Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
13/02/2024, 11:45
General
- Target DSC-NewPicture10.JPG_www.24x7filehosting.exe
- Size 194KB
- Sample240213-nwp5hsab29
- SHA256 9406a9e12983fcbb9163819a51e803cf51d146674ab94ca423ec693206898478
Malware Config
Extracted
-
metasploit
-
encoder/call4_dword_xor
Signatures
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Checks computer location settings 2 TTPs 36 IoCs
Looks up country code configured in the registry, likely geofence.
- Deletes itself 1 IoCs
- Executes dropped EXE 35 IoCs
- Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 36 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DSC-NewPicture10.JPG_www.24x7filehosting.exe"C:\Users\Admin\AppData\Local\Temp\DSC-NewPicture10.JPG_www.24x7filehosting.exe"1⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Users\Admin\AppData\Local\Temp\DSC-NE~1.EXE2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE3⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE4⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE5⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE7⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE9⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE11⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE13⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE15⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE17⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE19⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE21⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE23⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE25⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE27⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE29⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE30⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE31⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE32⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE33⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE34⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE35⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE36⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxqvs64.exe"C:\Windows\system32\igfxqvs64.exe" C:\Windows\SysWOW64\IGFXQV~1.EXE37⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
igfxqvs64.exe
igfxqvs64.exe
memory/212-76-0x0000000000400000-0x000000000047B000-memory.dmp
memory/212-75-0x0000000000400000-0x000000000047B000-memory.dmp
memory/212-79-0x0000000000400000-0x000000000047B000-memory.dmp
memory/456-90-0x0000000000400000-0x000000000047B000-memory.dmp
memory/456-94-0x0000000000400000-0x000000000047B000-memory.dmp
memory/456-91-0x0000000000550000-0x0000000000553000-memory.dmp
memory/556-169-0x0000000000400000-0x000000000047B000-memory.dmp
memory/556-167-0x0000000000400000-0x000000000047B000-memory.dmp
memory/556-166-0x0000000000400000-0x000000000047B000-memory.dmp
memory/852-130-0x0000000000400000-0x000000000047B000-memory.dmp
memory/852-131-0x0000000000400000-0x000000000047B000-memory.dmp
memory/852-133-0x0000000000400000-0x000000000047B000-memory.dmp
memory/888-151-0x0000000000400000-0x000000000047B000-memory.dmp
memory/888-155-0x0000000000400000-0x000000000047B000-memory.dmp
memory/888-152-0x00000000006F0000-0x0000000000700000-memory.dmp
memory/1168-195-0x0000000000400000-0x000000000047B000-memory.dmp
memory/1244-88-0x0000000000400000-0x000000000047B000-memory.dmp
memory/1244-86-0x0000000000500000-0x0000000000503000-memory.dmp
memory/1244-85-0x0000000000400000-0x000000000047B000-memory.dmp
memory/1436-182-0x0000000000400000-0x000000000047B000-memory.dmp
memory/1436-186-0x0000000000400000-0x000000000047B000-memory.dmp
memory/1436-183-0x00000000005E0000-0x00000000005FB000-memory.dmp
memory/1868-176-0x0000000000400000-0x000000000047B000-memory.dmp
memory/1868-178-0x0000000002150000-0x0000000002153000-memory.dmp
memory/1868-180-0x0000000000400000-0x000000000047B000-memory.dmp
memory/1872-126-0x00000000006E0000-0x00000000006FB000-memory.dmp
memory/1872-128-0x0000000000400000-0x000000000047B000-memory.dmp
memory/1872-125-0x0000000000400000-0x000000000047B000-memory.dmp
memory/2240-140-0x0000000000400000-0x000000000047B000-memory.dmp
memory/2240-141-0x0000000000510000-0x0000000000513000-memory.dmp
memory/2240-144-0x0000000000400000-0x000000000047B000-memory.dmp
memory/2416-95-0x0000000000400000-0x000000000047B000-memory.dmp
memory/2416-99-0x0000000000400000-0x000000000047B000-memory.dmp
memory/2416-96-0x00000000022D0000-0x00000000022D3000-memory.dmp
memory/2492-105-0x0000000000400000-0x000000000047B000-memory.dmp
memory/2492-101-0x0000000002140000-0x000000000215B000-memory.dmp
memory/2492-100-0x0000000000400000-0x000000000047B000-memory.dmp
memory/2812-38-0x0000000000400000-0x000000000047B000-memory.dmp
memory/2812-2-0x0000000000400000-0x000000000047B000-memory.dmp
memory/2812-3-0x0000000000510000-0x0000000000513000-memory.dmp
memory/2812-0-0x0000000000400000-0x000000000047B000-memory.dmp
memory/2812-1-0x0000000000400000-0x000000000047B000-memory.dmp
memory/2956-83-0x0000000000400000-0x000000000047B000-memory.dmp
memory/2956-81-0x0000000000400000-0x000000000047B000-memory.dmp
memory/2956-80-0x0000000000400000-0x000000000047B000-memory.dmp
memory/3028-111-0x0000000002080000-0x000000000209B000-memory.dmp
memory/3028-110-0x0000000000400000-0x000000000047B000-memory.dmp
memory/3028-114-0x0000000000400000-0x000000000047B000-memory.dmp
memory/3056-188-0x0000000000550000-0x0000000000553000-memory.dmp
memory/3056-191-0x0000000000400000-0x000000000047B000-memory.dmp
memory/3056-187-0x0000000000400000-0x000000000047B000-memory.dmp
memory/3424-161-0x0000000000400000-0x000000000047B000-memory.dmp
memory/3424-162-0x0000000000720000-0x000000000073B000-memory.dmp
memory/3424-164-0x0000000000400000-0x000000000047B000-memory.dmp
memory/3596-120-0x0000000000400000-0x000000000047B000-memory.dmp
memory/3596-121-0x0000000002D20000-0x0000000002D23000-memory.dmp
memory/3596-123-0x0000000000400000-0x000000000047B000-memory.dmp
memory/3604-104-0x0000000000400000-0x000000000047B000-memory.dmp
memory/3604-108-0x0000000000400000-0x000000000047B000-memory.dmp
memory/3604-106-0x0000000000510000-0x000000000052B000-memory.dmp
memory/3696-157-0x00000000005D0000-0x00000000005EB000-memory.dmp
memory/3696-160-0x0000000000400000-0x000000000047B000-memory.dmp
memory/3696-156-0x0000000000400000-0x000000000047B000-memory.dmp
memory/3868-49-0x0000000000400000-0x000000000047B000-memory.dmp
memory/3868-50-0x0000000000620000-0x000000000063B000-memory.dmp
memory/3868-53-0x0000000000400000-0x000000000047B000-memory.dmp
memory/4012-66-0x0000000000660000-0x000000000066C000-memory.dmp
memory/4012-65-0x0000000000400000-0x000000000047B000-memory.dmp
memory/4012-69-0x0000000000400000-0x000000000047B000-memory.dmp
memory/4060-115-0x0000000000720000-0x0000000000723000-memory.dmp
memory/4060-117-0x0000000000400000-0x000000000047B000-memory.dmp
memory/4060-119-0x0000000000720000-0x0000000000723000-memory.dmp
memory/4104-58-0x0000000000400000-0x000000000047B000-memory.dmp
memory/4104-55-0x0000000000400000-0x000000000047B000-memory.dmp
memory/4104-56-0x00000000020C0000-0x00000000020C3000-memory.dmp
memory/4616-42-0x0000000000400000-0x000000000047B000-memory.dmp
memory/4616-40-0x0000000000400000-0x000000000047B000-memory.dmp
memory/4616-39-0x0000000000400000-0x000000000047B000-memory.dmp
memory/4752-135-0x0000000000400000-0x000000000047B000-memory.dmp
memory/4752-136-0x0000000000660000-0x000000000067B000-memory.dmp
memory/4752-138-0x0000000000400000-0x000000000047B000-memory.dmp
memory/4768-61-0x0000000000400000-0x000000000047B000-memory.dmp
memory/4768-64-0x0000000000400000-0x000000000047B000-memory.dmp
memory/4768-60-0x0000000000400000-0x000000000047B000-memory.dmp
memory/4892-172-0x0000000000400000-0x000000000047B000-memory.dmp
memory/4892-173-0x0000000000500000-0x0000000000503000-memory.dmp
memory/4892-177-0x0000000000400000-0x000000000047B000-memory.dmp
memory/4972-71-0x0000000000400000-0x000000000047B000-memory.dmp
memory/4972-70-0x0000000000400000-0x000000000047B000-memory.dmp
memory/4972-74-0x0000000000400000-0x000000000047B000-memory.dmp
memory/5084-47-0x0000000000400000-0x000000000047B000-memory.dmp
memory/5084-45-0x0000000000510000-0x0000000000513000-memory.dmp
memory/5084-44-0x0000000000400000-0x000000000047B000-memory.dmp
memory/5088-150-0x0000000000400000-0x000000000047B000-memory.dmp
memory/5088-147-0x0000000002140000-0x0000000002143000-memory.dmp
memory/5088-146-0x0000000000400000-0x000000000047B000-memory.dmp
memory/5088-145-0x0000000000400000-0x000000000047B000-memory.dmp