Analysis
-
max time kernel
144s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 14:07
Static task
static1
Behavioral task
behavioral1
Sample
f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe
-
Size
179KB
-
MD5
f829068075a66248c618db9c7a7c3bb6
-
SHA1
1798ab6f4dd48e390b72ff15410631287d72e70a
-
SHA256
6db5b1e7bda8ab48e5f6cc2fee08ff2c250cde39fa21c938877e50ae5d1b619e
-
SHA512
17969d65c706d687004c5d1c26dbae38566a41ec28c972e89f8203ecd0b1b1f950a52e660dd63667dd567bc8b06d3b438264161eba63c066c1e515dffc7a4cd1
-
SSDEEP
3072:N29/K9xCyKtp5y5zd+d47mthmASvNLNcvf6XYlhzxuEaNlv92JiY:kyLA2RNyth/izMSXWt4lv9DY
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Checks computer location settings 2 TTPs 15 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation igfxwd32.exe Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation igfxwd32.exe Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation igfxwd32.exe Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation igfxwd32.exe Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation igfxwd32.exe Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation igfxwd32.exe Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation igfxwd32.exe Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation igfxwd32.exe Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation igfxwd32.exe Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation igfxwd32.exe Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation igfxwd32.exe Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation igfxwd32.exe Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation igfxwd32.exe Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation igfxwd32.exe -
Deletes itself 1 IoCs
pid Process 2588 igfxwd32.exe -
Executes dropped EXE 29 IoCs
pid Process 668 igfxwd32.exe 2588 igfxwd32.exe 2040 igfxwd32.exe 1672 igfxwd32.exe 228 igfxwd32.exe 2296 igfxwd32.exe 4124 igfxwd32.exe 3824 igfxwd32.exe 3256 igfxwd32.exe 3404 igfxwd32.exe 4392 igfxwd32.exe 2556 igfxwd32.exe 3144 igfxwd32.exe 2696 igfxwd32.exe 3180 igfxwd32.exe 4460 igfxwd32.exe 264 igfxwd32.exe 4580 igfxwd32.exe 440 igfxwd32.exe 432 igfxwd32.exe 4088 igfxwd32.exe 1980 igfxwd32.exe 4028 igfxwd32.exe 1068 igfxwd32.exe 3608 igfxwd32.exe 4884 igfxwd32.exe 2336 igfxwd32.exe 2420 igfxwd32.exe 2836 igfxwd32.exe -
resource yara_rule behavioral2/memory/3168-0-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3168-2-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3168-3-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3168-4-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3168-38-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2588-45-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2588-47-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1672-53-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1672-55-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2296-62-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2296-64-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3824-72-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3824-74-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3404-80-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3404-83-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2556-89-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2556-92-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2696-99-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2696-101-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4460-108-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4460-110-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4580-115-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4580-116-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4580-117-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4580-119-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/432-126-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/432-130-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1980-135-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1980-141-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1068-146-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1068-151-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4884-157-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4884-162-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2420-168-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2420-172-0x0000000000400000-0x0000000000466000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 30 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe -
Drops file in System32 directory 45 IoCs
description ioc Process File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe -
Suspicious use of SetThreadContext 15 IoCs
description pid Process procid_target PID 3548 set thread context of 3168 3548 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 92 PID 668 set thread context of 2588 668 igfxwd32.exe 94 PID 2040 set thread context of 1672 2040 igfxwd32.exe 96 PID 228 set thread context of 2296 228 igfxwd32.exe 100 PID 4124 set thread context of 3824 4124 igfxwd32.exe 103 PID 3256 set thread context of 3404 3256 igfxwd32.exe 105 PID 4392 set thread context of 2556 4392 igfxwd32.exe 107 PID 3144 set thread context of 2696 3144 igfxwd32.exe 109 PID 3180 set thread context of 4460 3180 igfxwd32.exe 111 PID 264 set thread context of 4580 264 igfxwd32.exe 113 PID 440 set thread context of 432 440 igfxwd32.exe 115 PID 4088 set thread context of 1980 4088 igfxwd32.exe 117 PID 4028 set thread context of 1068 4028 igfxwd32.exe 119 PID 3608 set thread context of 4884 3608 igfxwd32.exe 121 PID 2336 set thread context of 2420 2336 igfxwd32.exe 123 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwd32.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 3168 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 3168 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 3168 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 3168 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 2588 igfxwd32.exe 2588 igfxwd32.exe 2588 igfxwd32.exe 2588 igfxwd32.exe 1672 igfxwd32.exe 1672 igfxwd32.exe 1672 igfxwd32.exe 1672 igfxwd32.exe 2296 igfxwd32.exe 2296 igfxwd32.exe 2296 igfxwd32.exe 2296 igfxwd32.exe 3824 igfxwd32.exe 3824 igfxwd32.exe 3824 igfxwd32.exe 3824 igfxwd32.exe 3404 igfxwd32.exe 3404 igfxwd32.exe 3404 igfxwd32.exe 3404 igfxwd32.exe 2556 igfxwd32.exe 2556 igfxwd32.exe 2556 igfxwd32.exe 2556 igfxwd32.exe 2696 igfxwd32.exe 2696 igfxwd32.exe 2696 igfxwd32.exe 2696 igfxwd32.exe 4460 igfxwd32.exe 4460 igfxwd32.exe 4460 igfxwd32.exe 4460 igfxwd32.exe 4580 igfxwd32.exe 4580 igfxwd32.exe 4580 igfxwd32.exe 4580 igfxwd32.exe 432 igfxwd32.exe 432 igfxwd32.exe 432 igfxwd32.exe 432 igfxwd32.exe 1980 igfxwd32.exe 1980 igfxwd32.exe 1980 igfxwd32.exe 1980 igfxwd32.exe 1068 igfxwd32.exe 1068 igfxwd32.exe 1068 igfxwd32.exe 1068 igfxwd32.exe 4884 igfxwd32.exe 4884 igfxwd32.exe 4884 igfxwd32.exe 4884 igfxwd32.exe 2420 igfxwd32.exe 2420 igfxwd32.exe 2420 igfxwd32.exe 2420 igfxwd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3548 wrote to memory of 3168 3548 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 92 PID 3548 wrote to memory of 3168 3548 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 92 PID 3548 wrote to memory of 3168 3548 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 92 PID 3548 wrote to memory of 3168 3548 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 92 PID 3548 wrote to memory of 3168 3548 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 92 PID 3548 wrote to memory of 3168 3548 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 92 PID 3548 wrote to memory of 3168 3548 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 92 PID 3168 wrote to memory of 668 3168 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 93 PID 3168 wrote to memory of 668 3168 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 93 PID 3168 wrote to memory of 668 3168 f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe 93 PID 668 wrote to memory of 2588 668 igfxwd32.exe 94 PID 668 wrote to memory of 2588 668 igfxwd32.exe 94 PID 668 wrote to memory of 2588 668 igfxwd32.exe 94 PID 668 wrote to memory of 2588 668 igfxwd32.exe 94 PID 668 wrote to memory of 2588 668 igfxwd32.exe 94 PID 668 wrote to memory of 2588 668 igfxwd32.exe 94 PID 668 wrote to memory of 2588 668 igfxwd32.exe 94 PID 2588 wrote to memory of 2040 2588 igfxwd32.exe 95 PID 2588 wrote to memory of 2040 2588 igfxwd32.exe 95 PID 2588 wrote to memory of 2040 2588 igfxwd32.exe 95 PID 2040 wrote to memory of 1672 2040 igfxwd32.exe 96 PID 2040 wrote to memory of 1672 2040 igfxwd32.exe 96 PID 2040 wrote to memory of 1672 2040 igfxwd32.exe 96 PID 2040 wrote to memory of 1672 2040 igfxwd32.exe 96 PID 2040 wrote to memory of 1672 2040 igfxwd32.exe 96 PID 2040 wrote to memory of 1672 2040 igfxwd32.exe 96 PID 2040 wrote to memory of 1672 2040 igfxwd32.exe 96 PID 1672 wrote to memory of 228 1672 igfxwd32.exe 99 PID 1672 wrote to memory of 228 1672 igfxwd32.exe 99 PID 1672 wrote to memory of 228 1672 igfxwd32.exe 99 PID 228 wrote to memory of 2296 228 igfxwd32.exe 100 PID 228 wrote to memory of 2296 228 igfxwd32.exe 100 PID 228 wrote to memory of 2296 228 igfxwd32.exe 100 PID 228 wrote to memory of 2296 228 igfxwd32.exe 100 PID 228 wrote to memory of 2296 228 igfxwd32.exe 100 PID 228 wrote to memory of 2296 228 igfxwd32.exe 100 PID 228 wrote to memory of 2296 228 igfxwd32.exe 100 PID 2296 wrote to memory of 4124 2296 igfxwd32.exe 101 PID 2296 wrote to memory of 4124 2296 igfxwd32.exe 101 PID 2296 wrote to memory of 4124 2296 igfxwd32.exe 101 PID 4124 wrote to memory of 3824 4124 igfxwd32.exe 103 PID 4124 wrote to memory of 3824 4124 igfxwd32.exe 103 PID 4124 wrote to memory of 3824 4124 igfxwd32.exe 103 PID 4124 wrote to memory of 3824 4124 igfxwd32.exe 103 PID 4124 wrote to memory of 3824 4124 igfxwd32.exe 103 PID 4124 wrote to memory of 3824 4124 igfxwd32.exe 103 PID 4124 wrote to memory of 3824 4124 igfxwd32.exe 103 PID 3824 wrote to memory of 3256 3824 igfxwd32.exe 104 PID 3824 wrote to memory of 3256 3824 igfxwd32.exe 104 PID 3824 wrote to memory of 3256 3824 igfxwd32.exe 104 PID 3256 wrote to memory of 3404 3256 igfxwd32.exe 105 PID 3256 wrote to memory of 3404 3256 igfxwd32.exe 105 PID 3256 wrote to memory of 3404 3256 igfxwd32.exe 105 PID 3256 wrote to memory of 3404 3256 igfxwd32.exe 105 PID 3256 wrote to memory of 3404 3256 igfxwd32.exe 105 PID 3256 wrote to memory of 3404 3256 igfxwd32.exe 105 PID 3256 wrote to memory of 3404 3256 igfxwd32.exe 105 PID 3404 wrote to memory of 4392 3404 igfxwd32.exe 106 PID 3404 wrote to memory of 4392 3404 igfxwd32.exe 106 PID 3404 wrote to memory of 4392 3404 igfxwd32.exe 106 PID 4392 wrote to memory of 2556 4392 igfxwd32.exe 107 PID 4392 wrote to memory of 2556 4392 igfxwd32.exe 107 PID 4392 wrote to memory of 2556 4392 igfxwd32.exe 107 PID 4392 wrote to memory of 2556 4392 igfxwd32.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f829068075a66248c618db9c7a7c3bb6_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Users\Admin\AppData\Local\Temp\F82906~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Users\Admin\AppData\Local\Temp\F82906~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2556 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3144 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2696 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3180 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4460 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:264 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4580 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:440 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:432 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4088 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1980 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4028 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1068 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3608 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4884 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2336 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe30⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2420 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe31⤵
- Executes dropped EXE
PID:2836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
179KB
MD5f829068075a66248c618db9c7a7c3bb6
SHA11798ab6f4dd48e390b72ff15410631287d72e70a
SHA2566db5b1e7bda8ab48e5f6cc2fee08ff2c250cde39fa21c938877e50ae5d1b619e
SHA51217969d65c706d687004c5d1c26dbae38566a41ec28c972e89f8203ecd0b1b1f950a52e660dd63667dd567bc8b06d3b438264161eba63c066c1e515dffc7a4cd1