Overview
overview
3Static
static
3Phoenix/An...rp.dll
windows7-x64
1Phoenix/An...rp.dll
windows10-2004-x64
1Phoenix/Co...le.dll
windows7-x64
1Phoenix/Co...le.dll
windows10-2004-x64
1Phoenix/IC...ib.dll
windows7-x64
1Phoenix/IC...ib.dll
windows10-2004-x64
1Phoenix/Ne...on.dll
windows7-x64
1Phoenix/Ne...on.dll
windows10-2004-x64
1Phoenix/Phoenix.exe
windows7-x64
1Phoenix/Phoenix.exe
windows10-2004-x64
1Phoenix/Phoenix.exe
windows7-x64
1Phoenix/Phoenix.exe
windows10-2004-x64
1Phoenix/Ph...g.json
windows7-x64
3Phoenix/Ph...g.json
windows10-2004-x64
3Phoenix/WebDriver.dll
windows7-x64
1Phoenix/WebDriver.dll
windows10-2004-x64
1Phoenix/We...er.dll
windows7-x64
1Phoenix/We...er.dll
windows10-2004-x64
1Phoenix/Wo...ns.txt
windows7-x64
1Phoenix/Wo...ns.txt
windows10-2004-x64
1Phoenix/mu...ns.txt
windows7-x64
1Phoenix/mu...ns.txt
windows10-2004-x64
1Phoenix/se...anager
ubuntu-18.04-amd64
3Phoenix/se...anager
macos-10.15-amd64
1Phoenix/se...er.exe
windows7-x64
1Phoenix/se...er.exe
windows10-2004-x64
1Phoenix/token.txt
windows7-x64
1Phoenix/token.txt
windows10-2004-x64
1Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19-07-2024 20:29
Static task
static1
Behavioral task
behavioral1
Sample
Phoenix/AngleSharp.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Phoenix/AngleSharp.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
Phoenix/Colorful.Console.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
Phoenix/Colorful.Console.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
Phoenix/ICSharpCode.SharpZipLib.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
Phoenix/ICSharpCode.SharpZipLib.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
Phoenix/Newtonsoft.Json.dll
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
Phoenix/Newtonsoft.Json.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
Phoenix/Phoenix.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
Phoenix/Phoenix.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
Phoenix/Phoenix.exe
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
Phoenix/Phoenix.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
Phoenix/Phoenix.runtimeconfig.json
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
Phoenix/Phoenix.runtimeconfig.json
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
Phoenix/WebDriver.dll
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
Phoenix/WebDriver.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
Phoenix/WebDriverManager.dll
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
Phoenix/WebDriverManager.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
Phoenix/WorkingTokens.txt
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
Phoenix/WorkingTokens.txt
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
Phoenix/multitokens.txt
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
Phoenix/multitokens.txt
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
Phoenix/selenium-manager/linux/selenium-manager
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral24
Sample
Phoenix/selenium-manager/macos/selenium-manager
Resource
macos-20240711.1-en
Behavioral task
behavioral25
Sample
Phoenix/selenium-manager/windows/selenium-manager.exe
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
Phoenix/selenium-manager/windows/selenium-manager.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
Phoenix/token.txt
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
Phoenix/token.txt
Resource
win10v2004-20240709-en
General
-
Target
Phoenix/Phoenix.runtimeconfig.json
-
Size
253B
-
MD5
39179c3a11d63cfeb42fae4a35085b48
-
SHA1
a480014e50f69e53f77cbeb0c1d200842f9875cd
-
SHA256
489a92c37422b7e5ce212f9701b7a081d887b895f88b91b000976131f90f823f
-
SHA512
39fa8b6e2ac64b9a4d9f75a5aae74cc9ae42440296fed8fa074ec0d0f15d10470ad2167ec3d7087222ce6824e571af5edda591e6c46a37d030ad147417f4b948
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\json_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\json_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\.json\ = "json_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\json_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\json_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\json_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\.json rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2728 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2728 AcroRd32.exe 2728 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1544 wrote to memory of 2732 1544 cmd.exe rundll32.exe PID 1544 wrote to memory of 2732 1544 cmd.exe rundll32.exe PID 1544 wrote to memory of 2732 1544 cmd.exe rundll32.exe PID 2732 wrote to memory of 2728 2732 rundll32.exe AcroRd32.exe PID 2732 wrote to memory of 2728 2732 rundll32.exe AcroRd32.exe PID 2732 wrote to memory of 2728 2732 rundll32.exe AcroRd32.exe PID 2732 wrote to memory of 2728 2732 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Phoenix\Phoenix.runtimeconfig.json1⤵
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Phoenix\Phoenix.runtimeconfig.json2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Phoenix\Phoenix.runtimeconfig.json"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2728
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5f2b05b53a8e0a1d4a133cdc16993c68d
SHA1fbb485c116821b6a976b4ec4f50b22583c5e4a63
SHA256ca8ccd8600ecbedbcdb7cd7961806d7c5d2ad4e5aa3b6a7c7daeb8737ce23bce
SHA512ed025313bd94223956885214acb66d37ab26fed4c7473db29627f2bbddc598096ebd8394eaa4b7ca04dda7956607c5f4bb878704d7a3e49fcf3d7d00eb8e71ee