Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    21/01/2024, 23:58

General

  • Target

    igfxctv32.exe

  • Size

    139KB

  • MD5

    b5202ea069462c2e8b64ff72100faa28

  • SHA1

    7ffd5668f76d34515eb979bc38dde3b4daf84f74

  • SHA256

    d445f21a4bd3aa1d61ad5e26df3535e611d44b1d9c70149987ee6979f8e9d3e4

  • SHA512

    02a1edf3721d8c471f254dcb7dbf0a5b7ed7448e8f37e218fe5f8429b81dff501eb9edf97b628f4eaa4c204ed809349bd3434d6fde8c7988084689a1366670a1

  • SSDEEP

    3072:1whYNSrlVZOlVbKLbHLAxY1RThXrz6hI+hc99r4T183HtlNNuA:Sm6oVbu74Y1RThXr914wH9QA

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 26 IoCs
  • Loads dropped DLL 52 IoCs
  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Maps connected drives based on registry 3 TTPs 28 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 39 IoCs
  • Suspicious use of SetThreadContext 14 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\igfxctv32.exe
    "C:\Users\Admin\AppData\Local\Temp\igfxctv32.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2284
    • C:\Users\Admin\AppData\Local\Temp\igfxctv32.exe
      "C:\Users\Admin\AppData\Local\Temp\igfxctv32.exe"
      2⤵
      • Loads dropped DLL
      • Maps connected drives based on registry
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3068
      • C:\Windows\SysWOW64\igfxctv32.exe
        "C:\Windows\system32\igfxctv32.exe" C:\Users\Admin\AppData\Local\Temp\IGFXCT~1.EXE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2720
        • C:\Windows\SysWOW64\igfxctv32.exe
          "C:\Windows\system32\igfxctv32.exe" C:\Users\Admin\AppData\Local\Temp\IGFXCT~1.EXE
          4⤵
          • Deletes itself
          • Executes dropped EXE
          • Loads dropped DLL
          • Maps connected drives based on registry
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2696
          • C:\Windows\SysWOW64\igfxctv32.exe
            "C:\Windows\system32\igfxctv32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2392
            • C:\Windows\SysWOW64\igfxctv32.exe
              "C:\Windows\system32\igfxctv32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Maps connected drives based on registry
              • Drops file in System32 directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2516
              • C:\Windows\SysWOW64\igfxctv32.exe
                "C:\Windows\system32\igfxctv32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:1052
                • C:\Windows\SysWOW64\igfxctv32.exe
                  "C:\Windows\system32\igfxctv32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Maps connected drives based on registry
                  • Drops file in System32 directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:2468
                  • C:\Windows\SysWOW64\igfxctv32.exe
                    "C:\Windows\system32\igfxctv32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetThreadContext
                    • Suspicious use of WriteProcessMemory
                    PID:588
                    • C:\Windows\SysWOW64\igfxctv32.exe
                      "C:\Windows\system32\igfxctv32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Maps connected drives based on registry
                      • Drops file in System32 directory
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:2740
                      • C:\Windows\SysWOW64\igfxctv32.exe
                        "C:\Windows\system32\igfxctv32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of SetThreadContext
                        • Suspicious use of WriteProcessMemory
                        PID:2040
                        • C:\Windows\SysWOW64\igfxctv32.exe
                          "C:\Windows\system32\igfxctv32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Maps connected drives based on registry
                          • Drops file in System32 directory
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:2072
                          • C:\Windows\SysWOW64\igfxctv32.exe
                            "C:\Windows\system32\igfxctv32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Suspicious use of SetThreadContext
                            PID:2088
                            • C:\Windows\SysWOW64\igfxctv32.exe
                              "C:\Windows\system32\igfxctv32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE
                              14⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Maps connected drives based on registry
                              • Drops file in System32 directory
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1036
                              • C:\Windows\SysWOW64\igfxctv32.exe
                                "C:\Windows\system32\igfxctv32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE
                                15⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Suspicious use of SetThreadContext
                                PID:1724
                                • C:\Windows\SysWOW64\igfxctv32.exe
                                  "C:\Windows\system32\igfxctv32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE
                                  16⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Maps connected drives based on registry
                                  • Drops file in System32 directory
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:1764
                                  • C:\Windows\SysWOW64\igfxctv32.exe
                                    "C:\Windows\system32\igfxctv32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE
                                    17⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Suspicious use of SetThreadContext
                                    PID:2052
                                    • C:\Windows\SysWOW64\igfxctv32.exe
                                      "C:\Windows\system32\igfxctv32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE
                                      18⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Maps connected drives based on registry
                                      • Drops file in System32 directory
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:760
                                      • C:\Windows\SysWOW64\igfxctv32.exe
                                        "C:\Windows\system32\igfxctv32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE
                                        19⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Suspicious use of SetThreadContext
                                        PID:1736
                                        • C:\Windows\SysWOW64\igfxctv32.exe
                                          "C:\Windows\system32\igfxctv32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE
                                          20⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Maps connected drives based on registry
                                          • Drops file in System32 directory
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:1704
                                          • C:\Windows\SysWOW64\igfxctv32.exe
                                            "C:\Windows\system32\igfxctv32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE
                                            21⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Suspicious use of SetThreadContext
                                            PID:2848
                                            • C:\Windows\SysWOW64\igfxctv32.exe
                                              "C:\Windows\system32\igfxctv32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE
                                              22⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Maps connected drives based on registry
                                              • Drops file in System32 directory
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:2724
                                              • C:\Windows\SysWOW64\igfxctv32.exe
                                                "C:\Windows\system32\igfxctv32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE
                                                23⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Suspicious use of SetThreadContext
                                                PID:2596
                                                • C:\Windows\SysWOW64\igfxctv32.exe
                                                  "C:\Windows\system32\igfxctv32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Maps connected drives based on registry
                                                  • Drops file in System32 directory
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:2616
                                                  • C:\Windows\SysWOW64\igfxctv32.exe
                                                    "C:\Windows\system32\igfxctv32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Suspicious use of SetThreadContext
                                                    PID:2876
                                                    • C:\Windows\SysWOW64\igfxctv32.exe
                                                      "C:\Windows\system32\igfxctv32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Maps connected drives based on registry
                                                      • Drops file in System32 directory
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:2884
                                                      • C:\Windows\SysWOW64\igfxctv32.exe
                                                        "C:\Windows\system32\igfxctv32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Suspicious use of SetThreadContext
                                                        PID:1680
                                                        • C:\Windows\SysWOW64\igfxctv32.exe
                                                          "C:\Windows\system32\igfxctv32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE
                                                          28⤵
                                                          • Executes dropped EXE
                                                          • Maps connected drives based on registry
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:552

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Windows\SysWOW64\igfxctv32.exe

          Filesize

          139KB

          MD5

          b5202ea069462c2e8b64ff72100faa28

          SHA1

          7ffd5668f76d34515eb979bc38dde3b4daf84f74

          SHA256

          d445f21a4bd3aa1d61ad5e26df3535e611d44b1d9c70149987ee6979f8e9d3e4

          SHA512

          02a1edf3721d8c471f254dcb7dbf0a5b7ed7448e8f37e218fe5f8429b81dff501eb9edf97b628f4eaa4c204ed809349bd3434d6fde8c7988084689a1366670a1

        • \Windows\SysWOW64\igfxctv32.exe

          Filesize

          126KB

          MD5

          0bd7111935b72b16d91b78f6f34b7bbc

          SHA1

          cad6d64970fca1abdf1c9f449a66fc12c04d5615

          SHA256

          954915b0a36d0c6609a0e4c4a29a2b54e0f4052514ca754cfcf9d12e1d3b6fcf

          SHA512

          fb685ba7c3f23d13e31716a481a7e6568116e1e0edf7aad63c97053e7fdb5a9a8beafe0977d66988ec1746cd5c40d8cf997a528a5a22b6c8ea06978c760bf977

        • \Windows\SysWOW64\igfxctv32.exe

          Filesize

          85KB

          MD5

          b9b900d9241ae57f65809474f1809245

          SHA1

          73c170773f31ee9f5210322448fec4ede2043db5

          SHA256

          65ee5bb848d4e2f48b32a44bf7b1df75586decd4e1c79bedef059eddb12c78c5

          SHA512

          a2537cc2c69f0b5db21d97cebc0f4e8c91e338dcdcc04f34b4a06b99a16f896aa073ecb95e26b0909a5a0a75ba200c48c872d598d2fe66ed9796cf2f8f235747

        • \Windows\SysWOW64\igfxctv32.exe

          Filesize

          107KB

          MD5

          b47e1ac6a488aa96889a0efd4df24832

          SHA1

          fb9b5f6c2655487359337128eeb09cc0a76a5324

          SHA256

          7eb9118510bdd904fdddb784577eb76c688ced943328b2706d438c91b0a58826

          SHA512

          c4399906647d459a034e8a476b9233f7deb93c3165097b754b9e58bb83f5814aa3948786e0409f0d9d324727b06c95566587576dbab68e13d865c59b33f7d6aa

        • memory/760-172-0x0000000000400000-0x000000000045A000-memory.dmp

          Filesize

          360KB

        • memory/760-158-0x0000000000400000-0x000000000045A000-memory.dmp

          Filesize

          360KB

        • memory/1036-138-0x0000000000400000-0x000000000045A000-memory.dmp

          Filesize

          360KB

        • memory/1704-188-0x0000000000400000-0x000000000045A000-memory.dmp

          Filesize

          360KB

        • memory/1764-157-0x0000000000400000-0x000000000045A000-memory.dmp

          Filesize

          360KB

        • memory/2072-120-0x0000000000400000-0x000000000045A000-memory.dmp

          Filesize

          360KB

        • memory/2468-72-0x0000000000400000-0x000000000045A000-memory.dmp

          Filesize

          360KB

        • memory/2516-59-0x0000000000400000-0x000000000045A000-memory.dmp

          Filesize

          360KB

        • memory/2616-218-0x0000000000400000-0x000000000045A000-memory.dmp

          Filesize

          360KB

        • memory/2696-33-0x0000000000400000-0x000000000045A000-memory.dmp

          Filesize

          360KB

        • memory/2696-31-0x0000000000400000-0x000000000045A000-memory.dmp

          Filesize

          360KB

        • memory/2696-32-0x0000000000400000-0x000000000045A000-memory.dmp

          Filesize

          360KB

        • memory/2696-38-0x0000000000400000-0x000000000045A000-memory.dmp

          Filesize

          360KB

        • memory/2724-203-0x0000000000400000-0x000000000045A000-memory.dmp

          Filesize

          360KB

        • memory/2740-91-0x0000000000400000-0x000000000045A000-memory.dmp

          Filesize

          360KB

        • memory/2884-232-0x0000000000400000-0x000000000045A000-memory.dmp

          Filesize

          360KB

        • memory/2884-220-0x0000000000400000-0x000000000045A000-memory.dmp

          Filesize

          360KB

        • memory/3068-0-0x0000000000400000-0x000000000045A000-memory.dmp

          Filesize

          360KB

        • memory/3068-24-0x0000000000400000-0x000000000045A000-memory.dmp

          Filesize

          360KB

        • memory/3068-4-0x0000000000400000-0x000000000045A000-memory.dmp

          Filesize

          360KB

        • memory/3068-6-0x0000000000400000-0x000000000045A000-memory.dmp

          Filesize

          360KB

        • memory/3068-7-0x0000000000400000-0x000000000045A000-memory.dmp

          Filesize

          360KB

        • memory/3068-8-0x0000000000400000-0x000000000045A000-memory.dmp

          Filesize

          360KB

        • memory/3068-2-0x0000000000400000-0x000000000045A000-memory.dmp

          Filesize

          360KB

        • memory/3068-3-0x0000000000400000-0x000000000045A000-memory.dmp

          Filesize

          360KB