Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/10/2024, 14:39
Behavioral task
behavioral1
Sample
VolDriver.exe
Resource
win7-20240708-en
windows7-x64
General
-
Target
VolDriver.exe
-
Size
73KB
-
MD5
45fcc38f53e4ba514815477f91618a47
-
SHA1
e971641482d77987e082289c38388052465b2117
-
SHA256
68dd15c384e6d7b3fc6afeda9a17df9ffa55ed29861e9249751488b03abac2fc
-
SHA512
99f0a43b7e0bf732a87cbb36c84ec10d72d4e60d3fa805c908597956cdde005d60e225f24d24da5a07747bd5265eeb78edc7e5f5c0da1f005cac5c21ac53f08d
-
SSDEEP
1536:q3Mz8qPJhOiwf80HUAB0jguYmi159R7wKcfF4:RwEJhOBHpuEHmi1ZEFfF
Malware Config
Extracted
phorphiex
http://185.215.113.66/twizt/
12SJv5p8xUHeiKnXPCDaKCMpqvXj7TABT5BSxGt3csz9Beuc
1A6utf8R2zfLL7X31T5QRHdQyAx16BjdFD
3PFzu8Rw8aDNhDT6d5FMrZ3ckE4dEHzogfg
3BJS4zYwrnfcJMm4xLxRcsa69ght8n6QWz
qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k
XgWbWpuyPGney7hcS9vZ7eNhkj7WcvGcj8
DPcSSyFAYLu4aEB4s1Yotb8ANwtx6bZEQG
0xb899fC445a1b61Cdd62266795193203aa72351fE
LRDpmP5wHZ82LZimzWDLHVqJPDSpkM1gZ7
r1eZ7W1fmUT9tiUZwK6rr3g6RNiE4QpU1
TBdEh7r35ywUD5omutc2kDTX7rXhnFkxy5
t1T7mBRBgTYPEL9RPPBnAVgcftiWUPBFWyy
AGUqhQzF52Qwbvun5wQSrpokPtCC4b9yiX
bitcoincash:qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k
43ABGVDKXksdy7UTP8aHqkRf4xAVDmKKXBYDRevAadwaLJhHzH4ubZHGLjVpLc5ZWk7TVmHbHHAWUBF78mx1YG4eNbww6fr
GCVFMTUKNLFBGHE3AHRJH4IJDRZGWOJ6JD2FQTFQAAIQR64ALD7QJHUY
bnb1rcg9mnkzna2tw4u8ughyaj6ja8feyj87hss9ky
bc1qzs2hs5dvyx04h0erq4ea72sctcre2rcwadsq2v
-
mutex
550032
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36
Signatures
-
Phorphiex payload 1 IoCs
resource yara_rule behavioral2/files/0x000a000000023b9d-16.dat family_phorphiex -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" sysredvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysredvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysredvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysredvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysredvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysredvcs.exe -
Executes dropped EXE 1 IoCs
pid Process 1756 sysredvcs.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysredvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysredvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" sysredvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysredvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" sysredvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysredvcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysredvcs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysredvcs.exe" VolDriver.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\sysredvcs.exe VolDriver.exe File opened for modification C:\Windows\sysredvcs.exe VolDriver.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VolDriver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysredvcs.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4932 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4932 taskmgr.exe Token: SeSystemProfilePrivilege 4932 taskmgr.exe Token: SeCreateGlobalPrivilege 4932 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe 4932 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4788 wrote to memory of 1756 4788 VolDriver.exe 93 PID 4788 wrote to memory of 1756 4788 VolDriver.exe 93 PID 4788 wrote to memory of 1756 4788 VolDriver.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\VolDriver.exe"C:\Users\Admin\AppData\Local\Temp\VolDriver.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\sysredvcs.exeC:\Windows\sysredvcs.exe2⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
PID:1756
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4932
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
MD51fcb78fb6cf9720e9d9494c42142d885
SHA1fef9c2e728ab9d56ce9ed28934b3182b6f1d5379
SHA25684652bb8c63ca4fd7eb7a2d6ef44029801f3057aa2961867245a3a765928dd02
SHA512cdf58e463af1784aea86995b3e5d6b07701c5c4095e30ec80cc901ffd448c6f4f714c521bf8796ffa8c47538bf8bf5351e157596efaa7ab88155d63dc33f7dc3
-
Filesize
73KB
MD545fcc38f53e4ba514815477f91618a47
SHA1e971641482d77987e082289c38388052465b2117
SHA25668dd15c384e6d7b3fc6afeda9a17df9ffa55ed29861e9249751488b03abac2fc
SHA51299f0a43b7e0bf732a87cbb36c84ec10d72d4e60d3fa805c908597956cdde005d60e225f24d24da5a07747bd5265eeb78edc7e5f5c0da1f005cac5c21ac53f08d