Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04-07-2024 17:49
Static task
static1
Behavioral task
behavioral1
Sample
0213bbe612a5ddfaceb6f543197e990db6aae05fcdf115c50525c957ed922a68.exe
Resource
win7-20240611-en
General
-
Target
0213bbe612a5ddfaceb6f543197e990db6aae05fcdf115c50525c957ed922a68.exe
-
Size
105KB
-
MD5
e38218ed028e3b003647386cb7f29d20
-
SHA1
0c2663acde9b68580f803178035ce5dafe674969
-
SHA256
0213bbe612a5ddfaceb6f543197e990db6aae05fcdf115c50525c957ed922a68
-
SHA512
9a5807239fbf99a3b21a6234cdc6ea93ee71f4d4b3f93b047d53b02de7808013b8cdbd5d99541654b2450bc4fb2c72d012f45ad8e729893f3f7d86b4e1b00635
-
SSDEEP
1536:JO/z6hPABUjO/Zd1716EoLiL4l1HdIaqQPDm0xK8i6f0Zn9PRVW8sW45oDFU:2zgjO/Zd1RePDmZ8tf05iW4u5
Malware Config
Extracted
phorphiex
http://185.215.113.66/
http://77.91.77.92/
http://91.202.233.141/
0xCa90599132C4D88907Bd8E046540284aa468a035
TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6
qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
XryzFMFVpDUvU7famUGf214EXD3xNUSmQf
LLeT2zkStY3cvxMBFhoWXkG5VuZPoezduv
rwc4LVd9ABpULQ1CuCpDkgX2xVB1fUijyb
4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK
15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC
17hgMFyLDwMjxWqw5GhijhnPdJDyFDqecY
ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp
3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc
3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3
DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA
t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh
stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj
bnb1epx67ne4vckqmaj4gwke8m322f4yjr6eh52wqw
bc1qmpkehfffkr6phuklsksnd7nhgx0369sxu772m3
bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3
-
mutex
55a4er5wo
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Signatures
-
Modifies security service 2 TTPs 1 IoCs
Processes:
sysmablsvr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4" sysmablsvr.exe -
Phorphiex payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\279757590.exe family_phorphiex -
Processes:
sysmablsvr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysmablsvr.exe -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0213bbe612a5ddfaceb6f543197e990db6aae05fcdf115c50525c957ed922a68.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 0213bbe612a5ddfaceb6f543197e990db6aae05fcdf115c50525c957ed922a68.exe -
Executes dropped EXE 6 IoCs
Processes:
EE86.exeF05B.exe279757590.exe307148358.exesysmablsvr.exe1533017020.exepid process 2216 EE86.exe 3268 F05B.exe 4348 279757590.exe 3744 307148358.exe 3172 sysmablsvr.exe 3432 1533017020.exe -
Processes:
sysmablsvr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" sysmablsvr.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
279757590.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysmablsvr.exe" 279757590.exe -
Drops file in Windows directory 2 IoCs
Processes:
279757590.exedescription ioc process File created C:\Windows\sysmablsvr.exe 279757590.exe File opened for modification C:\Windows\sysmablsvr.exe 279757590.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
0213bbe612a5ddfaceb6f543197e990db6aae05fcdf115c50525c957ed922a68.exe0213bbe612a5ddfaceb6f543197e990db6aae05fcdf115c50525c957ed922a68.exeEE86.exeF05B.exe279757590.exesysmablsvr.exedescription pid process target process PID 4724 wrote to memory of 2216 4724 0213bbe612a5ddfaceb6f543197e990db6aae05fcdf115c50525c957ed922a68.exe EE86.exe PID 4724 wrote to memory of 2216 4724 0213bbe612a5ddfaceb6f543197e990db6aae05fcdf115c50525c957ed922a68.exe EE86.exe PID 4724 wrote to memory of 2216 4724 0213bbe612a5ddfaceb6f543197e990db6aae05fcdf115c50525c957ed922a68.exe EE86.exe PID 4724 wrote to memory of 4160 4724 0213bbe612a5ddfaceb6f543197e990db6aae05fcdf115c50525c957ed922a68.exe 0213bbe612a5ddfaceb6f543197e990db6aae05fcdf115c50525c957ed922a68.exe PID 4724 wrote to memory of 4160 4724 0213bbe612a5ddfaceb6f543197e990db6aae05fcdf115c50525c957ed922a68.exe 0213bbe612a5ddfaceb6f543197e990db6aae05fcdf115c50525c957ed922a68.exe PID 4724 wrote to memory of 4160 4724 0213bbe612a5ddfaceb6f543197e990db6aae05fcdf115c50525c957ed922a68.exe 0213bbe612a5ddfaceb6f543197e990db6aae05fcdf115c50525c957ed922a68.exe PID 4160 wrote to memory of 3268 4160 0213bbe612a5ddfaceb6f543197e990db6aae05fcdf115c50525c957ed922a68.exe F05B.exe PID 4160 wrote to memory of 3268 4160 0213bbe612a5ddfaceb6f543197e990db6aae05fcdf115c50525c957ed922a68.exe F05B.exe PID 4160 wrote to memory of 3268 4160 0213bbe612a5ddfaceb6f543197e990db6aae05fcdf115c50525c957ed922a68.exe F05B.exe PID 2216 wrote to memory of 4348 2216 EE86.exe 279757590.exe PID 2216 wrote to memory of 4348 2216 EE86.exe 279757590.exe PID 2216 wrote to memory of 4348 2216 EE86.exe 279757590.exe PID 3268 wrote to memory of 3744 3268 F05B.exe 307148358.exe PID 3268 wrote to memory of 3744 3268 F05B.exe 307148358.exe PID 3268 wrote to memory of 3744 3268 F05B.exe 307148358.exe PID 4348 wrote to memory of 3172 4348 279757590.exe sysmablsvr.exe PID 4348 wrote to memory of 3172 4348 279757590.exe sysmablsvr.exe PID 4348 wrote to memory of 3172 4348 279757590.exe sysmablsvr.exe PID 3172 wrote to memory of 3432 3172 sysmablsvr.exe 1533017020.exe PID 3172 wrote to memory of 3432 3172 sysmablsvr.exe 1533017020.exe PID 3172 wrote to memory of 3432 3172 sysmablsvr.exe 1533017020.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0213bbe612a5ddfaceb6f543197e990db6aae05fcdf115c50525c957ed922a68.exe"C:\Users\Admin\AppData\Local\Temp\0213bbe612a5ddfaceb6f543197e990db6aae05fcdf115c50525c957ed922a68.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\EE86.exe"C:\Users\Admin\AppData\Local\Temp\EE86.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\279757590.exeC:\Users\Admin\AppData\Local\Temp\279757590.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\sysmablsvr.exeC:\Windows\sysmablsvr.exe4⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1533017020.exeC:\Users\Admin\AppData\Local\Temp\1533017020.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\0213bbe612a5ddfaceb6f543197e990db6aae05fcdf115c50525c957ed922a68.exe"C:\Users\Admin\AppData\Local\Temp\0213bbe612a5ddfaceb6f543197e990db6aae05fcdf115c50525c957ed922a68.exe" end2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\F05B.exe"C:\Users\Admin\AppData\Local\Temp\F05B.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\307148358.exeC:\Users\Admin\AppData\Local\Temp\307148358.exe4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4040,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1533017020.exeFilesize
7KB
MD51f0abf08afc2cd737aae9a255c8f55e1
SHA1537711117ca2f3a3c9e4f5bb8d9c2513d06d2cbf
SHA256ed1a5a83999330c81f957917d6ca6bc9a64aa2825ca0023a31ffc02ba422a0a5
SHA512e638eabe89a447b79488903e7a6fa208827e8f2c96a3a4910e33d6b65e75bb9c6a5ae81cbe909578fd933a8e69f8ba1d750857478432e82dfac03b8f04b09291
-
C:\Users\Admin\AppData\Local\Temp\279757590.exeFilesize
88KB
MD54505daf4c08fc8e8e1380911e98588aa
SHA1d990eb1b2ccbb71c878944be37923b1ebd17bc72
SHA256a2139600c569365149894405d411ea1401bafc8c7e8af1983d046cf087269c40
SHA512bb57d11150086c3c61f9a8fdd2511e3e780a24362183a6b833f44484238451f23b74b244262009f38a8baa7254d07dfdd9d4209efcf426dfd4e651c47f2f8cec
-
C:\Users\Admin\AppData\Local\Temp\EE86.exeFilesize
9KB
MD58d8e6c7952a9dc7c0c73911c4dbc5518
SHA19098da03b33b2c822065b49d5220359c275d5e94
SHA256feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278
SHA51291a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645
-
memory/4160-13-0x0000000000400000-0x000000000041FDB0-memory.dmpFilesize
127KB
-
memory/4724-7-0x0000000000400000-0x000000000041FDB0-memory.dmpFilesize
127KB