phorphiex | 7cfa6bc35fde4c3d6994f56560dc7e9149d1a213351888d89d722e16d7b3e393

General

Target

1bdbf56cc827f362a689eced94a4ee30N.exe
Size

289KB
MD5

1bdbf56cc827f362a689eced94a4ee30
SHA1

609e8b54a528f61804cd0aa13c3a2aaca17e71f7
SHA256

7cfa6bc35fde4c3d6994f56560dc7e9149d1a213351888d89d722e16d7b3e393
SHA512

06dc0f12d77f2a4e0b3da591d08c5367b236082d11447ab6a32a01a30d423372be50adb6a4bfbff72f5b051c67b178450f89cbfb6450685f066dbc081a589da7
SSDEEP

3072:KwYVpJP8Dzh115F/4aS8iV4nU2Iyg/WXnG840r9pwwdgTP94fYP:ZYVDP85pF//SvDGHXG8G

Score

10^/10

phorphiex discovery evasion loader persistence trojan upx worm

Malware Config

Signatures

Phorphiex payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3360-0-0x0000000000400000-0x000000000044C000-memory.dmp	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

1bdbf56cc827f362a689eced94a4ee30N.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	1bdbf56cc827f362a689eced94a4ee30N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	1bdbf56cc827f362a689eced94a4ee30N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	1bdbf56cc827f362a689eced94a4ee30N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	1bdbf56cc827f362a689eced94a4ee30N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	1bdbf56cc827f362a689eced94a4ee30N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	1bdbf56cc827f362a689eced94a4ee30N.exe

Executes dropped EXE 1 IoCs

Processes:

1bdbf56cc827f362a689eced94a4ee30Nmgr.exe

pid process

3276 1bdbf56cc827f362a689eced94a4ee30Nmgr.exe

pid	process
3276	1bdbf56cc827f362a689eced94a4ee30Nmgr.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1bdbf56cc827f362a689eced94a4ee30Nmgr.exe	upx
behavioral2/memory/3276-4-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral2/memory/3276-11-0x0000000000400000-0x0000000000470000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

1bdbf56cc827f362a689eced94a4ee30N.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	1bdbf56cc827f362a689eced94a4ee30N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	1bdbf56cc827f362a689eced94a4ee30N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	1bdbf56cc827f362a689eced94a4ee30N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	1bdbf56cc827f362a689eced94a4ee30N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	1bdbf56cc827f362a689eced94a4ee30N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	1bdbf56cc827f362a689eced94a4ee30N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	1bdbf56cc827f362a689eced94a4ee30N.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

1bdbf56cc827f362a689eced94a4ee30N.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Update Service = "C:\\Windows\\wupdsvcs.exe"	1bdbf56cc827f362a689eced94a4ee30N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Update Service = "C:\\Users\\Admin\\wupdsvcs.exe"	1bdbf56cc827f362a689eced94a4ee30N.exe

Drops file in Windows directory 2 IoCs

Processes:

1bdbf56cc827f362a689eced94a4ee30N.exe

description	ioc	process
File created	C:\Windows\wupdsvcs.exe	1bdbf56cc827f362a689eced94a4ee30N.exe
File opened for modification	C:\Windows\wupdsvcs.exe	1bdbf56cc827f362a689eced94a4ee30N.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3524 3276 WerFault.exe 1bdbf56cc827f362a689eced94a4ee30Nmgr.exe

pid	pid_target	process	target process
3524	3276	WerFault.exe	1bdbf56cc827f362a689eced94a4ee30Nmgr.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

1bdbf56cc827f362a689eced94a4ee30N.exe1bdbf56cc827f362a689eced94a4ee30Nmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1bdbf56cc827f362a689eced94a4ee30N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1bdbf56cc827f362a689eced94a4ee30Nmgr.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

1bdbf56cc827f362a689eced94a4ee30N.exe

description	pid	process	target process
PID 3360 wrote to memory of 3276	3360	1bdbf56cc827f362a689eced94a4ee30N.exe	1bdbf56cc827f362a689eced94a4ee30Nmgr.exe
PID 3360 wrote to memory of 3276	3360	1bdbf56cc827f362a689eced94a4ee30N.exe	1bdbf56cc827f362a689eced94a4ee30Nmgr.exe
PID 3360 wrote to memory of 3276	3360	1bdbf56cc827f362a689eced94a4ee30N.exe	1bdbf56cc827f362a689eced94a4ee30Nmgr.exe

C:\Users\Admin\AppData\Local\Temp\1bdbf56cc827f362a689eced94a4ee30N.exe
"C:\Users\Admin\AppData\Local\Temp\1bdbf56cc827f362a689eced94a4ee30N.exe"
1⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Users\Admin\AppData\Local\Temp\1bdbf56cc827f362a689eced94a4ee30Nmgr.exe
  C:\Users\Admin\AppData\Local\Temp\1bdbf56cc827f362a689eced94a4ee30Nmgr.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3276
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 264
    3⤵
    - Program crash
    PID:3524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3276 -ip 3276
1⤵
PID:1340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1bdbf56cc827f362a689eced94a4ee30Nmgr.exe

Filesize
220KB

MD5
1b7fc3fa0a84470506c3028b48a5f04d

SHA1
3fa9f258fd20c92c0dd366f1520d44f61e236d3b

SHA256
9f62f582fc02ae7b3b5df9a8a90718a80773eed10828014cee2a938976ab056b

SHA512
1259215288d11be9493abc5d9babec8ff2563be3ed1aaf47fbda3f5832d7604f4f5956d09a06854ff133fb9e0971ac398966c46c743dee3f0aead6a2d0901c19

Download Submit
memory/3276-4-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3276-6-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/3276-11-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3360-0-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads