Overview

overview

10

Static

static

3

4ff314143f...ea.exe

windows7-x64

10

4ff314143f...ea.exe

windows10-2004-x64

10

Resubmissions

28-07-2024 18:23

240728-w1kdtsxcll 10

28-07-2024 16:49

240728-vbwj5axckg 10

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-07-2024 16:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4ff314143f6fea359946a81034ec04a4f515998fc23c6937bc5d032b02f01bea.exe

  • Size

    72KB

  • MD5

    fcb76d19b9003bd5522c6da0703175d5

  • SHA1

    99b5b69c4c3c6946162c1239ddbfa6e366cce3e3

  • SHA256

    4ff314143f6fea359946a81034ec04a4f515998fc23c6937bc5d032b02f01bea

  • SHA512

    dc08946159c732d367fa9a2f603eca3ec994eb37c962141bdf91bdd39f136998d560ba45ed307db4527386f85db4c002682d7b55b7a880d345ef613afd49fdce

  • SSDEEP

    1536:lNeRBl5PT/rx1mzwRMSTdLpJSVJaaw38x6S3hT3GCq2iW7z:lQRrmzwR5J7UthDGCH

Score
10/10
phobosaspackv2defense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Signatures

  • Phobos

    Phobos ransomware appeared at the beginning of 2019.

    ransomwarephobos
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (103) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ff314143f6fea359946a81034ec04a4f515998fc23c6937bc5d032b02f01bea.exe
    "C:\Users\Admin\AppData\Local\Temp\4ff314143f6fea359946a81034ec04a4f515998fc23c6937bc5d032b02f01bea.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:388
    • C:\Users\Admin\AppData\Local\Temp\DaGvPt.exe
      C:\Users\Admin\AppData\Local\Temp\DaGvPt.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1312
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1d977db1.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        PID:720
    • C:\Users\Admin\AppData\Local\Temp\4ff314143f6fea359946a81034ec04a4f515998fc23c6937bc5d032b02f01bea.exe
      "C:\Users\Admin\AppData\Local\Temp\4ff314143f6fea359946a81034ec04a4f515998fc23c6937bc5d032b02f01bea.exe"
      2⤵
        PID:4976
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2504
        • C:\Windows\system32\netsh.exe
          netsh advfirewall set currentprofile state off
          3⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:2088
        • C:\Windows\system32\netsh.exe
          netsh firewall set opmode mode=disable
          3⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:2216
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1992
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:4584
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4420
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:3284
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled no
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:5068
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          3⤵
          • Deletes backup catalog
          PID:1804
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2892
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2524
    • C:\Windows\System32\vdsldr.exe
      C:\Windows\System32\vdsldr.exe -Embedding
      1⤵
        PID:4644
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Checks SCSI registry key(s)
        PID:3120

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Command and Scripting Interpreter

      1
      T1059

      Windows Management Instrumentation

      1
      T1047

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Event Triggered Execution

      1
      T1546

      Netsh Helper DLL

      1
      T1546.007

      Privilege Escalation

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Event Triggered Execution

      1
      T1546

      Netsh Helper DLL

      1
      T1546.007

      Defense Evasion

      Direct Volume Access

      1
      T1006

      Impair Defenses

      1
      T1562

      Disable or Modify System Firewall

      1
      T1562.004

      Indicator Removal

      3
      T1070

      File Deletion

      3
      T1070.004

      Modify Registry

      1
      T1112

      Credential Access

      Unsecured Credentials

      1
      T1552

      Credentials In Files

      1
      T1552.001

      Discovery

      Peripheral Device Discovery

      1
      T1120

      Query Registry

      3
      T1012

      System Information Discovery

      3
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Command and Control

      Exfiltration

      Impact

      Inhibit System Recovery

      4
      T1490

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files\7-Zip\7z.exe
        Filesize

        544KB

        MD5

        26f7a83fcf6b31b786c91895d1bdf46e

        SHA1

        ee774dde283164e3728f154a218de091f87d161f

        SHA256

        3701a7e99b37d6738cf1406569b5b3a7aef28ef55ad7def4191ba57835d502d6

        SHA512

        ffdf7aced2f86ca568eb13c1b44458b5336aefe5c8517c86d3171766f7694f7a6ba112a6ee3511eb50712b9f954d1c3de12e3e68259174efa8ad41f8d55c5991

        Download Submit

      • C:\Program Files\7-Zip\Uninstall.exe
        Filesize

        31KB

        MD5

        50615dd05bb46aafc9490a7c48391314

        SHA1

        d955e44ff63fda3f9b18f19aa72cbba43a5d8e44

        SHA256

        4fa7abf3016b4fce22b2ef413654a5ef60fd6a75cce4b6e7aeedf3cf46dde806

        SHA512

        db29f2204faeac580799cbd65346d83a7c74d5b7239dcd761287324f8aae27cafe7b7b19ab0a2d94580d34a74278faaab141a07e620699be4b96da36c8bd6e11

        Download Submit

      • C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md
        Filesize

        2KB

        MD5

        ddc4cb14453391bcb5f4d645b2916a6c

        SHA1

        c4738d174c90c285e17bf51a9218256f45f96ea7

        SHA256

        0c19ba9eeecab3cbbdf38da08c3fa0266f10ce8166e056715931efc543335eeb

        SHA512

        34a32b92ffb2945608439653b5ecacba49fd3312ba5487ba14796c75b07655f0d8f735453dac117d46d204d3f810126f8a189f82c015fa8bb6ea37d9b8e0e30f

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db
        Filesize

        24B

        MD5

        1681ffc6e046c7af98c9e6c232a3fe0a

        SHA1

        d3399b7262fb56cb9ed053d68db9291c410839c4

        SHA256

        9d908ecfb6b256def8b49a7c504e6c889c4b0e41fe6ce3e01863dd7b61a20aa0

        SHA512

        11bb994b5d2eab48b18667c7d8943e82c9011cb1d974304b8f2b6247a7e6b7f55ca2f7c62893644c3728d17dafd74ae3ba46271cf6287bb9e751c779a26fefc5

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I0E3LJN0\k2[1].rar
        Filesize

        4B

        MD5

        d3b07384d113edec49eaa6238ad5ff00

        SHA1

        f1d2d2f924e986ac86fdf7b36c94bcdf32beec15

        SHA256

        b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c

        SHA512

        0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1d977db1.bat
        Filesize

        187B

        MD5

        bec7c7294e7b78f09babcdf4493b64a4

        SHA1

        426ea1978a04d20ec5d5811c3b3dbe16b4683d63

        SHA256

        7f894b45896d1636de03e1b05a87924deb376f39018b67120faf1e5d38773bfd

        SHA512

        44a240fd675c34c3bcb2e9ed70fc8ff217ccc3e41fbb7d82b97e7a66a7b7d86d56e0054587d746ade9cb26e5fad96db008e73a1b06759453262bf5a10b8ce567

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\369A4383.exe
        Filesize

        4B

        MD5

        20879c987e2f9a916e578386d499f629

        SHA1

        c7b33ddcc42361fdb847036fc07e880b81935d5d

        SHA256

        9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31

        SHA512

        bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\DaGvPt.exe
        Filesize

        15KB

        MD5

        f7d21de5c4e81341eccd280c11ddcc9a

        SHA1

        d4e9ef10d7685d491583c6fa93ae5d9105d815bd

        SHA256

        4485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794

        SHA512

        e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3

        Download Submit

      • memory/388-783-0x00000000007C0000-0x00000000007D8000-memory.dmp

        Filesize

        96KB

        Download

      • memory/388-0-0x00000000007C0000-0x00000000007D8000-memory.dmp

        Filesize

        96KB

        Download

      • memory/1312-1707-0x0000000000300000-0x0000000000309000-memory.dmp

        Filesize

        36KB

        Download

      • memory/1312-163-0x0000000000300000-0x0000000000309000-memory.dmp

        Filesize

        36KB

        Download

      • memory/1312-5-0x0000000000300000-0x0000000000309000-memory.dmp

        Filesize

        36KB

        Download

      • memory/4976-7-0x00000000007C0000-0x00000000007D8000-memory.dmp

        Filesize

        96KB

        Download