phorphiex | aa90c2cdee8278a423f4104038b5817962471bebde82c4124a5b9d47f9d07059

Analysis

max time kernel
96s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2024 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa90c2cdee8278a423f4104038b5817962471bebde82c4124a5b9d47f9d07059.exe
Size

11KB
MD5

59c9da9fe35e01962f605570d31b0d93
SHA1

5ff4b2b6b8de81848ea2bbbaf47c408798f8497a
SHA256

aa90c2cdee8278a423f4104038b5817962471bebde82c4124a5b9d47f9d07059
SHA512

5ed16754e11db17dfbe50c435ae4186d494e8f11c7e47e663378ef57b46a2a638d7293a2728d06919be566c3806fbbc4958903d9a61389ca7d805e0a014e9cc4
SSDEEP

192:x5S4bB5cUNN8Vflr4hegCrJJfxMLkWScZqYSi/H:x5S4RNQsgxTxMQWSc9

Score

10^/10

phorphiex discovery loader persistence trojan worm

Malware Config

Extracted

Family

phorphiex

http://twizt.net

Signatures

Phorphiex family
phorphiex
Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Executes dropped EXE 1 IoCs

pid	Process
2228	winsvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Users\\Admin\\winsvc.exe"	aa90c2cdee8278a423f4104038b5817962471bebde82c4124a5b9d47f9d07059.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aa90c2cdee8278a423f4104038b5817962471bebde82c4124a5b9d47f9d07059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winsvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2228	1948	aa90c2cdee8278a423f4104038b5817962471bebde82c4124a5b9d47f9d07059.exe	82
PID 1948 wrote to memory of 2228	1948	aa90c2cdee8278a423f4104038b5817962471bebde82c4124a5b9d47f9d07059.exe	82
PID 1948 wrote to memory of 2228	1948	aa90c2cdee8278a423f4104038b5817962471bebde82c4124a5b9d47f9d07059.exe	82

C:\Users\Admin\AppData\Local\Temp\aa90c2cdee8278a423f4104038b5817962471bebde82c4124a5b9d47f9d07059.exe
"C:\Users\Admin\AppData\Local\Temp\aa90c2cdee8278a423f4104038b5817962471bebde82c4124a5b9d47f9d07059.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Users\Admin\winsvc.exe
  C:\Users\Admin\winsvc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\winsvc.exe

Filesize
11KB

MD5
59c9da9fe35e01962f605570d31b0d93

SHA1
5ff4b2b6b8de81848ea2bbbaf47c408798f8497a

SHA256
aa90c2cdee8278a423f4104038b5817962471bebde82c4124a5b9d47f9d07059

SHA512
5ed16754e11db17dfbe50c435ae4186d494e8f11c7e47e663378ef57b46a2a638d7293a2728d06919be566c3806fbbc4958903d9a61389ca7d805e0a014e9cc4

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads