Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/03/2024, 15:51
Static task
static1
Behavioral task
behavioral1
Sample
e20a2e09c3050c02b1bd800a06f7b2ef.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e20a2e09c3050c02b1bd800a06f7b2ef.exe
Resource
win10v2004-20231215-en
General
-
Target
e20a2e09c3050c02b1bd800a06f7b2ef.exe
-
Size
168KB
-
MD5
e20a2e09c3050c02b1bd800a06f7b2ef
-
SHA1
63218ed0508f58e6249ebeb567bd36898c02fa8b
-
SHA256
a5194d524d6873a0c9b353153e9d73b16022567224a09f46d9ccbf251cf6c8ac
-
SHA512
581f1276a853cc9277ce20202cd78ae2f33c4802ce0d07cf964e397a8955ab49d9a23faacf66a96387b57040221dc1bfbf1bc09c7e85fa9b5cf04a9b288e8d84
-
SSDEEP
3072:o194BB9ZN91eRHm02Voe//OH+PHfvCvC:Yubj4RH2VokfHC
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Deletes itself 1 IoCs
pid Process 2536 igfxtc32.exe -
Executes dropped EXE 47 IoCs
pid Process 2536 igfxtc32.exe 2408 igfxtc32.exe 2628 igfxtc32.exe 1832 igfxtc32.exe 2640 igfxtc32.exe 2336 igfxtc32.exe 560 igfxtc32.exe 1944 igfxtc32.exe 1472 igfxtc32.exe 2316 igfxtc32.exe 1716 igfxtc32.exe 1628 igfxtc32.exe 2420 igfxtc32.exe 2424 igfxtc32.exe 1260 igfxtc32.exe 2276 igfxtc32.exe 1832 igfxtc32.exe 1828 igfxtc32.exe 2200 igfxtc32.exe 560 igfxtc32.exe 2180 igfxtc32.exe 2204 igfxtc32.exe 1224 igfxtc32.exe 2516 igfxtc32.exe 2520 igfxtc32.exe 2604 igfxtc32.exe 2144 igfxtc32.exe 1504 igfxtc32.exe 1600 igfxtc32.exe 2992 igfxtc32.exe 1832 igfxtc32.exe 2776 igfxtc32.exe 1160 igfxtc32.exe 1192 igfxtc32.exe 1872 igfxtc32.exe 2812 igfxtc32.exe 2968 igfxtc32.exe 2696 igfxtc32.exe 2704 igfxtc32.exe 2396 igfxtc32.exe 2900 igfxtc32.exe 1260 igfxtc32.exe 2040 igfxtc32.exe 2656 igfxtc32.exe 2188 igfxtc32.exe 1904 igfxtc32.exe 2244 igfxtc32.exe -
Loads dropped DLL 64 IoCs
pid Process 1924 e20a2e09c3050c02b1bd800a06f7b2ef.exe 1924 e20a2e09c3050c02b1bd800a06f7b2ef.exe 2536 igfxtc32.exe 2536 igfxtc32.exe 2408 igfxtc32.exe 2408 igfxtc32.exe 2628 igfxtc32.exe 2628 igfxtc32.exe 1832 igfxtc32.exe 1832 igfxtc32.exe 2640 igfxtc32.exe 2640 igfxtc32.exe 2336 igfxtc32.exe 2336 igfxtc32.exe 560 igfxtc32.exe 560 igfxtc32.exe 1944 igfxtc32.exe 1944 igfxtc32.exe 1472 igfxtc32.exe 1472 igfxtc32.exe 2316 igfxtc32.exe 2316 igfxtc32.exe 1716 igfxtc32.exe 1716 igfxtc32.exe 1628 igfxtc32.exe 1628 igfxtc32.exe 2420 igfxtc32.exe 2420 igfxtc32.exe 2424 igfxtc32.exe 2424 igfxtc32.exe 1260 igfxtc32.exe 1260 igfxtc32.exe 2276 igfxtc32.exe 2276 igfxtc32.exe 1832 igfxtc32.exe 1832 igfxtc32.exe 1828 igfxtc32.exe 1828 igfxtc32.exe 2200 igfxtc32.exe 2200 igfxtc32.exe 560 igfxtc32.exe 560 igfxtc32.exe 2180 igfxtc32.exe 2180 igfxtc32.exe 2204 igfxtc32.exe 2204 igfxtc32.exe 1224 igfxtc32.exe 1224 igfxtc32.exe 2516 igfxtc32.exe 2516 igfxtc32.exe 2520 igfxtc32.exe 2520 igfxtc32.exe 2604 igfxtc32.exe 2604 igfxtc32.exe 2144 igfxtc32.exe 2144 igfxtc32.exe 1504 igfxtc32.exe 1504 igfxtc32.exe 1600 igfxtc32.exe 1600 igfxtc32.exe 2992 igfxtc32.exe 2992 igfxtc32.exe 1832 igfxtc32.exe 1832 igfxtc32.exe -
Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 e20a2e09c3050c02b1bd800a06f7b2ef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ e20a2e09c3050c02b1bd800a06f7b2ef.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe e20a2e09c3050c02b1bd800a06f7b2ef.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe e20a2e09c3050c02b1bd800a06f7b2ef.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1924 e20a2e09c3050c02b1bd800a06f7b2ef.exe 1924 e20a2e09c3050c02b1bd800a06f7b2ef.exe 2536 igfxtc32.exe 2536 igfxtc32.exe 2408 igfxtc32.exe 2408 igfxtc32.exe 2628 igfxtc32.exe 2628 igfxtc32.exe 1832 igfxtc32.exe 1832 igfxtc32.exe 2640 igfxtc32.exe 2640 igfxtc32.exe 2336 igfxtc32.exe 2336 igfxtc32.exe 560 igfxtc32.exe 560 igfxtc32.exe 1944 igfxtc32.exe 1944 igfxtc32.exe 1472 igfxtc32.exe 1472 igfxtc32.exe 2316 igfxtc32.exe 2316 igfxtc32.exe 1716 igfxtc32.exe 1716 igfxtc32.exe 1628 igfxtc32.exe 1628 igfxtc32.exe 2420 igfxtc32.exe 2420 igfxtc32.exe 2424 igfxtc32.exe 2424 igfxtc32.exe 1260 igfxtc32.exe 1260 igfxtc32.exe 2276 igfxtc32.exe 2276 igfxtc32.exe 1832 igfxtc32.exe 1832 igfxtc32.exe 1828 igfxtc32.exe 1828 igfxtc32.exe 2200 igfxtc32.exe 2200 igfxtc32.exe 560 igfxtc32.exe 560 igfxtc32.exe 2180 igfxtc32.exe 2180 igfxtc32.exe 2204 igfxtc32.exe 2204 igfxtc32.exe 1224 igfxtc32.exe 1224 igfxtc32.exe 2516 igfxtc32.exe 2516 igfxtc32.exe 2520 igfxtc32.exe 2520 igfxtc32.exe 2604 igfxtc32.exe 2604 igfxtc32.exe 2144 igfxtc32.exe 2144 igfxtc32.exe 1504 igfxtc32.exe 1504 igfxtc32.exe 1600 igfxtc32.exe 1600 igfxtc32.exe 2992 igfxtc32.exe 2992 igfxtc32.exe 1832 igfxtc32.exe 1832 igfxtc32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2536 1924 e20a2e09c3050c02b1bd800a06f7b2ef.exe 28 PID 1924 wrote to memory of 2536 1924 e20a2e09c3050c02b1bd800a06f7b2ef.exe 28 PID 1924 wrote to memory of 2536 1924 e20a2e09c3050c02b1bd800a06f7b2ef.exe 28 PID 1924 wrote to memory of 2536 1924 e20a2e09c3050c02b1bd800a06f7b2ef.exe 28 PID 2536 wrote to memory of 2408 2536 igfxtc32.exe 29 PID 2536 wrote to memory of 2408 2536 igfxtc32.exe 29 PID 2536 wrote to memory of 2408 2536 igfxtc32.exe 29 PID 2536 wrote to memory of 2408 2536 igfxtc32.exe 29 PID 2408 wrote to memory of 2628 2408 igfxtc32.exe 30 PID 2408 wrote to memory of 2628 2408 igfxtc32.exe 30 PID 2408 wrote to memory of 2628 2408 igfxtc32.exe 30 PID 2408 wrote to memory of 2628 2408 igfxtc32.exe 30 PID 2628 wrote to memory of 1832 2628 igfxtc32.exe 31 PID 2628 wrote to memory of 1832 2628 igfxtc32.exe 31 PID 2628 wrote to memory of 1832 2628 igfxtc32.exe 31 PID 2628 wrote to memory of 1832 2628 igfxtc32.exe 31 PID 1832 wrote to memory of 2640 1832 igfxtc32.exe 32 PID 1832 wrote to memory of 2640 1832 igfxtc32.exe 32 PID 1832 wrote to memory of 2640 1832 igfxtc32.exe 32 PID 1832 wrote to memory of 2640 1832 igfxtc32.exe 32 PID 2640 wrote to memory of 2336 2640 igfxtc32.exe 33 PID 2640 wrote to memory of 2336 2640 igfxtc32.exe 33 PID 2640 wrote to memory of 2336 2640 igfxtc32.exe 33 PID 2640 wrote to memory of 2336 2640 igfxtc32.exe 33 PID 2336 wrote to memory of 560 2336 igfxtc32.exe 34 PID 2336 wrote to memory of 560 2336 igfxtc32.exe 34 PID 2336 wrote to memory of 560 2336 igfxtc32.exe 34 PID 2336 wrote to memory of 560 2336 igfxtc32.exe 34 PID 560 wrote to memory of 1944 560 igfxtc32.exe 35 PID 560 wrote to memory of 1944 560 igfxtc32.exe 35 PID 560 wrote to memory of 1944 560 igfxtc32.exe 35 PID 560 wrote to memory of 1944 560 igfxtc32.exe 35 PID 1944 wrote to memory of 1472 1944 igfxtc32.exe 36 PID 1944 wrote to memory of 1472 1944 igfxtc32.exe 36 PID 1944 wrote to memory of 1472 1944 igfxtc32.exe 36 PID 1944 wrote to memory of 1472 1944 igfxtc32.exe 36 PID 1472 wrote to memory of 2316 1472 igfxtc32.exe 37 PID 1472 wrote to memory of 2316 1472 igfxtc32.exe 37 PID 1472 wrote to memory of 2316 1472 igfxtc32.exe 37 PID 1472 wrote to memory of 2316 1472 igfxtc32.exe 37 PID 2316 wrote to memory of 1716 2316 igfxtc32.exe 38 PID 2316 wrote to memory of 1716 2316 igfxtc32.exe 38 PID 2316 wrote to memory of 1716 2316 igfxtc32.exe 38 PID 2316 wrote to memory of 1716 2316 igfxtc32.exe 38 PID 1716 wrote to memory of 1628 1716 igfxtc32.exe 39 PID 1716 wrote to memory of 1628 1716 igfxtc32.exe 39 PID 1716 wrote to memory of 1628 1716 igfxtc32.exe 39 PID 1716 wrote to memory of 1628 1716 igfxtc32.exe 39 PID 1628 wrote to memory of 2420 1628 igfxtc32.exe 40 PID 1628 wrote to memory of 2420 1628 igfxtc32.exe 40 PID 1628 wrote to memory of 2420 1628 igfxtc32.exe 40 PID 1628 wrote to memory of 2420 1628 igfxtc32.exe 40 PID 2420 wrote to memory of 2424 2420 igfxtc32.exe 41 PID 2420 wrote to memory of 2424 2420 igfxtc32.exe 41 PID 2420 wrote to memory of 2424 2420 igfxtc32.exe 41 PID 2420 wrote to memory of 2424 2420 igfxtc32.exe 41 PID 2424 wrote to memory of 1260 2424 igfxtc32.exe 44 PID 2424 wrote to memory of 1260 2424 igfxtc32.exe 44 PID 2424 wrote to memory of 1260 2424 igfxtc32.exe 44 PID 2424 wrote to memory of 1260 2424 igfxtc32.exe 44 PID 1260 wrote to memory of 2276 1260 igfxtc32.exe 45 PID 1260 wrote to memory of 2276 1260 igfxtc32.exe 45 PID 1260 wrote to memory of 2276 1260 igfxtc32.exe 45 PID 1260 wrote to memory of 2276 1260 igfxtc32.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e20a2e09c3050c02b1bd800a06f7b2ef.exe"C:\Users\Admin\AppData\Local\Temp\e20a2e09c3050c02b1bd800a06f7b2ef.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Users\Admin\AppData\Local\Temp\E20A2E~1.EXE2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2276 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:1832 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1828 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2200 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:560 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2180 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2204 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1224 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2516 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2520 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2604 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2144 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1504 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1600 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:2992 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1832 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2776 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe34⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
PID:1160 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe35⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
PID:1192 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe36⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
PID:1872 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe37⤵
- Executes dropped EXE
- Maps connected drives based on registry
PID:2812 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe38⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
PID:2968 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe39⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
PID:2696 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe40⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
PID:2704 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe41⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
PID:2396 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe42⤵
- Executes dropped EXE
- Maps connected drives based on registry
PID:2900 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1260 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe44⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
PID:2040 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe45⤵
- Executes dropped EXE
- Maps connected drives based on registry
PID:2656 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe46⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2188 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1904 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe48⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
PID:2244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD5e20a2e09c3050c02b1bd800a06f7b2ef
SHA163218ed0508f58e6249ebeb567bd36898c02fa8b
SHA256a5194d524d6873a0c9b353153e9d73b16022567224a09f46d9ccbf251cf6c8ac
SHA512581f1276a853cc9277ce20202cd78ae2f33c4802ce0d07cf964e397a8955ab49d9a23faacf66a96387b57040221dc1bfbf1bc09c7e85fa9b5cf04a9b288e8d84