SHA256
f1e2b5685035903fca89cd8f05b7b5ca922a1b23f9587cfa6db938cf59a9c15d
-
SHA512
7113d70e7a71799fbe810d184cb9804e77280588b037093e05b9741f23977411c85e3ee14eeeb7a4d89adcc0ff48acaf4586b10741be08b15c1e8d1b1fc66762
-
SSDEEP
768:bvrNNeRBl5JFTXqwXrkgrn/9/HiDKGwRj4RcTdyH4pYT3nPKVU1EiN9qJcFVAuNZ:VNeRBl5PT/rx1mzwRMSTdLpJiNTFVRZ
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Renames multiple (306) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Modifies Windows Firewall
-
Drops startup file
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Indicator Removal
3File Deletion
3Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Direct Volume Access
1