Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-04-2024 14:07
Static task
static1
Behavioral task
behavioral1
Sample
f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe
-
Size
179KB
-
MD5
f829068075a66248c618db9c7a7c3bb6
-
SHA1
1798ab6f4dd48e390b72ff15410631287d72e70a
-
SHA256
6db5b1e7bda8ab48e5f6cc2fee08ff2c250cde39fa21c938877e50ae5d1b619e
-
SHA512
17969d65c706d687004c5d1c26dbae38566a41ec28c972e89f8203ecd0b1b1f950a52e660dd63667dd567bc8b06d3b438264161eba63c066c1e515dffc7a4cd1
-
SSDEEP
3072:N29/K9xCyKtp5y5zd+d47mthmASvNLNcvf6XYlhzxuEaNlv92JiY:kyLA2RNyth/izMSXWt4lv9DY
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Deletes itself 1 IoCs
pid Process 2460 igfxwd32.exe -
Executes dropped EXE 29 IoCs
pid Process 2644 igfxwd32.exe 2460 igfxwd32.exe 2496 igfxwd32.exe 2932 igfxwd32.exe 2808 igfxwd32.exe 1216 igfxwd32.exe 524 igfxwd32.exe 2736 igfxwd32.exe 1512 igfxwd32.exe 2528 igfxwd32.exe 2872 igfxwd32.exe 1880 igfxwd32.exe 3040 igfxwd32.exe 684 igfxwd32.exe 912 igfxwd32.exe 844 igfxwd32.exe 828 igfxwd32.exe 1356 igfxwd32.exe 2512 igfxwd32.exe 1668 igfxwd32.exe 2856 igfxwd32.exe 108 igfxwd32.exe 2432 igfxwd32.exe 2928 igfxwd32.exe 2812 igfxwd32.exe 2740 igfxwd32.exe 852 igfxwd32.exe 2676 igfxwd32.exe 1368 igfxwd32.exe -
Loads dropped DLL 29 IoCs
pid Process 1256 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 2644 igfxwd32.exe 2460 igfxwd32.exe 2496 igfxwd32.exe 2932 igfxwd32.exe 2808 igfxwd32.exe 1216 igfxwd32.exe 524 igfxwd32.exe 2736 igfxwd32.exe 1512 igfxwd32.exe 2528 igfxwd32.exe 2872 igfxwd32.exe 1880 igfxwd32.exe 3040 igfxwd32.exe 684 igfxwd32.exe 912 igfxwd32.exe 844 igfxwd32.exe 828 igfxwd32.exe 1356 igfxwd32.exe 2512 igfxwd32.exe 1668 igfxwd32.exe 2856 igfxwd32.exe 108 igfxwd32.exe 2432 igfxwd32.exe 2928 igfxwd32.exe 2812 igfxwd32.exe 2740 igfxwd32.exe 852 igfxwd32.exe 2676 igfxwd32.exe -
resource yara_rule behavioral1/memory/1256-2-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1256-3-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1256-4-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1256-6-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1256-7-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1256-8-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1256-9-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1256-17-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2460-28-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2460-30-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2460-29-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2460-34-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2932-49-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1216-63-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2736-77-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2736-82-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2528-100-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1880-114-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1880-119-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/684-136-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/844-152-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1356-168-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1668-184-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/108-200-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2928-216-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2740-231-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2676-239-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2676-244-0x0000000000400000-0x0000000000466000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 30 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe -
Drops file in System32 directory 45 IoCs
description ioc Process File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe -
Suspicious use of SetThreadContext 15 IoCs
description pid Process procid_target PID 1668 set thread context of 1256 1668 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 28 PID 2644 set thread context of 2460 2644 igfxwd32.exe 30 PID 2496 set thread context of 2932 2496 igfxwd32.exe 32 PID 2808 set thread context of 1216 2808 igfxwd32.exe 34 PID 524 set thread context of 2736 524 igfxwd32.exe 38 PID 1512 set thread context of 2528 1512 igfxwd32.exe 40 PID 2872 set thread context of 1880 2872 igfxwd32.exe 42 PID 3040 set thread context of 684 3040 igfxwd32.exe 44 PID 912 set thread context of 844 912 igfxwd32.exe 46 PID 828 set thread context of 1356 828 igfxwd32.exe 48 PID 2512 set thread context of 1668 2512 igfxwd32.exe 50 PID 2856 set thread context of 108 2856 igfxwd32.exe 52 PID 2432 set thread context of 2928 2432 igfxwd32.exe 54 PID 2812 set thread context of 2740 2812 igfxwd32.exe 56 PID 852 set thread context of 2676 852 igfxwd32.exe 58 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 1256 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 1256 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 2460 igfxwd32.exe 2460 igfxwd32.exe 2932 igfxwd32.exe 2932 igfxwd32.exe 1216 igfxwd32.exe 1216 igfxwd32.exe 2736 igfxwd32.exe 2736 igfxwd32.exe 2528 igfxwd32.exe 2528 igfxwd32.exe 1880 igfxwd32.exe 1880 igfxwd32.exe 684 igfxwd32.exe 684 igfxwd32.exe 844 igfxwd32.exe 844 igfxwd32.exe 1356 igfxwd32.exe 1356 igfxwd32.exe 1668 igfxwd32.exe 1668 igfxwd32.exe 108 igfxwd32.exe 108 igfxwd32.exe 2928 igfxwd32.exe 2928 igfxwd32.exe 2740 igfxwd32.exe 2740 igfxwd32.exe 2676 igfxwd32.exe 2676 igfxwd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1668 wrote to memory of 1256 1668 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 28 PID 1668 wrote to memory of 1256 1668 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 28 PID 1668 wrote to memory of 1256 1668 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 28 PID 1668 wrote to memory of 1256 1668 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 28 PID 1668 wrote to memory of 1256 1668 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 28 PID 1668 wrote to memory of 1256 1668 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 28 PID 1668 wrote to memory of 1256 1668 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 28 PID 1256 wrote to memory of 2644 1256 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 29 PID 1256 wrote to memory of 2644 1256 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 29 PID 1256 wrote to memory of 2644 1256 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 29 PID 1256 wrote to memory of 2644 1256 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 29 PID 2644 wrote to memory of 2460 2644 igfxwd32.exe 30 PID 2644 wrote to memory of 2460 2644 igfxwd32.exe 30 PID 2644 wrote to memory of 2460 2644 igfxwd32.exe 30 PID 2644 wrote to memory of 2460 2644 igfxwd32.exe 30 PID 2644 wrote to memory of 2460 2644 igfxwd32.exe 30 PID 2644 wrote to memory of 2460 2644 igfxwd32.exe 30 PID 2644 wrote to memory of 2460 2644 igfxwd32.exe 30 PID 2460 wrote to memory of 2496 2460 igfxwd32.exe 31 PID 2460 wrote to memory of 2496 2460 igfxwd32.exe 31 PID 2460 wrote to memory of 2496 2460 igfxwd32.exe 31 PID 2460 wrote to memory of 2496 2460 igfxwd32.exe 31 PID 2496 wrote to memory of 2932 2496 igfxwd32.exe 32 PID 2496 wrote to memory of 2932 2496 igfxwd32.exe 32 PID 2496 wrote to memory of 2932 2496 igfxwd32.exe 32 PID 2496 wrote to memory of 2932 2496 igfxwd32.exe 32 PID 2496 wrote to memory of 2932 2496 igfxwd32.exe 32 PID 2496 wrote to memory of 2932 2496 igfxwd32.exe 32 PID 2496 wrote to memory of 2932 2496 igfxwd32.exe 32 PID 2932 wrote to memory of 2808 2932 igfxwd32.exe 33 PID 2932 wrote to memory of 2808 2932 igfxwd32.exe 33 PID 2932 wrote to memory of 2808 2932 igfxwd32.exe 33 PID 2932 wrote to memory of 2808 2932 igfxwd32.exe 33 PID 2808 wrote to memory of 1216 2808 igfxwd32.exe 34 PID 2808 wrote to memory of 1216 2808 igfxwd32.exe 34 PID 2808 wrote to memory of 1216 2808 igfxwd32.exe 34 PID 2808 wrote to memory of 1216 2808 igfxwd32.exe 34 PID 2808 wrote to memory of 1216 2808 igfxwd32.exe 34 PID 2808 wrote to memory of 1216 2808 igfxwd32.exe 34 PID 2808 wrote to memory of 1216 2808 igfxwd32.exe 34 PID 1216 wrote to memory of 524 1216 igfxwd32.exe 37 PID 1216 wrote to memory of 524 1216 igfxwd32.exe 37 PID 1216 wrote to memory of 524 1216 igfxwd32.exe 37 PID 1216 wrote to memory of 524 1216 igfxwd32.exe 37 PID 524 wrote to memory of 2736 524 igfxwd32.exe 38 PID 524 wrote to memory of 2736 524 igfxwd32.exe 38 PID 524 wrote to memory of 2736 524 igfxwd32.exe 38 PID 524 wrote to memory of 2736 524 igfxwd32.exe 38 PID 524 wrote to memory of 2736 524 igfxwd32.exe 38 PID 524 wrote to memory of 2736 524 igfxwd32.exe 38 PID 524 wrote to memory of 2736 524 igfxwd32.exe 38 PID 2736 wrote to memory of 1512 2736 igfxwd32.exe 39 PID 2736 wrote to memory of 1512 2736 igfxwd32.exe 39 PID 2736 wrote to memory of 1512 2736 igfxwd32.exe 39 PID 2736 wrote to memory of 1512 2736 igfxwd32.exe 39 PID 1512 wrote to memory of 2528 1512 igfxwd32.exe 40 PID 1512 wrote to memory of 2528 1512 igfxwd32.exe 40 PID 1512 wrote to memory of 2528 1512 igfxwd32.exe 40 PID 1512 wrote to memory of 2528 1512 igfxwd32.exe 40 PID 1512 wrote to memory of 2528 1512 igfxwd32.exe 40 PID 1512 wrote to memory of 2528 1512 igfxwd32.exe 40 PID 1512 wrote to memory of 2528 1512 igfxwd32.exe 40 PID 2528 wrote to memory of 2872 2528 igfxwd32.exe 41 PID 2528 wrote to memory of 2872 2528 igfxwd32.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Users\Admin\AppData\Local\Temp\F82906~1.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Users\Admin\AppData\Local\Temp\F82906~1.EXE4⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2872 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1880 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:3040 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:684 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:912 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:844 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:828 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1356 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2512 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1668 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2856 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:108 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2432 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2928 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2812 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2740 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:852 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2676 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe31⤵
- Executes dropped EXE
PID:1368
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
179KB
MD5f829068075a66248c618db9c7a7c3bb6
SHA11798ab6f4dd48e390b72ff15410631287d72e70a
SHA2566db5b1e7bda8ab48e5f6cc2fee08ff2c250cde39fa21c938877e50ae5d1b619e
SHA51217969d65c706d687004c5d1c26dbae38566a41ec28c972e89f8203ecd0b1b1f950a52e660dd63667dd567bc8b06d3b438264161eba63c066c1e515dffc7a4cd1