Analysis
-
max time kernel
144s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 06:57
Static task
static1
Behavioral task
behavioral1
Sample
b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe
Resource
win10v2004-20220901-en
General
-
Target
b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe
-
Size
237KB
-
MD5
e8840fbf9dc879cdf2646d9732aaf4fb
-
SHA1
b4b9f15c9a97b318aa3ee624704621286610f73d
-
SHA256
b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637
-
SHA512
7658a51b5baff89ca68fc0f3defa36ffd2db217dcc7234e292c0cc2fbaa0cf7538b07592820f3f83417c93e46294807876c287b127441488db1a55fa488a099e
-
SSDEEP
3072:eGSriql1GY0iYCN/kkSophVyPb4/zS5DG5OUZ0Twff+Zuw8WyL+u:WWyT0qkxophPpfZ02
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies firewall policy service 2 TTPs 8 IoCs
Processes:
igfxhk64.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile igfxhk64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications igfxhk64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\igfxhk64.exe = "C:\\Windows\\SysWOW64\\igfxhk64.exe:*:Enabled:Intel Help Console" igfxhk64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List igfxhk64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile igfxhk64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications igfxhk64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\igfxhk64.exe = "C:\\Windows\\SysWOW64\\igfxhk64.exe:*:Enabled:Intel Help Console" igfxhk64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List igfxhk64.exe -
Executes dropped EXE 2 IoCs
Processes:
igfxhk64.exeigfxhk64.exepid process 4248 igfxhk64.exe 1716 igfxhk64.exe -
Processes:
resource yara_rule behavioral2/memory/376-133-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/376-135-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/376-136-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/376-137-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/376-141-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1716-146-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1716-147-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1716-148-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/memory/1716-149-0x0000000000400000-0x0000000000464000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
igfxhk64.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run igfxhk64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Intel Help Console = "C:\\Windows\\SysWOW64\\igfxhk64.exe" igfxhk64.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
igfxhk64.exeb4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxhk64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxhk64.exe -
Drops file in System32 directory 5 IoCs
Processes:
igfxhk64.exeb4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exedescription ioc process File opened for modification C:\Windows\SysWOW64\ igfxhk64.exe File opened for modification C:\Windows\SysWOW64\igfxhk64.exe igfxhk64.exe File opened for modification C:\Windows\SysWOW64\ b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe File opened for modification C:\Windows\SysWOW64\igfxhk64.exe b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe File created C:\Windows\SysWOW64\igfxhk64.exe b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exeigfxhk64.exedescription pid process target process PID 4932 set thread context of 376 4932 b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe PID 4248 set thread context of 1716 4248 igfxhk64.exe igfxhk64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exeigfxhk64.exepid process 376 b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe 376 b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe 376 b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe 376 b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe 1716 igfxhk64.exe 1716 igfxhk64.exe 1716 igfxhk64.exe 1716 igfxhk64.exe 1716 igfxhk64.exe 1716 igfxhk64.exe 1716 igfxhk64.exe 1716 igfxhk64.exe 1716 igfxhk64.exe 1716 igfxhk64.exe 1716 igfxhk64.exe 1716 igfxhk64.exe 1716 igfxhk64.exe 1716 igfxhk64.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exeb4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exeigfxhk64.exeigfxhk64.exedescription pid process target process PID 4932 wrote to memory of 376 4932 b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe PID 4932 wrote to memory of 376 4932 b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe PID 4932 wrote to memory of 376 4932 b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe PID 4932 wrote to memory of 376 4932 b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe PID 4932 wrote to memory of 376 4932 b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe PID 4932 wrote to memory of 376 4932 b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe PID 4932 wrote to memory of 376 4932 b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe PID 4932 wrote to memory of 376 4932 b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe PID 376 wrote to memory of 4248 376 b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe igfxhk64.exe PID 376 wrote to memory of 4248 376 b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe igfxhk64.exe PID 376 wrote to memory of 4248 376 b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe igfxhk64.exe PID 4248 wrote to memory of 1716 4248 igfxhk64.exe igfxhk64.exe PID 4248 wrote to memory of 1716 4248 igfxhk64.exe igfxhk64.exe PID 4248 wrote to memory of 1716 4248 igfxhk64.exe igfxhk64.exe PID 4248 wrote to memory of 1716 4248 igfxhk64.exe igfxhk64.exe PID 4248 wrote to memory of 1716 4248 igfxhk64.exe igfxhk64.exe PID 4248 wrote to memory of 1716 4248 igfxhk64.exe igfxhk64.exe PID 4248 wrote to memory of 1716 4248 igfxhk64.exe igfxhk64.exe PID 4248 wrote to memory of 1716 4248 igfxhk64.exe igfxhk64.exe PID 1716 wrote to memory of 2948 1716 igfxhk64.exe Explorer.EXE PID 1716 wrote to memory of 2948 1716 igfxhk64.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe"C:\Users\Admin\AppData\Local\Temp\b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe"C:\Users\Admin\AppData\Local\Temp\b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637.exe"3⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxhk64.exe"C:\Windows\SysWOW64\igfxhk64.exe" C:\Users\Admin\AppData\Local\Temp\B4C75C~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxhk64.exe"C:\Windows\SysWOW64\igfxhk64.exe" C:\Users\Admin\AppData\Local\Temp\B4C75C~1.EXE5⤵
- Modifies firewall policy service
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\igfxhk64.exeFilesize
237KB
MD5e8840fbf9dc879cdf2646d9732aaf4fb
SHA1b4b9f15c9a97b318aa3ee624704621286610f73d
SHA256b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637
SHA5127658a51b5baff89ca68fc0f3defa36ffd2db217dcc7234e292c0cc2fbaa0cf7538b07592820f3f83417c93e46294807876c287b127441488db1a55fa488a099e
-
C:\Windows\SysWOW64\igfxhk64.exeFilesize
237KB
MD5e8840fbf9dc879cdf2646d9732aaf4fb
SHA1b4b9f15c9a97b318aa3ee624704621286610f73d
SHA256b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637
SHA5127658a51b5baff89ca68fc0f3defa36ffd2db217dcc7234e292c0cc2fbaa0cf7538b07592820f3f83417c93e46294807876c287b127441488db1a55fa488a099e
-
C:\Windows\SysWOW64\igfxhk64.exeFilesize
237KB
MD5e8840fbf9dc879cdf2646d9732aaf4fb
SHA1b4b9f15c9a97b318aa3ee624704621286610f73d
SHA256b4c75cde1442704ad67e162fdd087f7b6d0680cd2e349e4a5665e0a948390637
SHA5127658a51b5baff89ca68fc0f3defa36ffd2db217dcc7234e292c0cc2fbaa0cf7538b07592820f3f83417c93e46294807876c287b127441488db1a55fa488a099e
-
memory/376-136-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/376-137-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/376-132-0x0000000000000000-mapping.dmp
-
memory/376-135-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/376-141-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/376-133-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/1716-142-0x0000000000000000-mapping.dmp
-
memory/1716-146-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/1716-147-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/1716-148-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/1716-149-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/4248-138-0x0000000000000000-mapping.dmp