Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/03/2024, 17:50
Static task
static1
Behavioral task
behavioral1
Sample
02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe
Resource
win10v2004-20240226-en
General
-
Target
02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe
-
Size
198KB
-
MD5
72da478f6ecd87e5cfb1d5ac32f25d86
-
SHA1
86412ed57392d65ecbc7aa5ef86f16b5f3826772
-
SHA256
02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070
-
SHA512
a50f6b82d0c077b8c2c6bb5d6c89ec20767f2bb4fdbace3a04deaa257d43fac119630c1ca5914db4bca7f7ae877eed6b9c3bb40c6198e3e0591433b2fb2eee14
-
SSDEEP
3072:6vZTRN8EQTZBNpLmPMNsEEZsDXu48J3UX/HxRL5WGyF8D92olU7WQYwT:6JRN8jBdmPJbsDXb8J3ioKJvU3Y6
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Deletes itself 1 IoCs
pid Process 2672 igfxdr32.exe -
Executes dropped EXE 41 IoCs
pid Process 2672 igfxdr32.exe 2548 igfxdr32.exe 2716 igfxdr32.exe 308 igfxdr32.exe 1460 igfxdr32.exe 2072 igfxdr32.exe 628 igfxdr32.exe 344 igfxdr32.exe 2988 igfxdr32.exe 2856 igfxdr32.exe 1672 igfxdr32.exe 2888 igfxdr32.exe 1696 igfxdr32.exe 2188 igfxdr32.exe 1528 igfxdr32.exe 568 igfxdr32.exe 1820 igfxdr32.exe 1824 igfxdr32.exe 2292 igfxdr32.exe 1512 igfxdr32.exe 2288 igfxdr32.exe 2652 igfxdr32.exe 324 igfxdr32.exe 880 igfxdr32.exe 1732 igfxdr32.exe 1172 igfxdr32.exe 1388 igfxdr32.exe 1116 igfxdr32.exe 3016 igfxdr32.exe 2248 igfxdr32.exe 2172 igfxdr32.exe 2292 igfxdr32.exe 2528 igfxdr32.exe 2436 igfxdr32.exe 2664 igfxdr32.exe 1628 igfxdr32.exe 2716 igfxdr32.exe 1368 igfxdr32.exe 2876 igfxdr32.exe 1924 igfxdr32.exe 364 igfxdr32.exe -
Loads dropped DLL 64 IoCs
pid Process 1680 02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe 1680 02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe 2672 igfxdr32.exe 2672 igfxdr32.exe 2548 igfxdr32.exe 2548 igfxdr32.exe 2716 igfxdr32.exe 2716 igfxdr32.exe 308 igfxdr32.exe 308 igfxdr32.exe 1460 igfxdr32.exe 1460 igfxdr32.exe 2072 igfxdr32.exe 2072 igfxdr32.exe 628 igfxdr32.exe 628 igfxdr32.exe 344 igfxdr32.exe 344 igfxdr32.exe 2988 igfxdr32.exe 2988 igfxdr32.exe 2856 igfxdr32.exe 2856 igfxdr32.exe 1672 igfxdr32.exe 1672 igfxdr32.exe 2888 igfxdr32.exe 2888 igfxdr32.exe 1696 igfxdr32.exe 1696 igfxdr32.exe 2188 igfxdr32.exe 2188 igfxdr32.exe 1528 igfxdr32.exe 1528 igfxdr32.exe 568 igfxdr32.exe 568 igfxdr32.exe 1820 igfxdr32.exe 1820 igfxdr32.exe 1824 igfxdr32.exe 1824 igfxdr32.exe 2292 igfxdr32.exe 2292 igfxdr32.exe 1512 igfxdr32.exe 1512 igfxdr32.exe 2288 igfxdr32.exe 2288 igfxdr32.exe 2652 igfxdr32.exe 2652 igfxdr32.exe 324 igfxdr32.exe 324 igfxdr32.exe 880 igfxdr32.exe 880 igfxdr32.exe 1732 igfxdr32.exe 1732 igfxdr32.exe 1172 igfxdr32.exe 1172 igfxdr32.exe 1388 igfxdr32.exe 1388 igfxdr32.exe 1116 igfxdr32.exe 1116 igfxdr32.exe 3016 igfxdr32.exe 3016 igfxdr32.exe 2248 igfxdr32.exe 2248 igfxdr32.exe 2172 igfxdr32.exe 2172 igfxdr32.exe -
Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdr32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\igfxdr32.exe 02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe File opened for modification C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdr32.exe File opened for modification C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdr32.exe File opened for modification C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File created C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File created C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File opened for modification C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File created C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdr32.exe File opened for modification C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File created C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File created C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File created C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File opened for modification C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File opened for modification C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File created C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File created C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdr32.exe File opened for modification C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File created C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdr32.exe File created C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File opened for modification C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File opened for modification C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdr32.exe File created C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdr32.exe File created C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File created C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File opened for modification C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdr32.exe File opened for modification C:\Windows\SysWOW64\ 02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe File opened for modification C:\Windows\SysWOW64\ igfxdr32.exe File opened for modification C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File opened for modification C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File created C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdr32.exe File created C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File created C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdr32.exe File created C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File created C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdr32.exe File opened for modification C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File opened for modification C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdr32.exe File opened for modification C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File created C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdr32.exe File created C:\Windows\SysWOW64\igfxdr32.exe igfxdr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdr32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 42 IoCs
pid Process 1680 02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe 2672 igfxdr32.exe 2548 igfxdr32.exe 2716 igfxdr32.exe 308 igfxdr32.exe 1460 igfxdr32.exe 2072 igfxdr32.exe 628 igfxdr32.exe 344 igfxdr32.exe 2988 igfxdr32.exe 2856 igfxdr32.exe 1672 igfxdr32.exe 2888 igfxdr32.exe 1696 igfxdr32.exe 2188 igfxdr32.exe 1528 igfxdr32.exe 568 igfxdr32.exe 1820 igfxdr32.exe 1824 igfxdr32.exe 2292 igfxdr32.exe 1512 igfxdr32.exe 2288 igfxdr32.exe 2652 igfxdr32.exe 324 igfxdr32.exe 880 igfxdr32.exe 1732 igfxdr32.exe 1172 igfxdr32.exe 1388 igfxdr32.exe 1116 igfxdr32.exe 3016 igfxdr32.exe 2248 igfxdr32.exe 2172 igfxdr32.exe 2292 igfxdr32.exe 2528 igfxdr32.exe 2436 igfxdr32.exe 2664 igfxdr32.exe 1628 igfxdr32.exe 2716 igfxdr32.exe 1368 igfxdr32.exe 2876 igfxdr32.exe 1924 igfxdr32.exe 364 igfxdr32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1680 02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe 1680 02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe 1680 02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe 1680 02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe 1680 02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe 1680 02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe 1680 02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe 1680 02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe 1680 02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe 1680 02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe 1680 02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe 1680 02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe 1680 02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe 1680 02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe 1680 02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe 2672 igfxdr32.exe 2672 igfxdr32.exe 2672 igfxdr32.exe 2672 igfxdr32.exe 2672 igfxdr32.exe 2672 igfxdr32.exe 2672 igfxdr32.exe 2672 igfxdr32.exe 2672 igfxdr32.exe 2672 igfxdr32.exe 2672 igfxdr32.exe 2672 igfxdr32.exe 2672 igfxdr32.exe 2672 igfxdr32.exe 2672 igfxdr32.exe 2548 igfxdr32.exe 2548 igfxdr32.exe 2548 igfxdr32.exe 2548 igfxdr32.exe 2548 igfxdr32.exe 2548 igfxdr32.exe 2548 igfxdr32.exe 2548 igfxdr32.exe 2548 igfxdr32.exe 2548 igfxdr32.exe 2548 igfxdr32.exe 2548 igfxdr32.exe 2548 igfxdr32.exe 2548 igfxdr32.exe 2548 igfxdr32.exe 2716 igfxdr32.exe 2716 igfxdr32.exe 2716 igfxdr32.exe 2716 igfxdr32.exe 2716 igfxdr32.exe 2716 igfxdr32.exe 2716 igfxdr32.exe 2716 igfxdr32.exe 2716 igfxdr32.exe 2716 igfxdr32.exe 2716 igfxdr32.exe 2716 igfxdr32.exe 2716 igfxdr32.exe 2716 igfxdr32.exe 2716 igfxdr32.exe 308 igfxdr32.exe 308 igfxdr32.exe 308 igfxdr32.exe 308 igfxdr32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1680 wrote to memory of 2672 1680 02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe 28 PID 1680 wrote to memory of 2672 1680 02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe 28 PID 1680 wrote to memory of 2672 1680 02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe 28 PID 1680 wrote to memory of 2672 1680 02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe 28 PID 2672 wrote to memory of 2548 2672 igfxdr32.exe 29 PID 2672 wrote to memory of 2548 2672 igfxdr32.exe 29 PID 2672 wrote to memory of 2548 2672 igfxdr32.exe 29 PID 2672 wrote to memory of 2548 2672 igfxdr32.exe 29 PID 2548 wrote to memory of 2716 2548 igfxdr32.exe 30 PID 2548 wrote to memory of 2716 2548 igfxdr32.exe 30 PID 2548 wrote to memory of 2716 2548 igfxdr32.exe 30 PID 2548 wrote to memory of 2716 2548 igfxdr32.exe 30 PID 2716 wrote to memory of 308 2716 igfxdr32.exe 31 PID 2716 wrote to memory of 308 2716 igfxdr32.exe 31 PID 2716 wrote to memory of 308 2716 igfxdr32.exe 31 PID 2716 wrote to memory of 308 2716 igfxdr32.exe 31 PID 308 wrote to memory of 1460 308 igfxdr32.exe 32 PID 308 wrote to memory of 1460 308 igfxdr32.exe 32 PID 308 wrote to memory of 1460 308 igfxdr32.exe 32 PID 308 wrote to memory of 1460 308 igfxdr32.exe 32 PID 1460 wrote to memory of 2072 1460 igfxdr32.exe 33 PID 1460 wrote to memory of 2072 1460 igfxdr32.exe 33 PID 1460 wrote to memory of 2072 1460 igfxdr32.exe 33 PID 1460 wrote to memory of 2072 1460 igfxdr32.exe 33 PID 2072 wrote to memory of 628 2072 igfxdr32.exe 34 PID 2072 wrote to memory of 628 2072 igfxdr32.exe 34 PID 2072 wrote to memory of 628 2072 igfxdr32.exe 34 PID 2072 wrote to memory of 628 2072 igfxdr32.exe 34 PID 628 wrote to memory of 344 628 igfxdr32.exe 35 PID 628 wrote to memory of 344 628 igfxdr32.exe 35 PID 628 wrote to memory of 344 628 igfxdr32.exe 35 PID 628 wrote to memory of 344 628 igfxdr32.exe 35 PID 344 wrote to memory of 2988 344 igfxdr32.exe 36 PID 344 wrote to memory of 2988 344 igfxdr32.exe 36 PID 344 wrote to memory of 2988 344 igfxdr32.exe 36 PID 344 wrote to memory of 2988 344 igfxdr32.exe 36 PID 2988 wrote to memory of 2856 2988 igfxdr32.exe 37 PID 2988 wrote to memory of 2856 2988 igfxdr32.exe 37 PID 2988 wrote to memory of 2856 2988 igfxdr32.exe 37 PID 2988 wrote to memory of 2856 2988 igfxdr32.exe 37 PID 2856 wrote to memory of 1672 2856 igfxdr32.exe 40 PID 2856 wrote to memory of 1672 2856 igfxdr32.exe 40 PID 2856 wrote to memory of 1672 2856 igfxdr32.exe 40 PID 2856 wrote to memory of 1672 2856 igfxdr32.exe 40 PID 1672 wrote to memory of 2888 1672 igfxdr32.exe 41 PID 1672 wrote to memory of 2888 1672 igfxdr32.exe 41 PID 1672 wrote to memory of 2888 1672 igfxdr32.exe 41 PID 1672 wrote to memory of 2888 1672 igfxdr32.exe 41 PID 2888 wrote to memory of 1696 2888 igfxdr32.exe 42 PID 2888 wrote to memory of 1696 2888 igfxdr32.exe 42 PID 2888 wrote to memory of 1696 2888 igfxdr32.exe 42 PID 2888 wrote to memory of 1696 2888 igfxdr32.exe 42 PID 1696 wrote to memory of 2188 1696 igfxdr32.exe 43 PID 1696 wrote to memory of 2188 1696 igfxdr32.exe 43 PID 1696 wrote to memory of 2188 1696 igfxdr32.exe 43 PID 1696 wrote to memory of 2188 1696 igfxdr32.exe 43 PID 2188 wrote to memory of 1528 2188 igfxdr32.exe 44 PID 2188 wrote to memory of 1528 2188 igfxdr32.exe 44 PID 2188 wrote to memory of 1528 2188 igfxdr32.exe 44 PID 2188 wrote to memory of 1528 2188 igfxdr32.exe 44 PID 1528 wrote to memory of 568 1528 igfxdr32.exe 45 PID 1528 wrote to memory of 568 1528 igfxdr32.exe 45 PID 1528 wrote to memory of 568 1528 igfxdr32.exe 45 PID 1528 wrote to memory of 568 1528 igfxdr32.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe"C:\Users\Admin\AppData\Local\Temp\02974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Users\Admin\AppData\Local\Temp\02974C~1.EXE2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:308 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:344 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:568 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1820 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1824 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2292 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1512 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2288 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2652 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:324 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:880 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1732 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1172 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1388 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1116 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3016 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2248 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2172 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe33⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2292 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe34⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2528 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe35⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2436 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2664 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe37⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1628 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe38⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2716 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe39⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1368 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe40⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2876 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe41⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1924 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe42⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:364 -
C:\Windows\SysWOW64\igfxdr32.exe"C:\Windows\system32\igfxdr32.exe" C:\Windows\SysWOW64\igfxdr32.exe43⤵PID:888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
198KB
MD572da478f6ecd87e5cfb1d5ac32f25d86
SHA186412ed57392d65ecbc7aa5ef86f16b5f3826772
SHA25602974ca035c4894e668679edbcb8cf72afc4d900d444bc816fb96093f63e6070
SHA512a50f6b82d0c077b8c2c6bb5d6c89ec20767f2bb4fdbace3a04deaa257d43fac119630c1ca5914db4bca7f7ae877eed6b9c3bb40c6198e3e0591433b2fb2eee14