CyberzSOC

INDICATORS OF COMPROMISE (IOCs) See Table 1 through 6 for IOCs obtained from CISA and the FBI investigations from September through Table 1: Associated Phobos Domains Table 2: Observed Phobos Shell Commands vssadmin delete shadows /all /quiet [T1490] netsh advfirewall set currentprofile state off netsh firewall set opmode mode=disable [T1562.004] bcdedit /set {default} bootstatuspolicy ignoreallfailures [T1547.001] bcdedit /set {default} recoveryenabled no [T1490] mshta C:\%USERPROFILE%\Desktop\info.hta [T1218.005] mshta C:\%PUBLIC%\Desktop\info.hta The commands above are observed during the execution of a Phobos encryption executable. A Phobos encryption executable spawns a cmd.exe process, which then executes the commands listed in Table 1 with their respective Windows system executables. When the commands above are executed on a Windows system, volume shadow copies are deleted and Windows Firewall is disabled. Additionally, the system’s boot status policy is set to boot even when there are errors during the boot process, and automatic recovery options, like Windows Recovery Environment (WinRE), are disabled for the given boot entry. Finally, the Phobos ransom note is displayed to the end user using mshta.exe.