544ce0a2f004e8a12f5004496aedc83b2f863a5e8228c8529df9956f7df2b026

General

Target

544ce0a2f004e8a12f5004496aedc83b2f863a5e8228c8529df9956f7df2b026.exe
Size

26.1MB
MD5

221efb4a5fa8ac017bf3918669495e83
SHA1

682b7b9d1a0868625b3c358c73fa99024fbb114f
SHA256

544ce0a2f004e8a12f5004496aedc83b2f863a5e8228c8529df9956f7df2b026
SHA512

2ce0707c3535277652720dc866c6b7476969c887b6faa8acb555af8966460bb39ebed0c5fa8c672e41c37a850186847e7da2ac42ea16ca2dca97f903b736a87b
SSDEEP

393216:H/4u+DepixkkahO/Ria/mMZGhK13BLwk2YFr287+jX9Zmgr7nPvkA61EXwc7yhNO:f4u+SPfk/1kG19FNkygnPvks7yhAxtNh

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2200	mralfdjn.exe
2768	LineInst.exe
13100	Phxph.exe
11972	Phxph.exe

Loads dropped DLL 8 IoCs

pid	Process
1764	544ce0a2f004e8a12f5004496aedc83b2f863a5e8228c8529df9956f7df2b026.exe
1764	544ce0a2f004e8a12f5004496aedc83b2f863a5e8228c8529df9956f7df2b026.exe
1764	544ce0a2f004e8a12f5004496aedc83b2f863a5e8228c8529df9956f7df2b026.exe
1764	544ce0a2f004e8a12f5004496aedc83b2f863a5e8228c8529df9956f7df2b026.exe
1764	544ce0a2f004e8a12f5004496aedc83b2f863a5e8228c8529df9956f7df2b026.exe
1764	544ce0a2f004e8a12f5004496aedc83b2f863a5e8228c8529df9956f7df2b026.exe
1764	544ce0a2f004e8a12f5004496aedc83b2f863a5e8228c8529df9956f7df2b026.exe
1764	544ce0a2f004e8a12f5004496aedc83b2f863a5e8228c8529df9956f7df2b026.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	Phxph.exe
File opened (read-only)	\??\S:	Phxph.exe
File opened (read-only)	\??\X:	Phxph.exe
File opened (read-only)	\??\H:	Phxph.exe
File opened (read-only)	\??\K:	Phxph.exe
File opened (read-only)	\??\Q:	Phxph.exe
File opened (read-only)	\??\W:	Phxph.exe
File opened (read-only)	\??\Y:	Phxph.exe
File opened (read-only)	\??\Z:	Phxph.exe
File opened (read-only)	\??\G:	Phxph.exe
File opened (read-only)	\??\N:	Phxph.exe
File opened (read-only)	\??\O:	Phxph.exe
File opened (read-only)	\??\T:	Phxph.exe
File opened (read-only)	\??\V:	Phxph.exe
File opened (read-only)	\??\P:	Phxph.exe
File opened (read-only)	\??\R:	Phxph.exe
File opened (read-only)	\??\U:	Phxph.exe
File opened (read-only)	\??\B:	Phxph.exe
File opened (read-only)	\??\E:	Phxph.exe
File opened (read-only)	\??\I:	Phxph.exe
File opened (read-only)	\??\L:	Phxph.exe
File opened (read-only)	\??\M:	Phxph.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Phxph.exe	mralfdjn.exe
File opened for modification	C:\Windows\SysWOW64\Phxph.exe	mralfdjn.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 40 IoCs

pid	Process
2200	mralfdjn.exe
2200	mralfdjn.exe
13100	Phxph.exe
13100	Phxph.exe
2200	mralfdjn.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LineInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phxph.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Phxph.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	544ce0a2f004e8a12f5004496aedc83b2f863a5e8228c8529df9956f7df2b026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mralfdjn.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
14032	cmd.exe
5088	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Phxph.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Phxph.exe

Modifies data under HKEY_USERS 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Phxph.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	Phxph.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	Phxph.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie	Phxph.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum	Phxph.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7"	Phxph.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Phxph.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Phxph.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Phxph.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	Phxph.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Phxph.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Phxph.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5088	PING.EXE

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe
11972	Phxph.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2200	mralfdjn.exe
Token: 33	11972	Phxph.exe
Token: SeIncBasePriorityPrivilege	11972	Phxph.exe
Token: 33	11972	Phxph.exe
Token: SeIncBasePriorityPrivilege	11972	Phxph.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 2200	1764	544ce0a2f004e8a12f5004496aedc83b2f863a5e8228c8529df9956f7df2b026.exe	31
PID 1764 wrote to memory of 2200	1764	544ce0a2f004e8a12f5004496aedc83b2f863a5e8228c8529df9956f7df2b026.exe	31
PID 1764 wrote to memory of 2200	1764	544ce0a2f004e8a12f5004496aedc83b2f863a5e8228c8529df9956f7df2b026.exe	31
PID 1764 wrote to memory of 2200	1764	544ce0a2f004e8a12f5004496aedc83b2f863a5e8228c8529df9956f7df2b026.exe	31
PID 1764 wrote to memory of 2768	1764	544ce0a2f004e8a12f5004496aedc83b2f863a5e8228c8529df9956f7df2b026.exe	32
PID 1764 wrote to memory of 2768	1764	544ce0a2f004e8a12f5004496aedc83b2f863a5e8228c8529df9956f7df2b026.exe	32
PID 1764 wrote to memory of 2768	1764	544ce0a2f004e8a12f5004496aedc83b2f863a5e8228c8529df9956f7df2b026.exe	32
PID 1764 wrote to memory of 2768	1764	544ce0a2f004e8a12f5004496aedc83b2f863a5e8228c8529df9956f7df2b026.exe	32
PID 1764 wrote to memory of 2768	1764	544ce0a2f004e8a12f5004496aedc83b2f863a5e8228c8529df9956f7df2b026.exe	32
PID 1764 wrote to memory of 2768	1764	544ce0a2f004e8a12f5004496aedc83b2f863a5e8228c8529df9956f7df2b026.exe	32
PID 1764 wrote to memory of 2768	1764	544ce0a2f004e8a12f5004496aedc83b2f863a5e8228c8529df9956f7df2b026.exe	32
PID 13100 wrote to memory of 11972	13100	Phxph.exe	35
PID 13100 wrote to memory of 11972	13100	Phxph.exe	35
PID 13100 wrote to memory of 11972	13100	Phxph.exe	35
PID 13100 wrote to memory of 11972	13100	Phxph.exe	35
PID 2200 wrote to memory of 14032	2200	mralfdjn.exe	34
PID 2200 wrote to memory of 14032	2200	mralfdjn.exe	34
PID 2200 wrote to memory of 14032	2200	mralfdjn.exe	34
PID 2200 wrote to memory of 14032	2200	mralfdjn.exe	34
PID 14032 wrote to memory of 5088	14032	cmd.exe	37
PID 14032 wrote to memory of 5088	14032	cmd.exe	37
PID 14032 wrote to memory of 5088	14032	cmd.exe	37
PID 14032 wrote to memory of 5088	14032	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\544ce0a2f004e8a12f5004496aedc83b2f863a5e8228c8529df9956f7df2b026.exe
"C:\Users\Admin\AppData\Local\Temp\544ce0a2f004e8a12f5004496aedc83b2f863a5e8228c8529df9956f7df2b026.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Users\Admin\AppData\Local\Temp\mralfdjn.exe
  "C:\Users\Admin\AppData\Local\Temp\mralfdjn.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\mralfdjn.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:14032
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5088
- C:\Users\Admin\AppData\Local\Temp\LineInst.exe
  "C:\Users\Admin\AppData\Local\Temp\LineInst.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2768

C:\Windows\SysWOW64\Phxph.exe
C:\Windows\SysWOW64\Phxph.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:13100
- C:\Windows\SysWOW64\Phxph.exe
  C:\Windows\SysWOW64\Phxph.exe -acsi
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:11972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

1

T1018

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JX33I87moEMS.exe

Filesize
7.4MB

MD5
3e7186781b9393bdb84477fc025e995c

SHA1
727c10bf95ece9c41ccc68b72d75457fc2989015

SHA256
a8525190ad6b567760a210cfd5cdf6e163a1391173f0f4dba1d2bf18f5ac46d8

SHA512
d0dfcc0d9ed4c7ee29696bb4dde3e8fad6de6b850f2e50b809dd12cfb6ca9bdae7c912bd81089b05fd7dc302a671b32415c5610f3a2740cd6fbad8ddf677fe0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\mralfdjn.exe

Filesize
27.3MB

MD5
f9d4a4c93c769108a010dd8a1c7f3cdb

SHA1
544448693eda94e35201ee220294250c4bbe9a51

SHA256
fea7547e78ba91f0b72162ce9a4ec2f419446c57fa008fffe4c92eadc594aab0

SHA512
1f362c032469027da4d7852315174cc4535cafc635790f8ef51ebbfaa84b46bfbe5abf6975c858e134d76995c6948fcc64113a9d5be51a2626dabd6bf7be14c3

Download Submit
\Users\Admin\AppData\Local\Temp\LineInst.exe

Filesize
1004KB

MD5
587e3bc21efaf428c87331decc9bfeb3

SHA1
a5b8ebeab4e3968673a61a95350b7f0bf60d7459

SHA256
b931c5686cc09b2183bba197dc151b8e95ca6151e39fb98954352340c0b31120

SHA512
ffae2dab5caf16dc7dfd0a97a8ff6349a466bc57ee043d1ac4d53e011498e39b9a855295d10207ba578c6857abebd445d378e83aa2ff6ec247713d81b370d0ca

Download Submit
memory/1764-25-0x0000000005890000-0x00000000073E8000-memory.dmp

Filesize
27.3MB

Download
memory/1764-26-0x0000000005890000-0x00000000073E8000-memory.dmp

Filesize
27.3MB

Download
memory/2200-904-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-896-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-862-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-872-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-858-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-880-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-884-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-882-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-854-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-852-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-850-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-906-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-910-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-39-0x0000000075A90000-0x0000000075AD7000-memory.dmp

Filesize
284KB

Download
memory/2200-902-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-900-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-898-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-864-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-894-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-892-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-890-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-888-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-886-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-878-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-876-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-874-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-870-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-868-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-866-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-860-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-856-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-849-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download
memory/2200-908-0x0000000003BD0000-0x0000000003CE1000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads