phorphiex | 061db793b90f10c1b0c42faf0729c2a6e98b49f5a32e74a9815fea354bcec7e3

General

Target

061db793b90f10c1b0c42faf0729c2a6e98b49f5a32e74a9815fea354bcec7e3.exe
Size

113KB
MD5

d54208c1d2a0c3475398fc2ee70f3e40
SHA1

0d17b29fe85194032ebae3fc1e7b8d614ffb20f4
SHA256

061db793b90f10c1b0c42faf0729c2a6e98b49f5a32e74a9815fea354bcec7e3
SHA512

2bd65b0c6a23727d281ec7e79f16ce48609015c63c4529546543f9221d4dcc0907dfb9e1c6fb42134bc6ee87d709f83a4a3bf36881569153c59641bb2cd4d7cc
SSDEEP

3072:TwoehO0gArukWMsv0+ElfFtewoehO0gArukWO:0xhO+rj+OtFtVxhO+rX

Score

10^/10

phorphiex evasion loader persistence trojan worm

Malware Config

Signatures

Phorphiex payload 1 IoCs

Processes:

resource	yara_rule
C:\Windows\sysfevcs.exe	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

sysfevcs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysfevcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysfevcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysfevcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysfevcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysfevcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysfevcs.exe

Executes dropped EXE 1 IoCs

Processes:

sysfevcs.exe

pid process

2112 sysfevcs.exe

pid	process
2112	sysfevcs.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

sysfevcs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysfevcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysfevcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysfevcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysfevcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysfevcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysfevcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysfevcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

061db793b90f10c1b0c42faf0729c2a6e98b49f5a32e74a9815fea354bcec7e3.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysfevcs.exe"	061db793b90f10c1b0c42faf0729c2a6e98b49f5a32e74a9815fea354bcec7e3.exe

Drops file in Windows directory 2 IoCs

Processes:

061db793b90f10c1b0c42faf0729c2a6e98b49f5a32e74a9815fea354bcec7e3.exe

description	ioc	process
File created	C:\Windows\sysfevcs.exe	061db793b90f10c1b0c42faf0729c2a6e98b49f5a32e74a9815fea354bcec7e3.exe
File opened for modification	C:\Windows\sysfevcs.exe	061db793b90f10c1b0c42faf0729c2a6e98b49f5a32e74a9815fea354bcec7e3.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

061db793b90f10c1b0c42faf0729c2a6e98b49f5a32e74a9815fea354bcec7e3.exe

description	pid	process	target process
PID 2416 wrote to memory of 2112	2416	061db793b90f10c1b0c42faf0729c2a6e98b49f5a32e74a9815fea354bcec7e3.exe	sysfevcs.exe
PID 2416 wrote to memory of 2112	2416	061db793b90f10c1b0c42faf0729c2a6e98b49f5a32e74a9815fea354bcec7e3.exe	sysfevcs.exe
PID 2416 wrote to memory of 2112	2416	061db793b90f10c1b0c42faf0729c2a6e98b49f5a32e74a9815fea354bcec7e3.exe	sysfevcs.exe
PID 2416 wrote to memory of 2112	2416	061db793b90f10c1b0c42faf0729c2a6e98b49f5a32e74a9815fea354bcec7e3.exe	sysfevcs.exe

C:\Users\Admin\AppData\Local\Temp\061db793b90f10c1b0c42faf0729c2a6e98b49f5a32e74a9815fea354bcec7e3.exe
"C:\Users\Admin\AppData\Local\Temp\061db793b90f10c1b0c42faf0729c2a6e98b49f5a32e74a9815fea354bcec7e3.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\sysfevcs.exe
  C:\Windows\sysfevcs.exe
  2⤵
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\sysfevcs.exe

Filesize
113KB

MD5
d54208c1d2a0c3475398fc2ee70f3e40

SHA1
0d17b29fe85194032ebae3fc1e7b8d614ffb20f4

SHA256
061db793b90f10c1b0c42faf0729c2a6e98b49f5a32e74a9815fea354bcec7e3

SHA512
2bd65b0c6a23727d281ec7e79f16ce48609015c63c4529546543f9221d4dcc0907dfb9e1c6fb42134bc6ee87d709f83a4a3bf36881569153c59641bb2cd4d7cc

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads