Analysis
- max time kernel
144s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
26/01/2024, 00:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
75e042dcde7e747b2b65078c520793ae.exe
Resource
win7-20231215-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
75e042dcde7e747b2b65078c520793ae.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 75e042dcde7e747b2b65078c520793ae.exe
- Size 174KB
- Sample240126-af8p2abbdm
- SHA256 a46c45f5cae16ee7105d2c59f192cd851f3674c6ff9a8a525178911c3e99b6a8
- MD5 75e042dcde7e747b2b65078c520793ae
- SHA1 082a01c74e981e5f711de29bc037f2681969033c
- SHA512 a7883b316b72fb9fa572ba0f930bd3f8abfb4e337d12016e31f28924b6051f40302490aac03a2f7fc9134d8ffc86493e99662e96329872aeb09ef6ee834c2380
- SSDEEP 3072:E6obs2IlIG5ttxQp7TojDrsQWbNpk/Z98INfai6MdzyX8JOuiY0Y:cSlO7TmsQSNO/ZHR/yX8JOuiC
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
metasploit
Version
-
encoder/call4_dword_xor
Signatures
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Checks computer location settings 2 TTPs 15 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation igfxwt32.exe Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation igfxwt32.exe Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation igfxwt32.exe Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation 75e042dcde7e747b2b65078c520793ae.exe Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation igfxwt32.exe Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation igfxwt32.exe Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation igfxwt32.exe Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation igfxwt32.exe Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation igfxwt32.exe Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation igfxwt32.exe Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation igfxwt32.exe Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation igfxwt32.exe Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation igfxwt32.exe Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation igfxwt32.exe Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation igfxwt32.exe - Deletes itself 1 IoCs
pid Process 2392 igfxwt32.exe - Executes dropped EXE 29 IoCs
pid Process 2232 igfxwt32.exe 2392 igfxwt32.exe 552 igfxwt32.exe 1776 igfxwt32.exe 3692 igfxwt32.exe 4472 igfxwt32.exe 2844 igfxwt32.exe 5072 igfxwt32.exe 4448 igfxwt32.exe 2876 igfxwt32.exe 1672 igfxwt32.exe 1928 igfxwt32.exe 4644 igfxwt32.exe 4792 igfxwt32.exe 1804 igfxwt32.exe 3424 igfxwt32.exe 3352 igfxwt32.exe 3044 igfxwt32.exe 2672 igfxwt32.exe 3932 igfxwt32.exe 2552 igfxwt32.exe 3444 igfxwt32.exe 208 igfxwt32.exe 4196 igfxwt32.exe 3644 igfxwt32.exe 2756 igfxwt32.exe 988 igfxwt32.exe 400 igfxwt32.exe 1004 igfxwt32.exe -
resource yara_rule behavioral2/memory/680-0-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/680-4-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/680-3-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/680-2-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/680-38-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2392-44-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2392-46-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2392-47-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1776-54-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1776-57-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4472-64-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4472-65-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/5072-73-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/5072-75-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2876-81-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2876-84-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1928-90-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1928-92-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1928-95-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4792-101-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4792-103-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4792-105-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3424-111-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3424-114-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3044-121-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3044-124-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3932-131-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3932-135-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3444-141-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3444-146-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4196-152-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4196-156-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2756-162-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2756-167-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/400-173-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/400-177-0x0000000000400000-0x0000000000466000-memory.dmp upx - Maps connected drives based on registry 3 TTPs 30 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 75e042dcde7e747b2b65078c520793ae.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 75e042dcde7e747b2b65078c520793ae.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwt32.exe - Drops file in System32 directory 45 IoCs
description ioc Process File created C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\ igfxwt32.exe File opened for modification C:\Windows\SysWOW64\ igfxwt32.exe File opened for modification C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File created C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\ igfxwt32.exe File opened for modification C:\Windows\SysWOW64\ igfxwt32.exe File opened for modification C:\Windows\SysWOW64\ igfxwt32.exe File opened for modification C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File created C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\ igfxwt32.exe File opened for modification C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File created C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File created C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\ igfxwt32.exe File opened for modification C:\Windows\SysWOW64\ igfxwt32.exe File created C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File created C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\ igfxwt32.exe File opened for modification C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\ 75e042dcde7e747b2b65078c520793ae.exe File opened for modification C:\Windows\SysWOW64\ igfxwt32.exe File opened for modification C:\Windows\SysWOW64\ igfxwt32.exe File created C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File created C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\ igfxwt32.exe File created C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File created C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File created C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\ igfxwt32.exe File opened for modification C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File created C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\igfxwt32.exe 75e042dcde7e747b2b65078c520793ae.exe File opened for modification C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\ igfxwt32.exe File created C:\Windows\SysWOW64\igfxwt32.exe 75e042dcde7e747b2b65078c520793ae.exe File created C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe - Suspicious use of SetThreadContext 15 IoCs
description pid Process procid_target PID 3820 set thread context of 680 3820 75e042dcde7e747b2b65078c520793ae.exe 94 PID 2232 set thread context of 2392 2232 igfxwt32.exe 98 PID 552 set thread context of 1776 552 igfxwt32.exe 100 PID 3692 set thread context of 4472 3692 igfxwt32.exe 103 PID 2844 set thread context of 5072 2844 igfxwt32.exe 105 PID 4448 set thread context of 2876 4448 igfxwt32.exe 107 PID 1672 set thread context of 1928 1672 igfxwt32.exe 109 PID 4644 set thread context of 4792 4644 igfxwt32.exe 111 PID 1804 set thread context of 3424 1804 igfxwt32.exe 113 PID 3352 set thread context of 3044 3352 igfxwt32.exe 115 PID 2672 set thread context of 3932 2672 igfxwt32.exe 117 PID 2552 set thread context of 3444 2552 igfxwt32.exe 119 PID 208 set thread context of 4196 208 igfxwt32.exe 121 PID 3644 set thread context of 2756 3644 igfxwt32.exe 123 PID 988 set thread context of 400 988 igfxwt32.exe 125 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwt32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwt32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwt32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwt32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 75e042dcde7e747b2b65078c520793ae.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwt32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwt32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwt32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwt32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwt32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwt32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwt32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwt32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwt32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwt32.exe - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 680 75e042dcde7e747b2b65078c520793ae.exe 680 75e042dcde7e747b2b65078c520793ae.exe 680 75e042dcde7e747b2b65078c520793ae.exe 680 75e042dcde7e747b2b65078c520793ae.exe 2392 igfxwt32.exe 2392 igfxwt32.exe 2392 igfxwt32.exe 2392 igfxwt32.exe 1776 igfxwt32.exe 1776 igfxwt32.exe 1776 igfxwt32.exe 1776 igfxwt32.exe 4472 igfxwt32.exe 4472 igfxwt32.exe 4472 igfxwt32.exe 4472 igfxwt32.exe 5072 igfxwt32.exe 5072 igfxwt32.exe 5072 igfxwt32.exe 5072 igfxwt32.exe 2876 igfxwt32.exe 2876 igfxwt32.exe 2876 igfxwt32.exe 2876 igfxwt32.exe 1928 igfxwt32.exe 1928 igfxwt32.exe 1928 igfxwt32.exe 1928 igfxwt32.exe 4792 igfxwt32.exe 4792 igfxwt32.exe 4792 igfxwt32.exe 4792 igfxwt32.exe 3424 igfxwt32.exe 3424 igfxwt32.exe 3424 igfxwt32.exe 3424 igfxwt32.exe 3044 igfxwt32.exe 3044 igfxwt32.exe 3044 igfxwt32.exe 3044 igfxwt32.exe 3932 igfxwt32.exe 3932 igfxwt32.exe 3932 igfxwt32.exe 3932 igfxwt32.exe 3444 igfxwt32.exe 3444 igfxwt32.exe 3444 igfxwt32.exe 3444 igfxwt32.exe 4196 igfxwt32.exe 4196 igfxwt32.exe 4196 igfxwt32.exe 4196 igfxwt32.exe 2756 igfxwt32.exe 2756 igfxwt32.exe 2756 igfxwt32.exe 2756 igfxwt32.exe 400 igfxwt32.exe 400 igfxwt32.exe 400 igfxwt32.exe 400 igfxwt32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3820 wrote to memory of 680 3820 75e042dcde7e747b2b65078c520793ae.exe 94 PID 3820 wrote to memory of 680 3820 75e042dcde7e747b2b65078c520793ae.exe 94 PID 3820 wrote to memory of 680 3820 75e042dcde7e747b2b65078c520793ae.exe 94 PID 3820 wrote to memory of 680 3820 75e042dcde7e747b2b65078c520793ae.exe 94 PID 3820 wrote to memory of 680 3820 75e042dcde7e747b2b65078c520793ae.exe 94 PID 3820 wrote to memory of 680 3820 75e042dcde7e747b2b65078c520793ae.exe 94 PID 3820 wrote to memory of 680 3820 75e042dcde7e747b2b65078c520793ae.exe 94 PID 680 wrote to memory of 2232 680 75e042dcde7e747b2b65078c520793ae.exe 95 PID 680 wrote to memory of 2232 680 75e042dcde7e747b2b65078c520793ae.exe 95 PID 680 wrote to memory of 2232 680 75e042dcde7e747b2b65078c520793ae.exe 95 PID 2232 wrote to memory of 2392 2232 igfxwt32.exe 98 PID 2232 wrote to memory of 2392 2232 igfxwt32.exe 98 PID 2232 wrote to memory of 2392 2232 igfxwt32.exe 98 PID 2232 wrote to memory of 2392 2232 igfxwt32.exe 98 PID 2232 wrote to memory of 2392 2232 igfxwt32.exe 98 PID 2232 wrote to memory of 2392 2232 igfxwt32.exe 98 PID 2232 wrote to memory of 2392 2232 igfxwt32.exe 98 PID 2392 wrote to memory of 552 2392 igfxwt32.exe 99 PID 2392 wrote to memory of 552 2392 igfxwt32.exe 99 PID 2392 wrote to memory of 552 2392 igfxwt32.exe 99 PID 552 wrote to memory of 1776 552 igfxwt32.exe 100 PID 552 wrote to memory of 1776 552 igfxwt32.exe 100 PID 552 wrote to memory of 1776 552 igfxwt32.exe 100 PID 552 wrote to memory of 1776 552 igfxwt32.exe 100 PID 552 wrote to memory of 1776 552 igfxwt32.exe 100 PID 552 wrote to memory of 1776 552 igfxwt32.exe 100 PID 552 wrote to memory of 1776 552 igfxwt32.exe 100 PID 1776 wrote to memory of 3692 1776 igfxwt32.exe 102 PID 1776 wrote to memory of 3692 1776 igfxwt32.exe 102 PID 1776 wrote to memory of 3692 1776 igfxwt32.exe 102 PID 3692 wrote to memory of 4472 3692 igfxwt32.exe 103 PID 3692 wrote to memory of 4472 3692 igfxwt32.exe 103 PID 3692 wrote to memory of 4472 3692 igfxwt32.exe 103 PID 3692 wrote to memory of 4472 3692 igfxwt32.exe 103 PID 3692 wrote to memory of 4472 3692 igfxwt32.exe 103 PID 3692 wrote to memory of 4472 3692 igfxwt32.exe 103 PID 3692 wrote to memory of 4472 3692 igfxwt32.exe 103 PID 4472 wrote to memory of 2844 4472 igfxwt32.exe 104 PID 4472 wrote to memory of 2844 4472 igfxwt32.exe 104 PID 4472 wrote to memory of 2844 4472 igfxwt32.exe 104 PID 2844 wrote to memory of 5072 2844 igfxwt32.exe 105 PID 2844 wrote to memory of 5072 2844 igfxwt32.exe 105 PID 2844 wrote to memory of 5072 2844 igfxwt32.exe 105 PID 2844 wrote to memory of 5072 2844 igfxwt32.exe 105 PID 2844 wrote to memory of 5072 2844 igfxwt32.exe 105 PID 2844 wrote to memory of 5072 2844 igfxwt32.exe 105 PID 2844 wrote to memory of 5072 2844 igfxwt32.exe 105 PID 5072 wrote to memory of 4448 5072 igfxwt32.exe 106 PID 5072 wrote to memory of 4448 5072 igfxwt32.exe 106 PID 5072 wrote to memory of 4448 5072 igfxwt32.exe 106 PID 4448 wrote to memory of 2876 4448 igfxwt32.exe 107 PID 4448 wrote to memory of 2876 4448 igfxwt32.exe 107 PID 4448 wrote to memory of 2876 4448 igfxwt32.exe 107 PID 4448 wrote to memory of 2876 4448 igfxwt32.exe 107 PID 4448 wrote to memory of 2876 4448 igfxwt32.exe 107 PID 4448 wrote to memory of 2876 4448 igfxwt32.exe 107 PID 4448 wrote to memory of 2876 4448 igfxwt32.exe 107 PID 2876 wrote to memory of 1672 2876 igfxwt32.exe 108 PID 2876 wrote to memory of 1672 2876 igfxwt32.exe 108 PID 2876 wrote to memory of 1672 2876 igfxwt32.exe 108 PID 1672 wrote to memory of 1928 1672 igfxwt32.exe 109 PID 1672 wrote to memory of 1928 1672 igfxwt32.exe 109 PID 1672 wrote to memory of 1928 1672 igfxwt32.exe 109 PID 1672 wrote to memory of 1928 1672 igfxwt32.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\75e042dcde7e747b2b65078c520793ae.exe"C:\Users\Admin\AppData\Local\Temp\75e042dcde7e747b2b65078c520793ae.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\75e042dcde7e747b2b65078c520793ae.exe"C:\Users\Admin\AppData\Local\Temp\75e042dcde7e747b2b65078c520793ae.exe"2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Users\Admin\AppData\Local\Temp\75E042~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Users\Admin\AppData\Local\Temp\75E042~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1928 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4644 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4792 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1804 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3424 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3352 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3044 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2672 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3932 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2552 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3444 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:208 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4196 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3644 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2756 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:988 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe30⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:400 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe31⤵
- Executes dropped EXE
PID:1004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\igfxwt32.exe
- Size 141KB
- SHA256 e2788269e2e8f4032e33457dc54559bfdb2d55c06e540e6095e65c0082fded6c
- MD5 bc0a9820f42b6351c66d45617eb78d2b
- SHA1 baa341b917f292bd880bbc960a21bfa8c016228b
- SHA512 3e86fbb73b8263ecdca86e700d76993fe82137ebfae17a88904e12b0e7dd2b933b1261616a51d5b4805eb902e2d7a75b9f34e7f0b10a4e7f790fd367f479a86d
- SSDEEP 3072:E6obs2IlIG5ttxQp7TojDrsQWbNpk/Z98INfw:cSlO7TmsQSNO/ZHY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\igfxwt32.exe
- Size 174KB
- SHA256 a46c45f5cae16ee7105d2c59f192cd851f3674c6ff9a8a525178911c3e99b6a8
- MD5 75e042dcde7e747b2b65078c520793ae
- SHA1 082a01c74e981e5f711de29bc037f2681969033c
- SHA512 a7883b316b72fb9fa572ba0f930bd3f8abfb4e337d12016e31f28924b6051f40302490aac03a2f7fc9134d8ffc86493e99662e96329872aeb09ef6ee834c2380
- SSDEEP 3072:E6obs2IlIG5ttxQp7TojDrsQWbNpk/Z98INfai6MdzyX8JOuiY0Y:cSlO7TmsQSNO/ZHR/yX8JOuiC
- MD5 SHA1 SHA512 SSDEEP