Extracted

Extracted

• • Target

    LCrypt0rX.vbs

  • Size

    25KB

  • MD5

    5c4dad0f397077e5e9cc55febfc096bd

  • SHA1

    eed1a50a4818890cb4c474792f8ad0258ab115a8

  • SHA256

    12897e2e24f1a59cf08655fcb274c08747ef550b16741e6306a0a8f94aefcb9c

  • SHA512

    90290ac0ca91e5cca3b2e19c4b5baec11523d7fe4ce674bd5f3db7e47f83deda55d923a635e2ad9e584af61c36e83209f548cfca867f9720a58a8a2181ac47c4

  • SSDEEP

    384:y8enbIbpBStxYUQHSH7l+ix/J/b6GvPpSy+tNywUTZEC:inucJb6UAUqC

  Score

  10^/10

  phorphiexdefense_evasionexecutionimpactloaderpersistenceransomwaretrojanwormdiscovery

  • Modifies WinLogon for persistence

    persistence

  • Phorphiex family

    phorphiex

  • Phorphiex payload

  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex

  • UAC bypass

    defense_evasiontrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Blocklisted process makes network request

  • Blocks application from running via registry modification

    Adds application to list of disallowed applications.

    defense_evasion

  • Creates new service(s)

    persistenceexecution

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Stops running service(s)

    defense_evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: Clear Persistence

    remove IFEO.

    defense_evasion

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2