Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2024, 23:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
78aa1f5eb26e10c602f0f4a2eb9ee80f.exe
Resource
win7-20231215-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
78aa1f5eb26e10c602f0f4a2eb9ee80f.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
78aa1f5eb26e10c602f0f4a2eb9ee80f.exe
-
Size
169KB
-
MD5
78aa1f5eb26e10c602f0f4a2eb9ee80f
-
SHA1
e1ce2a7431c92a804da4fab62baba651aa8fee52
-
SHA256
df09e45ba32d2c036cc4837402fe34950bb97fa7bc8c6fde0bf7d21cf9570ede
-
SHA512
93cda6e19b6e278e86538dbf1a2441f755ad5fda24568f649cc8c01ae14540cc3fdc14a6e5a200926ba64f0de8aea302c22f3407655aab1741502708735cb7a2
-
SSDEEP
3072:T2+GEkAt+XRiRvp3de87n+nvd0vmyRO0vWcmayqZSf3QL:rk43T+v6vmyUqZSv4
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Checks computer location settings 2 TTPs 15 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation igfxwl32.exe Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation igfxwl32.exe Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation igfxwl32.exe Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation igfxwl32.exe Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation igfxwl32.exe Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation igfxwl32.exe Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation igfxwl32.exe Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation igfxwl32.exe Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation igfxwl32.exe Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation 78aa1f5eb26e10c602f0f4a2eb9ee80f.exe Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation igfxwl32.exe Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation igfxwl32.exe Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation igfxwl32.exe Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation igfxwl32.exe Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation igfxwl32.exe -
Deletes itself 1 IoCs
pid Process 1000 igfxwl32.exe -
Executes dropped EXE 29 IoCs
pid Process 5044 igfxwl32.exe 1000 igfxwl32.exe 2004 igfxwl32.exe 2828 igfxwl32.exe 4348 igfxwl32.exe 764 igfxwl32.exe 2976 igfxwl32.exe 4704 igfxwl32.exe 4308 igfxwl32.exe 4460 igfxwl32.exe 1828 igfxwl32.exe 3464 igfxwl32.exe 2304 igfxwl32.exe 3724 igfxwl32.exe 3160 igfxwl32.exe 1532 igfxwl32.exe 1728 igfxwl32.exe 4064 igfxwl32.exe 3732 igfxwl32.exe 780 igfxwl32.exe 4236 igfxwl32.exe 1028 igfxwl32.exe 4472 igfxwl32.exe 2480 igfxwl32.exe 4344 igfxwl32.exe 1360 igfxwl32.exe 1032 igfxwl32.exe 4388 igfxwl32.exe 4308 igfxwl32.exe -
resource yara_rule behavioral2/memory/4304-0-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4304-2-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4304-4-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4304-3-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4304-38-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1000-43-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1000-45-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1000-44-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1000-47-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2828-53-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2828-56-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/764-65-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4704-71-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4704-73-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4460-81-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4460-83-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3464-89-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3464-92-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3724-98-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3724-100-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1532-107-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1532-110-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4064-116-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4064-119-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/780-125-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/780-130-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1028-135-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1028-140-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2480-145-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2480-150-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1360-155-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1360-160-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4388-166-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4388-170-0x0000000000400000-0x0000000000466000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 30 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwl32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwl32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwl32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwl32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwl32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwl32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwl32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwl32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwl32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwl32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwl32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwl32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwl32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 78aa1f5eb26e10c602f0f4a2eb9ee80f.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 78aa1f5eb26e10c602f0f4a2eb9ee80f.exe -
Drops file in System32 directory 45 IoCs
description ioc Process File created C:\Windows\SysWOW64\igfxwl32.exe igfxwl32.exe File opened for modification C:\Windows\SysWOW64\ igfxwl32.exe File opened for modification C:\Windows\SysWOW64\ 78aa1f5eb26e10c602f0f4a2eb9ee80f.exe File opened for modification C:\Windows\SysWOW64\ igfxwl32.exe File opened for modification C:\Windows\SysWOW64\igfxwl32.exe igfxwl32.exe File opened for modification C:\Windows\SysWOW64\igfxwl32.exe igfxwl32.exe File opened for modification C:\Windows\SysWOW64\igfxwl32.exe igfxwl32.exe File opened for modification C:\Windows\SysWOW64\ igfxwl32.exe File opened for modification C:\Windows\SysWOW64\ igfxwl32.exe File opened for modification C:\Windows\SysWOW64\igfxwl32.exe igfxwl32.exe File created C:\Windows\SysWOW64\igfxwl32.exe igfxwl32.exe File created C:\Windows\SysWOW64\igfxwl32.exe igfxwl32.exe File opened for modification C:\Windows\SysWOW64\ igfxwl32.exe File created C:\Windows\SysWOW64\igfxwl32.exe igfxwl32.exe File opened for modification C:\Windows\SysWOW64\igfxwl32.exe igfxwl32.exe File opened for modification C:\Windows\SysWOW64\ igfxwl32.exe File opened for modification C:\Windows\SysWOW64\igfxwl32.exe igfxwl32.exe File opened for modification C:\Windows\SysWOW64\ igfxwl32.exe File opened for modification C:\Windows\SysWOW64\igfxwl32.exe igfxwl32.exe File opened for modification C:\Windows\SysWOW64\ igfxwl32.exe File created C:\Windows\SysWOW64\igfxwl32.exe 78aa1f5eb26e10c602f0f4a2eb9ee80f.exe File created C:\Windows\SysWOW64\igfxwl32.exe igfxwl32.exe File opened for modification C:\Windows\SysWOW64\ igfxwl32.exe File opened for modification C:\Windows\SysWOW64\igfxwl32.exe igfxwl32.exe File created C:\Windows\SysWOW64\igfxwl32.exe igfxwl32.exe File opened for modification C:\Windows\SysWOW64\ igfxwl32.exe File created C:\Windows\SysWOW64\igfxwl32.exe igfxwl32.exe File opened for modification C:\Windows\SysWOW64\igfxwl32.exe igfxwl32.exe File opened for modification C:\Windows\SysWOW64\ igfxwl32.exe File created C:\Windows\SysWOW64\igfxwl32.exe igfxwl32.exe File opened for modification C:\Windows\SysWOW64\igfxwl32.exe igfxwl32.exe File created C:\Windows\SysWOW64\igfxwl32.exe igfxwl32.exe File created C:\Windows\SysWOW64\igfxwl32.exe igfxwl32.exe File opened for modification C:\Windows\SysWOW64\igfxwl32.exe igfxwl32.exe File created C:\Windows\SysWOW64\igfxwl32.exe igfxwl32.exe File opened for modification C:\Windows\SysWOW64\igfxwl32.exe igfxwl32.exe File opened for modification C:\Windows\SysWOW64\ igfxwl32.exe File opened for modification C:\Windows\SysWOW64\ igfxwl32.exe File created C:\Windows\SysWOW64\igfxwl32.exe igfxwl32.exe File opened for modification C:\Windows\SysWOW64\igfxwl32.exe 78aa1f5eb26e10c602f0f4a2eb9ee80f.exe File created C:\Windows\SysWOW64\igfxwl32.exe igfxwl32.exe File opened for modification C:\Windows\SysWOW64\igfxwl32.exe igfxwl32.exe File opened for modification C:\Windows\SysWOW64\igfxwl32.exe igfxwl32.exe File opened for modification C:\Windows\SysWOW64\ igfxwl32.exe File created C:\Windows\SysWOW64\igfxwl32.exe igfxwl32.exe -
Suspicious use of SetThreadContext 15 IoCs
description pid Process procid_target PID 4216 set thread context of 4304 4216 78aa1f5eb26e10c602f0f4a2eb9ee80f.exe 93 PID 5044 set thread context of 1000 5044 igfxwl32.exe 98 PID 2004 set thread context of 2828 2004 igfxwl32.exe 100 PID 4348 set thread context of 764 4348 igfxwl32.exe 103 PID 2976 set thread context of 4704 2976 igfxwl32.exe 105 PID 4308 set thread context of 4460 4308 igfxwl32.exe 107 PID 1828 set thread context of 3464 1828 igfxwl32.exe 109 PID 2304 set thread context of 3724 2304 igfxwl32.exe 111 PID 3160 set thread context of 1532 3160 igfxwl32.exe 113 PID 1728 set thread context of 4064 1728 igfxwl32.exe 115 PID 3732 set thread context of 780 3732 igfxwl32.exe 117 PID 4236 set thread context of 1028 4236 igfxwl32.exe 119 PID 4472 set thread context of 2480 4472 igfxwl32.exe 121 PID 4344 set thread context of 1360 4344 igfxwl32.exe 123 PID 1032 set thread context of 4388 1032 igfxwl32.exe 125 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 78aa1f5eb26e10c602f0f4a2eb9ee80f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwl32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4216 78aa1f5eb26e10c602f0f4a2eb9ee80f.exe 4216 78aa1f5eb26e10c602f0f4a2eb9ee80f.exe 4304 78aa1f5eb26e10c602f0f4a2eb9ee80f.exe 4304 78aa1f5eb26e10c602f0f4a2eb9ee80f.exe 4304 78aa1f5eb26e10c602f0f4a2eb9ee80f.exe 4304 78aa1f5eb26e10c602f0f4a2eb9ee80f.exe 5044 igfxwl32.exe 5044 igfxwl32.exe 1000 igfxwl32.exe 1000 igfxwl32.exe 1000 igfxwl32.exe 1000 igfxwl32.exe 2004 igfxwl32.exe 2004 igfxwl32.exe 2828 igfxwl32.exe 2828 igfxwl32.exe 2828 igfxwl32.exe 2828 igfxwl32.exe 4348 igfxwl32.exe 4348 igfxwl32.exe 764 igfxwl32.exe 764 igfxwl32.exe 764 igfxwl32.exe 764 igfxwl32.exe 2976 igfxwl32.exe 2976 igfxwl32.exe 4704 igfxwl32.exe 4704 igfxwl32.exe 4704 igfxwl32.exe 4704 igfxwl32.exe 4308 igfxwl32.exe 4308 igfxwl32.exe 4460 igfxwl32.exe 4460 igfxwl32.exe 4460 igfxwl32.exe 4460 igfxwl32.exe 1828 igfxwl32.exe 1828 igfxwl32.exe 3464 igfxwl32.exe 3464 igfxwl32.exe 3464 igfxwl32.exe 3464 igfxwl32.exe 2304 igfxwl32.exe 2304 igfxwl32.exe 3724 igfxwl32.exe 3724 igfxwl32.exe 3724 igfxwl32.exe 3724 igfxwl32.exe 3160 igfxwl32.exe 3160 igfxwl32.exe 1532 igfxwl32.exe 1532 igfxwl32.exe 1532 igfxwl32.exe 1532 igfxwl32.exe 1728 igfxwl32.exe 1728 igfxwl32.exe 4064 igfxwl32.exe 4064 igfxwl32.exe 4064 igfxwl32.exe 4064 igfxwl32.exe 3732 igfxwl32.exe 3732 igfxwl32.exe 780 igfxwl32.exe 780 igfxwl32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4216 wrote to memory of 4304 4216 78aa1f5eb26e10c602f0f4a2eb9ee80f.exe 93 PID 4216 wrote to memory of 4304 4216 78aa1f5eb26e10c602f0f4a2eb9ee80f.exe 93 PID 4216 wrote to memory of 4304 4216 78aa1f5eb26e10c602f0f4a2eb9ee80f.exe 93 PID 4216 wrote to memory of 4304 4216 78aa1f5eb26e10c602f0f4a2eb9ee80f.exe 93 PID 4216 wrote to memory of 4304 4216 78aa1f5eb26e10c602f0f4a2eb9ee80f.exe 93 PID 4216 wrote to memory of 4304 4216 78aa1f5eb26e10c602f0f4a2eb9ee80f.exe 93 PID 4216 wrote to memory of 4304 4216 78aa1f5eb26e10c602f0f4a2eb9ee80f.exe 93 PID 4304 wrote to memory of 5044 4304 78aa1f5eb26e10c602f0f4a2eb9ee80f.exe 97 PID 4304 wrote to memory of 5044 4304 78aa1f5eb26e10c602f0f4a2eb9ee80f.exe 97 PID 4304 wrote to memory of 5044 4304 78aa1f5eb26e10c602f0f4a2eb9ee80f.exe 97 PID 5044 wrote to memory of 1000 5044 igfxwl32.exe 98 PID 5044 wrote to memory of 1000 5044 igfxwl32.exe 98 PID 5044 wrote to memory of 1000 5044 igfxwl32.exe 98 PID 5044 wrote to memory of 1000 5044 igfxwl32.exe 98 PID 5044 wrote to memory of 1000 5044 igfxwl32.exe 98 PID 5044 wrote to memory of 1000 5044 igfxwl32.exe 98 PID 5044 wrote to memory of 1000 5044 igfxwl32.exe 98 PID 1000 wrote to memory of 2004 1000 igfxwl32.exe 99 PID 1000 wrote to memory of 2004 1000 igfxwl32.exe 99 PID 1000 wrote to memory of 2004 1000 igfxwl32.exe 99 PID 2004 wrote to memory of 2828 2004 igfxwl32.exe 100 PID 2004 wrote to memory of 2828 2004 igfxwl32.exe 100 PID 2004 wrote to memory of 2828 2004 igfxwl32.exe 100 PID 2004 wrote to memory of 2828 2004 igfxwl32.exe 100 PID 2004 wrote to memory of 2828 2004 igfxwl32.exe 100 PID 2004 wrote to memory of 2828 2004 igfxwl32.exe 100 PID 2004 wrote to memory of 2828 2004 igfxwl32.exe 100 PID 2828 wrote to memory of 4348 2828 igfxwl32.exe 102 PID 2828 wrote to memory of 4348 2828 igfxwl32.exe 102 PID 2828 wrote to memory of 4348 2828 igfxwl32.exe 102 PID 4348 wrote to memory of 764 4348 igfxwl32.exe 103 PID 4348 wrote to memory of 764 4348 igfxwl32.exe 103 PID 4348 wrote to memory of 764 4348 igfxwl32.exe 103 PID 4348 wrote to memory of 764 4348 igfxwl32.exe 103 PID 4348 wrote to memory of 764 4348 igfxwl32.exe 103 PID 4348 wrote to memory of 764 4348 igfxwl32.exe 103 PID 4348 wrote to memory of 764 4348 igfxwl32.exe 103 PID 764 wrote to memory of 2976 764 igfxwl32.exe 104 PID 764 wrote to memory of 2976 764 igfxwl32.exe 104 PID 764 wrote to memory of 2976 764 igfxwl32.exe 104 PID 2976 wrote to memory of 4704 2976 igfxwl32.exe 105 PID 2976 wrote to memory of 4704 2976 igfxwl32.exe 105 PID 2976 wrote to memory of 4704 2976 igfxwl32.exe 105 PID 2976 wrote to memory of 4704 2976 igfxwl32.exe 105 PID 2976 wrote to memory of 4704 2976 igfxwl32.exe 105 PID 2976 wrote to memory of 4704 2976 igfxwl32.exe 105 PID 2976 wrote to memory of 4704 2976 igfxwl32.exe 105 PID 4704 wrote to memory of 4308 4704 igfxwl32.exe 106 PID 4704 wrote to memory of 4308 4704 igfxwl32.exe 106 PID 4704 wrote to memory of 4308 4704 igfxwl32.exe 106 PID 4308 wrote to memory of 4460 4308 igfxwl32.exe 107 PID 4308 wrote to memory of 4460 4308 igfxwl32.exe 107 PID 4308 wrote to memory of 4460 4308 igfxwl32.exe 107 PID 4308 wrote to memory of 4460 4308 igfxwl32.exe 107 PID 4308 wrote to memory of 4460 4308 igfxwl32.exe 107 PID 4308 wrote to memory of 4460 4308 igfxwl32.exe 107 PID 4308 wrote to memory of 4460 4308 igfxwl32.exe 107 PID 4460 wrote to memory of 1828 4460 igfxwl32.exe 108 PID 4460 wrote to memory of 1828 4460 igfxwl32.exe 108 PID 4460 wrote to memory of 1828 4460 igfxwl32.exe 108 PID 1828 wrote to memory of 3464 1828 igfxwl32.exe 109 PID 1828 wrote to memory of 3464 1828 igfxwl32.exe 109 PID 1828 wrote to memory of 3464 1828 igfxwl32.exe 109 PID 1828 wrote to memory of 3464 1828 igfxwl32.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\78aa1f5eb26e10c602f0f4a2eb9ee80f.exe"C:\Users\Admin\AppData\Local\Temp\78aa1f5eb26e10c602f0f4a2eb9ee80f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\78aa1f5eb26e10c602f0f4a2eb9ee80f.exe"C:\Users\Admin\AppData\Local\Temp\78aa1f5eb26e10c602f0f4a2eb9ee80f.exe"2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\igfxwl32.exe"C:\Windows\system32\igfxwl32.exe" C:\Users\Admin\AppData\Local\Temp\78AA1F~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\igfxwl32.exe"C:\Windows\system32\igfxwl32.exe" C:\Users\Admin\AppData\Local\Temp\78AA1F~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\igfxwl32.exe"C:\Windows\system32\igfxwl32.exe" C:\Windows\SysWOW64\igfxwl32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\igfxwl32.exe"C:\Windows\system32\igfxwl32.exe" C:\Windows\SysWOW64\igfxwl32.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\igfxwl32.exe"C:\Windows\system32\igfxwl32.exe" C:\Windows\SysWOW64\igfxwl32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\igfxwl32.exe"C:\Windows\system32\igfxwl32.exe" C:\Windows\SysWOW64\igfxwl32.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\igfxwl32.exe"C:\Windows\system32\igfxwl32.exe" C:\Windows\SysWOW64\igfxwl32.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\igfxwl32.exe"C:\Windows\system32\igfxwl32.exe" C:\Windows\SysWOW64\igfxwl32.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\igfxwl32.exe"C:\Windows\system32\igfxwl32.exe" C:\Windows\SysWOW64\igfxwl32.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\SysWOW64\igfxwl32.exe"C:\Windows\system32\igfxwl32.exe" C:\Windows\SysWOW64\igfxwl32.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\igfxwl32.exe"C:\Windows\system32\igfxwl32.exe" C:\Windows\SysWOW64\igfxwl32.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\igfxwl32.exe"C:\Windows\system32\igfxwl32.exe" C:\Windows\SysWOW64\igfxwl32.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3464 -
C:\Windows\SysWOW64\igfxwl32.exe"C:\Windows\system32\igfxwl32.exe" C:\Windows\SysWOW64\igfxwl32.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:2304 -
C:\Windows\SysWOW64\igfxwl32.exe"C:\Windows\system32\igfxwl32.exe" C:\Windows\SysWOW64\igfxwl32.exe16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3724 -
C:\Windows\SysWOW64\igfxwl32.exe"C:\Windows\system32\igfxwl32.exe" C:\Windows\SysWOW64\igfxwl32.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:3160 -
C:\Windows\SysWOW64\igfxwl32.exe"C:\Windows\system32\igfxwl32.exe" C:\Windows\SysWOW64\igfxwl32.exe18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1532 -
C:\Windows\SysWOW64\igfxwl32.exe"C:\Windows\system32\igfxwl32.exe" C:\Windows\SysWOW64\igfxwl32.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:1728 -
C:\Windows\SysWOW64\igfxwl32.exe"C:\Windows\system32\igfxwl32.exe" C:\Windows\SysWOW64\igfxwl32.exe20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4064 -
C:\Windows\SysWOW64\igfxwl32.exe"C:\Windows\system32\igfxwl32.exe" C:\Windows\SysWOW64\igfxwl32.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:3732 -
C:\Windows\SysWOW64\igfxwl32.exe"C:\Windows\system32\igfxwl32.exe" C:\Windows\SysWOW64\igfxwl32.exe22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:780 -
C:\Windows\SysWOW64\igfxwl32.exe"C:\Windows\system32\igfxwl32.exe" C:\Windows\SysWOW64\igfxwl32.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4236 -
C:\Windows\SysWOW64\igfxwl32.exe"C:\Windows\system32\igfxwl32.exe" C:\Windows\SysWOW64\igfxwl32.exe24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
PID:1028 -
C:\Windows\SysWOW64\igfxwl32.exe"C:\Windows\system32\igfxwl32.exe" C:\Windows\SysWOW64\igfxwl32.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4472 -
C:\Windows\SysWOW64\igfxwl32.exe"C:\Windows\system32\igfxwl32.exe" C:\Windows\SysWOW64\igfxwl32.exe26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
PID:2480 -
C:\Windows\SysWOW64\igfxwl32.exe"C:\Windows\system32\igfxwl32.exe" C:\Windows\SysWOW64\igfxwl32.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4344 -
C:\Windows\SysWOW64\igfxwl32.exe"C:\Windows\system32\igfxwl32.exe" C:\Windows\SysWOW64\igfxwl32.exe28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
PID:1360 -
C:\Windows\SysWOW64\igfxwl32.exe"C:\Windows\system32\igfxwl32.exe" C:\Windows\SysWOW64\igfxwl32.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1032 -
C:\Windows\SysWOW64\igfxwl32.exe"C:\Windows\system32\igfxwl32.exe" C:\Windows\SysWOW64\igfxwl32.exe30⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
PID:4388 -
C:\Windows\SysWOW64\igfxwl32.exe"C:\Windows\system32\igfxwl32.exe" C:\Windows\SysWOW64\igfxwl32.exe31⤵
- Executes dropped EXE
PID:4308
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
169KB
MD578aa1f5eb26e10c602f0f4a2eb9ee80f
SHA1e1ce2a7431c92a804da4fab62baba651aa8fee52
SHA256df09e45ba32d2c036cc4837402fe34950bb97fa7bc8c6fde0bf7d21cf9570ede
SHA51293cda6e19b6e278e86538dbf1a2441f755ad5fda24568f649cc8c01ae14540cc3fdc14a6e5a200926ba64f0de8aea302c22f3407655aab1741502708735cb7a2