Analysis
-
max time kernel
138s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 04:32
Static task
static1
Behavioral task
behavioral1
Sample
cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe
Resource
win10v2004-20220812-en
General
-
Target
cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe
-
Size
264KB
-
MD5
99443f0fe6928746ba6a8b41fff141d8
-
SHA1
28f1a01d758c7285f8b87eaf78e11588f031cd4f
-
SHA256
cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c
-
SHA512
fb23c8e0e80cb37337affd699d7f15969766f8efa3b507695b150a418f6c73cd93c4e29b12a83667c08457bd6861b33b80ad3bd91d79b1716c58aeea702641e9
-
SSDEEP
6144:tC5ujFI7ZTHzevFiTpTyyGkY/U/no//XkY/U/no//XMMXgMXgMXgMXgMXgMXgMXv:tpS7Rze9QpnGkY/U/no//XkY/U/no//X
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies firewall policy service 2 TTPs 8 IoCs
Processes:
igfxds64.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications igfxds64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\igfxds64.exe = "C:\\Windows\\SysWOW64\\igfxds64.exe:*:Enabled:Intel Display Starter" igfxds64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List igfxds64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile igfxds64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications igfxds64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\igfxds64.exe = "C:\\Windows\\SysWOW64\\igfxds64.exe:*:Enabled:Intel Display Starter" igfxds64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List igfxds64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile igfxds64.exe -
Executes dropped EXE 2 IoCs
Processes:
igfxds64.exeigfxds64.exepid process 380 igfxds64.exe 3316 igfxds64.exe -
Processes:
resource yara_rule behavioral2/memory/2856-133-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2856-135-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2856-136-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2856-137-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/2856-141-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3316-147-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3316-148-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3316-149-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/3316-150-0x0000000000400000-0x0000000000464000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
igfxds64.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run igfxds64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Intel Display Starter = "C:\\Windows\\SysWOW64\\igfxds64.exe" igfxds64.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exeigfxds64.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxds64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxds64.exe -
Drops file in System32 directory 5 IoCs
Processes:
cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exeigfxds64.exedescription ioc process File opened for modification C:\Windows\SysWOW64\ cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe File opened for modification C:\Windows\SysWOW64\igfxds64.exe cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe File created C:\Windows\SysWOW64\igfxds64.exe cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe File opened for modification C:\Windows\SysWOW64\ igfxds64.exe File opened for modification C:\Windows\SysWOW64\igfxds64.exe igfxds64.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exeigfxds64.exedescription pid process target process PID 1048 set thread context of 2856 1048 cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe PID 380 set thread context of 3316 380 igfxds64.exe igfxds64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exeigfxds64.exepid process 2856 cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe 2856 cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe 2856 cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe 2856 cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe 3316 igfxds64.exe 3316 igfxds64.exe 3316 igfxds64.exe 3316 igfxds64.exe 3316 igfxds64.exe 3316 igfxds64.exe 3316 igfxds64.exe 3316 igfxds64.exe 3316 igfxds64.exe 3316 igfxds64.exe 3316 igfxds64.exe 3316 igfxds64.exe 3316 igfxds64.exe 3316 igfxds64.exe 3316 igfxds64.exe 3316 igfxds64.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.execee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exeigfxds64.exeigfxds64.exedescription pid process target process PID 1048 wrote to memory of 2856 1048 cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe PID 1048 wrote to memory of 2856 1048 cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe PID 1048 wrote to memory of 2856 1048 cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe PID 1048 wrote to memory of 2856 1048 cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe PID 1048 wrote to memory of 2856 1048 cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe PID 1048 wrote to memory of 2856 1048 cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe PID 1048 wrote to memory of 2856 1048 cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe PID 1048 wrote to memory of 2856 1048 cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe PID 2856 wrote to memory of 380 2856 cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe igfxds64.exe PID 2856 wrote to memory of 380 2856 cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe igfxds64.exe PID 2856 wrote to memory of 380 2856 cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe igfxds64.exe PID 380 wrote to memory of 3316 380 igfxds64.exe igfxds64.exe PID 380 wrote to memory of 3316 380 igfxds64.exe igfxds64.exe PID 380 wrote to memory of 3316 380 igfxds64.exe igfxds64.exe PID 380 wrote to memory of 3316 380 igfxds64.exe igfxds64.exe PID 380 wrote to memory of 3316 380 igfxds64.exe igfxds64.exe PID 380 wrote to memory of 3316 380 igfxds64.exe igfxds64.exe PID 380 wrote to memory of 3316 380 igfxds64.exe igfxds64.exe PID 380 wrote to memory of 3316 380 igfxds64.exe igfxds64.exe PID 3316 wrote to memory of 3092 3316 igfxds64.exe Explorer.EXE PID 3316 wrote to memory of 3092 3316 igfxds64.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe"C:\Users\Admin\AppData\Local\Temp\cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe"C:\Users\Admin\AppData\Local\Temp\cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c.exe"3⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxds64.exe"C:\Windows\SysWOW64\igfxds64.exe" C:\Users\Admin\AppData\Local\Temp\CEE308~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxds64.exe"C:\Windows\SysWOW64\igfxds64.exe" C:\Users\Admin\AppData\Local\Temp\CEE308~1.EXE5⤵
- Modifies firewall policy service
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\igfxds64.exeFilesize
264KB
MD599443f0fe6928746ba6a8b41fff141d8
SHA128f1a01d758c7285f8b87eaf78e11588f031cd4f
SHA256cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c
SHA512fb23c8e0e80cb37337affd699d7f15969766f8efa3b507695b150a418f6c73cd93c4e29b12a83667c08457bd6861b33b80ad3bd91d79b1716c58aeea702641e9
-
C:\Windows\SysWOW64\igfxds64.exeFilesize
264KB
MD599443f0fe6928746ba6a8b41fff141d8
SHA128f1a01d758c7285f8b87eaf78e11588f031cd4f
SHA256cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c
SHA512fb23c8e0e80cb37337affd699d7f15969766f8efa3b507695b150a418f6c73cd93c4e29b12a83667c08457bd6861b33b80ad3bd91d79b1716c58aeea702641e9
-
C:\Windows\SysWOW64\igfxds64.exeFilesize
264KB
MD599443f0fe6928746ba6a8b41fff141d8
SHA128f1a01d758c7285f8b87eaf78e11588f031cd4f
SHA256cee308ef86dc9e5e1516ac483910f5b4d4e9f08576aaa9a16dfcbf64e538c53c
SHA512fb23c8e0e80cb37337affd699d7f15969766f8efa3b507695b150a418f6c73cd93c4e29b12a83667c08457bd6861b33b80ad3bd91d79b1716c58aeea702641e9
-
memory/380-138-0x0000000000000000-mapping.dmp
-
memory/2856-136-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/2856-137-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/2856-132-0x0000000000000000-mapping.dmp
-
memory/2856-135-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/2856-141-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/2856-133-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/3316-142-0x0000000000000000-mapping.dmp
-
memory/3316-147-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/3316-148-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/3316-149-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/3316-150-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB