metasploit | fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779

General

Target

fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779.exe
Size

264KB
MD5

ee413845fea480f5df638da7993a39fe
SHA1

e4cec15d1f08a98e30e5702db9facf023d6710c8
SHA256

fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779
SHA512

3dfc6a444669ce33b532c8fe651a732c8f7f8880abcd82ebac594577850b09addc9aa75940f769cb2d50e3d00967b152fd6dad488ef2348794cc3b33b0900e53
SSDEEP

3072:Q4BRhwqFvaVuwt2UtrkgF4DBisPy0RGxLCw5CicFiIdQsIiy42ig:Q4HiqFvaVqgzWPy0RGxWwwIc2ig

Score

10^/10

metasploit backdoor evasion persistence trojan upx

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	igfxbv32.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\igfxbv32.exe = "C:\\Windows\\SysWOW64\\igfxbv32.exe:*:Enabled:Intel iBackup Core"	igfxbv32.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List	igfxbv32.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\igfxbv32.exe = "C:\\Windows\\SysWOW64\\igfxbv32.exe:*:Enabled:Intel iBackup Core"	igfxbv32.exe

Executes dropped EXE 2 IoCs

pid	Process
328	igfxbv32.exe
940	igfxbv32.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/788-55-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral1/memory/788-57-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral1/memory/788-58-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral1/memory/788-60-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral1/memory/788-64-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral1/memory/788-65-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral1/memory/788-66-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral1/memory/788-67-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral1/memory/788-72-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral1/memory/940-85-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral1/memory/940-86-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral1/memory/940-87-0x0000000000400000-0x0000000000467000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
940	igfxbv32.exe

Loads dropped DLL 2 IoCs

pid	Process
788	fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779.exe
788	fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	igfxbv32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Intel iBackup Core = "C:\\Windows\\SysWOW64\\igfxbv32.exe"	igfxbv32.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxbv32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxbv32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\	fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779.exe
File opened for modification	C:\Windows\SysWOW64\igfxbv32.exe	fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779.exe
File created	C:\Windows\SysWOW64\igfxbv32.exe	fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779.exe
File opened for modification	C:\Windows\SysWOW64\	igfxbv32.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1992 set thread context of 788	1992	fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779.exe	28
PID 328 set thread context of 940	328	igfxbv32.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
788	fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779.exe
788	fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779.exe
940	igfxbv32.exe
940	igfxbv32.exe
940	igfxbv32.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 788	1992	fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779.exe	28
PID 1992 wrote to memory of 788	1992	fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779.exe	28
PID 1992 wrote to memory of 788	1992	fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779.exe	28
PID 1992 wrote to memory of 788	1992	fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779.exe	28
PID 1992 wrote to memory of 788	1992	fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779.exe	28
PID 1992 wrote to memory of 788	1992	fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779.exe	28
PID 1992 wrote to memory of 788	1992	fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779.exe	28
PID 1992 wrote to memory of 788	1992	fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779.exe	28
PID 788 wrote to memory of 328	788	fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779.exe	29
PID 788 wrote to memory of 328	788	fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779.exe	29
PID 788 wrote to memory of 328	788	fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779.exe	29
PID 788 wrote to memory of 328	788	fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779.exe	29
PID 328 wrote to memory of 940	328	igfxbv32.exe	30
PID 328 wrote to memory of 940	328	igfxbv32.exe	30
PID 328 wrote to memory of 940	328	igfxbv32.exe	30
PID 328 wrote to memory of 940	328	igfxbv32.exe	30
PID 328 wrote to memory of 940	328	igfxbv32.exe	30
PID 328 wrote to memory of 940	328	igfxbv32.exe	30
PID 328 wrote to memory of 940	328	igfxbv32.exe	30
PID 328 wrote to memory of 940	328	igfxbv32.exe	30
PID 940 wrote to memory of 1224	940	igfxbv32.exe	16
PID 940 wrote to memory of 1224	940	igfxbv32.exe	16

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1224
- C:\Users\Admin\AppData\Local\Temp\fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779.exe
  "C:\Users\Admin\AppData\Local\Temp\fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Users\Admin\AppData\Local\Temp\fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779.exe
    "C:\Users\Admin\AppData\Local\Temp\fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779.exe"
    3⤵
    - Loads dropped DLL
    - Maps connected drives based on registry
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:788
  - - C:\Windows\SysWOW64\igfxbv32.exe
      "C:\Windows\SysWOW64\igfxbv32.exe" C:\Users\Admin\AppData\Local\Temp\FB79F4~1.EXE
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:328
    - - C:\Windows\SysWOW64\igfxbv32.exe
        
        "C:\Windows\SysWOW64\igfxbv32.exe" C:\Users\Admin\AppData\Local\Temp\FB79F4~1.EXE
        5⤵
        Modifies firewall policy service
        Executes dropped EXE
        Deletes itself
        Adds Run key to start application
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\igfxbv32.exe

Filesize
264KB

MD5
ee413845fea480f5df638da7993a39fe

SHA1
e4cec15d1f08a98e30e5702db9facf023d6710c8

SHA256
fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779

SHA512
3dfc6a444669ce33b532c8fe651a732c8f7f8880abcd82ebac594577850b09addc9aa75940f769cb2d50e3d00967b152fd6dad488ef2348794cc3b33b0900e53

Download Submit
C:\Windows\SysWOW64\igfxbv32.exe

Filesize
264KB

MD5
ee413845fea480f5df638da7993a39fe

SHA1
e4cec15d1f08a98e30e5702db9facf023d6710c8

SHA256
fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779

SHA512
3dfc6a444669ce33b532c8fe651a732c8f7f8880abcd82ebac594577850b09addc9aa75940f769cb2d50e3d00967b152fd6dad488ef2348794cc3b33b0900e53

Download Submit
C:\Windows\SysWOW64\igfxbv32.exe

Filesize
264KB

MD5
ee413845fea480f5df638da7993a39fe

SHA1
e4cec15d1f08a98e30e5702db9facf023d6710c8

SHA256
fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779

SHA512
3dfc6a444669ce33b532c8fe651a732c8f7f8880abcd82ebac594577850b09addc9aa75940f769cb2d50e3d00967b152fd6dad488ef2348794cc3b33b0900e53

Download Submit
\Windows\SysWOW64\igfxbv32.exe

Filesize
264KB

MD5
ee413845fea480f5df638da7993a39fe

SHA1
e4cec15d1f08a98e30e5702db9facf023d6710c8

SHA256
fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779

SHA512
3dfc6a444669ce33b532c8fe651a732c8f7f8880abcd82ebac594577850b09addc9aa75940f769cb2d50e3d00967b152fd6dad488ef2348794cc3b33b0900e53

Download Submit
\Windows\SysWOW64\igfxbv32.exe

Filesize
264KB

MD5
ee413845fea480f5df638da7993a39fe

SHA1
e4cec15d1f08a98e30e5702db9facf023d6710c8

SHA256
fb79f4641e1397547d2b2041cc9fb70e21bf5a50307c4f9bbbcb617bfaf59779

SHA512
3dfc6a444669ce33b532c8fe651a732c8f7f8880abcd82ebac594577850b09addc9aa75940f769cb2d50e3d00967b152fd6dad488ef2348794cc3b33b0900e53

Download Submit
memory/788-67-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/788-72-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/788-65-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/788-66-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/788-54-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/788-63-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/788-60-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/788-58-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/788-64-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/788-57-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/788-55-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/940-85-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/940-86-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/940-87-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1224-88-0x0000000002190000-0x00000000021AE000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads