Analysis
-
max time kernel
148s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/01/2024, 03:56
Static task
static1
Behavioral task
behavioral1
Sample
6ea94e3ef956c8567aad333e0c6e6190.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6ea94e3ef956c8567aad333e0c6e6190.exe
Resource
win10v2004-20231215-en
General
-
Target
6ea94e3ef956c8567aad333e0c6e6190.exe
-
Size
169KB
-
MD5
6ea94e3ef956c8567aad333e0c6e6190
-
SHA1
8ffdb2eb888b727ab63b639131395cb72cac6f6c
-
SHA256
34c74776e99de0b4c0e6beb741a47922aba72203aab945e744d3c8f85fef2afb
-
SHA512
4b3d75aa22a330825fd1e508c93b149b99f4735c0f87114b6de63bc2129eecb05b8df68739bc5f34f81f9954f38a93ab0ef113d7c548f313bfe0416d92e4b442
-
SSDEEP
3072:U6OobBSE5zhZKyoF2w3uUBKtPB3iQjFhYl6xTI+gzJZLlOwP7ASAh3ntiirq7:HBDhgyoF2IuUEtPB3iQjrYl6iRzUWcSb
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Deletes itself 1 IoCs
pid Process 844 igfxwk32.exe -
Executes dropped EXE 28 IoCs
pid Process 2980 igfxwk32.exe 844 igfxwk32.exe 2688 igfxwk32.exe 2492 igfxwk32.exe 2920 igfxwk32.exe 744 igfxwk32.exe 1020 igfxwk32.exe 1480 igfxwk32.exe 1528 igfxwk32.exe 2020 igfxwk32.exe 1892 igfxwk32.exe 968 igfxwk32.exe 2368 igfxwk32.exe 1692 igfxwk32.exe 1336 igfxwk32.exe 900 igfxwk32.exe 2360 igfxwk32.exe 2380 igfxwk32.exe 2484 igfxwk32.exe 2956 igfxwk32.exe 2812 igfxwk32.exe 2692 igfxwk32.exe 2564 igfxwk32.exe 3048 igfxwk32.exe 2896 igfxwk32.exe 472 igfxwk32.exe 364 igfxwk32.exe 2604 igfxwk32.exe -
Loads dropped DLL 28 IoCs
pid Process 816 6ea94e3ef956c8567aad333e0c6e6190.exe 2980 igfxwk32.exe 844 igfxwk32.exe 2688 igfxwk32.exe 2492 igfxwk32.exe 2920 igfxwk32.exe 744 igfxwk32.exe 1020 igfxwk32.exe 1480 igfxwk32.exe 1528 igfxwk32.exe 2020 igfxwk32.exe 1892 igfxwk32.exe 968 igfxwk32.exe 2368 igfxwk32.exe 1692 igfxwk32.exe 1336 igfxwk32.exe 900 igfxwk32.exe 2360 igfxwk32.exe 2380 igfxwk32.exe 2484 igfxwk32.exe 2956 igfxwk32.exe 2812 igfxwk32.exe 2692 igfxwk32.exe 2564 igfxwk32.exe 3048 igfxwk32.exe 2896 igfxwk32.exe 472 igfxwk32.exe 364 igfxwk32.exe -
resource yara_rule behavioral1/memory/816-2-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/816-3-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/816-4-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/816-6-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/816-7-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/816-8-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/816-9-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/816-17-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/844-28-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/844-29-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/844-30-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/844-33-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2492-49-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/744-63-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1480-78-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2020-96-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/968-112-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1692-128-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/900-138-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/900-145-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2380-162-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2956-178-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2692-194-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/3048-210-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/472-222-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/472-227-0x0000000000400000-0x0000000000466000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 30 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 6ea94e3ef956c8567aad333e0c6e6190.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 6ea94e3ef956c8567aad333e0c6e6190.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwk32.exe -
Drops file in System32 directory 42 IoCs
description ioc Process File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe 6ea94e3ef956c8567aad333e0c6e6190.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ 6ea94e3ef956c8567aad333e0c6e6190.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe 6ea94e3ef956c8567aad333e0c6e6190.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe -
Suspicious use of SetThreadContext 15 IoCs
description pid Process procid_target PID 3024 set thread context of 816 3024 6ea94e3ef956c8567aad333e0c6e6190.exe 28 PID 2980 set thread context of 844 2980 igfxwk32.exe 30 PID 2688 set thread context of 2492 2688 igfxwk32.exe 32 PID 2920 set thread context of 744 2920 igfxwk32.exe 36 PID 1020 set thread context of 1480 1020 igfxwk32.exe 38 PID 1528 set thread context of 2020 1528 igfxwk32.exe 40 PID 1892 set thread context of 968 1892 igfxwk32.exe 42 PID 2368 set thread context of 1692 2368 igfxwk32.exe 44 PID 1336 set thread context of 900 1336 igfxwk32.exe 46 PID 2360 set thread context of 2380 2360 igfxwk32.exe 48 PID 2484 set thread context of 2956 2484 igfxwk32.exe 50 PID 2812 set thread context of 2692 2812 igfxwk32.exe 52 PID 2564 set thread context of 3048 2564 igfxwk32.exe 54 PID 2896 set thread context of 472 2896 igfxwk32.exe 56 PID 364 set thread context of 2604 364 igfxwk32.exe 58 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 816 6ea94e3ef956c8567aad333e0c6e6190.exe 816 6ea94e3ef956c8567aad333e0c6e6190.exe 844 igfxwk32.exe 844 igfxwk32.exe 2492 igfxwk32.exe 2492 igfxwk32.exe 744 igfxwk32.exe 744 igfxwk32.exe 1480 igfxwk32.exe 1480 igfxwk32.exe 2020 igfxwk32.exe 2020 igfxwk32.exe 968 igfxwk32.exe 968 igfxwk32.exe 1692 igfxwk32.exe 1692 igfxwk32.exe 900 igfxwk32.exe 900 igfxwk32.exe 2380 igfxwk32.exe 2380 igfxwk32.exe 2956 igfxwk32.exe 2956 igfxwk32.exe 2692 igfxwk32.exe 2692 igfxwk32.exe 3048 igfxwk32.exe 3048 igfxwk32.exe 472 igfxwk32.exe 472 igfxwk32.exe 2604 igfxwk32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3024 wrote to memory of 816 3024 6ea94e3ef956c8567aad333e0c6e6190.exe 28 PID 3024 wrote to memory of 816 3024 6ea94e3ef956c8567aad333e0c6e6190.exe 28 PID 3024 wrote to memory of 816 3024 6ea94e3ef956c8567aad333e0c6e6190.exe 28 PID 3024 wrote to memory of 816 3024 6ea94e3ef956c8567aad333e0c6e6190.exe 28 PID 3024 wrote to memory of 816 3024 6ea94e3ef956c8567aad333e0c6e6190.exe 28 PID 3024 wrote to memory of 816 3024 6ea94e3ef956c8567aad333e0c6e6190.exe 28 PID 3024 wrote to memory of 816 3024 6ea94e3ef956c8567aad333e0c6e6190.exe 28 PID 816 wrote to memory of 2980 816 6ea94e3ef956c8567aad333e0c6e6190.exe 29 PID 816 wrote to memory of 2980 816 6ea94e3ef956c8567aad333e0c6e6190.exe 29 PID 816 wrote to memory of 2980 816 6ea94e3ef956c8567aad333e0c6e6190.exe 29 PID 816 wrote to memory of 2980 816 6ea94e3ef956c8567aad333e0c6e6190.exe 29 PID 2980 wrote to memory of 844 2980 igfxwk32.exe 30 PID 2980 wrote to memory of 844 2980 igfxwk32.exe 30 PID 2980 wrote to memory of 844 2980 igfxwk32.exe 30 PID 2980 wrote to memory of 844 2980 igfxwk32.exe 30 PID 2980 wrote to memory of 844 2980 igfxwk32.exe 30 PID 2980 wrote to memory of 844 2980 igfxwk32.exe 30 PID 2980 wrote to memory of 844 2980 igfxwk32.exe 30 PID 844 wrote to memory of 2688 844 igfxwk32.exe 31 PID 844 wrote to memory of 2688 844 igfxwk32.exe 31 PID 844 wrote to memory of 2688 844 igfxwk32.exe 31 PID 844 wrote to memory of 2688 844 igfxwk32.exe 31 PID 2688 wrote to memory of 2492 2688 igfxwk32.exe 32 PID 2688 wrote to memory of 2492 2688 igfxwk32.exe 32 PID 2688 wrote to memory of 2492 2688 igfxwk32.exe 32 PID 2688 wrote to memory of 2492 2688 igfxwk32.exe 32 PID 2688 wrote to memory of 2492 2688 igfxwk32.exe 32 PID 2688 wrote to memory of 2492 2688 igfxwk32.exe 32 PID 2688 wrote to memory of 2492 2688 igfxwk32.exe 32 PID 2492 wrote to memory of 2920 2492 igfxwk32.exe 33 PID 2492 wrote to memory of 2920 2492 igfxwk32.exe 33 PID 2492 wrote to memory of 2920 2492 igfxwk32.exe 33 PID 2492 wrote to memory of 2920 2492 igfxwk32.exe 33 PID 2920 wrote to memory of 744 2920 igfxwk32.exe 36 PID 2920 wrote to memory of 744 2920 igfxwk32.exe 36 PID 2920 wrote to memory of 744 2920 igfxwk32.exe 36 PID 2920 wrote to memory of 744 2920 igfxwk32.exe 36 PID 2920 wrote to memory of 744 2920 igfxwk32.exe 36 PID 2920 wrote to memory of 744 2920 igfxwk32.exe 36 PID 2920 wrote to memory of 744 2920 igfxwk32.exe 36 PID 744 wrote to memory of 1020 744 igfxwk32.exe 37 PID 744 wrote to memory of 1020 744 igfxwk32.exe 37 PID 744 wrote to memory of 1020 744 igfxwk32.exe 37 PID 744 wrote to memory of 1020 744 igfxwk32.exe 37 PID 1020 wrote to memory of 1480 1020 igfxwk32.exe 38 PID 1020 wrote to memory of 1480 1020 igfxwk32.exe 38 PID 1020 wrote to memory of 1480 1020 igfxwk32.exe 38 PID 1020 wrote to memory of 1480 1020 igfxwk32.exe 38 PID 1020 wrote to memory of 1480 1020 igfxwk32.exe 38 PID 1020 wrote to memory of 1480 1020 igfxwk32.exe 38 PID 1020 wrote to memory of 1480 1020 igfxwk32.exe 38 PID 1480 wrote to memory of 1528 1480 igfxwk32.exe 39 PID 1480 wrote to memory of 1528 1480 igfxwk32.exe 39 PID 1480 wrote to memory of 1528 1480 igfxwk32.exe 39 PID 1480 wrote to memory of 1528 1480 igfxwk32.exe 39 PID 1528 wrote to memory of 2020 1528 igfxwk32.exe 40 PID 1528 wrote to memory of 2020 1528 igfxwk32.exe 40 PID 1528 wrote to memory of 2020 1528 igfxwk32.exe 40 PID 1528 wrote to memory of 2020 1528 igfxwk32.exe 40 PID 1528 wrote to memory of 2020 1528 igfxwk32.exe 40 PID 1528 wrote to memory of 2020 1528 igfxwk32.exe 40 PID 1528 wrote to memory of 2020 1528 igfxwk32.exe 40 PID 2020 wrote to memory of 1892 2020 igfxwk32.exe 41 PID 2020 wrote to memory of 1892 2020 igfxwk32.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ea94e3ef956c8567aad333e0c6e6190.exe"C:\Users\Admin\AppData\Local\Temp\6ea94e3ef956c8567aad333e0c6e6190.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\6ea94e3ef956c8567aad333e0c6e6190.exe"C:\Users\Admin\AppData\Local\Temp\6ea94e3ef956c8567aad333e0c6e6190.exe"2⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Users\Admin\AppData\Local\Temp\6EA94E~1.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Users\Admin\AppData\Local\Temp\6EA94E~1.EXE4⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1892 -
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:968 -
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2368 -
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1692 -
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1336 -
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:900 -
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2360 -
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2380 -
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2484 -
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2956 -
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2812 -
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2692 -
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2564 -
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3048 -
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2896 -
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:472 -
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:364 -
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe30⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:2604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD54bf8115b2937c0e17bc87c3bfeb96103
SHA17bc76dc8bf5adce185d4df71df4adc6b72a8113d
SHA2565a1c54ac7bdc56cc851e7396a9bca938c662e08cbb06ce2fb7ba1af0ee4357ba
SHA5120d826e29734f9f8b430d4c896834e8f9db9d18cf669b4e69195c3868e136a85845049f6e76c228f70b2bac38528756d3f1cd1673de616e4f6dbb0fce5ecd2bc2
-
Filesize
169KB
MD56ea94e3ef956c8567aad333e0c6e6190
SHA18ffdb2eb888b727ab63b639131395cb72cac6f6c
SHA25634c74776e99de0b4c0e6beb741a47922aba72203aab945e744d3c8f85fef2afb
SHA5124b3d75aa22a330825fd1e508c93b149b99f4735c0f87114b6de63bc2129eecb05b8df68739bc5f34f81f9954f38a93ab0ef113d7c548f313bfe0416d92e4b442