Analysis
-
max time kernel
156s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 18:02
Static task
static1
Behavioral task
behavioral1
Sample
1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe
Resource
win10v2004-20220812-en
General
-
Target
1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe
-
Size
262KB
-
MD5
fb587d7566a6948d5aa91f6ce3c02fe8
-
SHA1
829651bca7d2f28b2cad79050ffc3154eec53082
-
SHA256
1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26
-
SHA512
829d5151c5a230efbfeb30441143db3b8e6933ec910630b5d2cf7ba84de3a92249b63c34ade2c06cff2a0615bca0080040bd69c4c994cfb47290bc4f6f2e553b
-
SSDEEP
6144:m25j2GUiafXga6kEwMBJpE6NEMFkLOVDS5+7F:m25y/fswMBJq1WBVDbF
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies firewall policy service 2 TTPs 8 IoCs
Processes:
igfxps64.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications igfxps64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\igfxps64.exe = "C:\\Windows\\SysWOW64\\igfxps64.exe:*:Enabled:Intel Software Manager" igfxps64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List igfxps64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile igfxps64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications igfxps64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\igfxps64.exe = "C:\\Windows\\SysWOW64\\igfxps64.exe:*:Enabled:Intel Software Manager" igfxps64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List igfxps64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile igfxps64.exe -
Executes dropped EXE 2 IoCs
Processes:
igfxps64.exeigfxps64.exepid process 532 igfxps64.exe 2192 igfxps64.exe -
Processes:
resource yara_rule behavioral2/memory/2728-133-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2728-135-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2728-136-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2728-137-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2728-138-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2728-142-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2192-147-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2192-148-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2192-149-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2192-150-0x0000000000400000-0x0000000000466000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
igfxps64.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run igfxps64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Intel Software Manager = "C:\\Windows\\SysWOW64\\igfxps64.exe" igfxps64.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exeigfxps64.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxps64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxps64.exe -
Drops file in System32 directory 5 IoCs
Processes:
1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exeigfxps64.exedescription ioc process File opened for modification C:\Windows\SysWOW64\ 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe File opened for modification C:\Windows\SysWOW64\igfxps64.exe 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe File created C:\Windows\SysWOW64\igfxps64.exe 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe File opened for modification C:\Windows\SysWOW64\ igfxps64.exe File opened for modification C:\Windows\SysWOW64\igfxps64.exe igfxps64.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exeigfxps64.exedescription pid process target process PID 4648 set thread context of 2728 4648 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe PID 532 set thread context of 2192 532 igfxps64.exe igfxps64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exeigfxps64.exepid process 2728 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe 2728 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe 2728 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe 2728 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe 2192 igfxps64.exe 2192 igfxps64.exe 2192 igfxps64.exe 2192 igfxps64.exe 2192 igfxps64.exe 2192 igfxps64.exe 2192 igfxps64.exe 2192 igfxps64.exe 2192 igfxps64.exe 2192 igfxps64.exe 2192 igfxps64.exe 2192 igfxps64.exe 2192 igfxps64.exe 2192 igfxps64.exe 2192 igfxps64.exe 2192 igfxps64.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exeigfxps64.exeigfxps64.exedescription pid process target process PID 4648 wrote to memory of 2728 4648 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe PID 4648 wrote to memory of 2728 4648 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe PID 4648 wrote to memory of 2728 4648 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe PID 4648 wrote to memory of 2728 4648 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe PID 4648 wrote to memory of 2728 4648 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe PID 4648 wrote to memory of 2728 4648 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe PID 4648 wrote to memory of 2728 4648 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe PID 4648 wrote to memory of 2728 4648 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe PID 2728 wrote to memory of 532 2728 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe igfxps64.exe PID 2728 wrote to memory of 532 2728 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe igfxps64.exe PID 2728 wrote to memory of 532 2728 1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe igfxps64.exe PID 532 wrote to memory of 2192 532 igfxps64.exe igfxps64.exe PID 532 wrote to memory of 2192 532 igfxps64.exe igfxps64.exe PID 532 wrote to memory of 2192 532 igfxps64.exe igfxps64.exe PID 532 wrote to memory of 2192 532 igfxps64.exe igfxps64.exe PID 532 wrote to memory of 2192 532 igfxps64.exe igfxps64.exe PID 532 wrote to memory of 2192 532 igfxps64.exe igfxps64.exe PID 532 wrote to memory of 2192 532 igfxps64.exe igfxps64.exe PID 532 wrote to memory of 2192 532 igfxps64.exe igfxps64.exe PID 2192 wrote to memory of 2556 2192 igfxps64.exe Explorer.EXE PID 2192 wrote to memory of 2556 2192 igfxps64.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe"C:\Users\Admin\AppData\Local\Temp\1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe"C:\Users\Admin\AppData\Local\Temp\1d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26.exe"3⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxps64.exe"C:\Windows\SysWOW64\igfxps64.exe" C:\Users\Admin\AppData\Local\Temp\1D3D52~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxps64.exe"C:\Windows\SysWOW64\igfxps64.exe" C:\Users\Admin\AppData\Local\Temp\1D3D52~1.EXE5⤵
- Modifies firewall policy service
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\igfxps64.exeFilesize
262KB
MD5fb587d7566a6948d5aa91f6ce3c02fe8
SHA1829651bca7d2f28b2cad79050ffc3154eec53082
SHA2561d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26
SHA512829d5151c5a230efbfeb30441143db3b8e6933ec910630b5d2cf7ba84de3a92249b63c34ade2c06cff2a0615bca0080040bd69c4c994cfb47290bc4f6f2e553b
-
C:\Windows\SysWOW64\igfxps64.exeFilesize
262KB
MD5fb587d7566a6948d5aa91f6ce3c02fe8
SHA1829651bca7d2f28b2cad79050ffc3154eec53082
SHA2561d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26
SHA512829d5151c5a230efbfeb30441143db3b8e6933ec910630b5d2cf7ba84de3a92249b63c34ade2c06cff2a0615bca0080040bd69c4c994cfb47290bc4f6f2e553b
-
C:\Windows\SysWOW64\igfxps64.exeFilesize
262KB
MD5fb587d7566a6948d5aa91f6ce3c02fe8
SHA1829651bca7d2f28b2cad79050ffc3154eec53082
SHA2561d3d5220f170b8e75690da0eb9a92bb02d1f84d6599b6e8ec181a0b3dd8bff26
SHA512829d5151c5a230efbfeb30441143db3b8e6933ec910630b5d2cf7ba84de3a92249b63c34ade2c06cff2a0615bca0080040bd69c4c994cfb47290bc4f6f2e553b
-
memory/532-139-0x0000000000000000-mapping.dmp
-
memory/2192-147-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2192-143-0x0000000000000000-mapping.dmp
-
memory/2192-148-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2192-149-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2192-150-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2728-138-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2728-137-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2728-136-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2728-135-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2728-142-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2728-133-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2728-132-0x0000000000000000-mapping.dmp