Analysis
-
max time kernel
147s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-04-2024 18:02
Static task
static1
Behavioral task
behavioral1
Sample
f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
-
Size
184KB
-
MD5
f87d227c239f2153debe2ed82b791af4
-
SHA1
86b7ca4b65925fe8c34346824e7514dec9bc4dc9
-
SHA256
0e3bd9a2273d23017ac49410da451bd01b9972f14a6fbac0551dc45a77e86da5
-
SHA512
cf5fd3e38a2bb4115949cc609c63f436c18538a32986c0b1b314b8c73c86454b2a3a76f9d9b440d31f4176ceb9d924e590a696c06b1030825656140649aeeb51
-
SSDEEP
3072:42cek9K+k7JeRFr/mt+YrxLbaQrhnUn0NwSsSaD6wtADYzaiFw9Rykw9sQ4SKRfk:42cekCqJzQLbd9p28i2dEsVSI8
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Deletes itself 1 IoCs
pid Process 3004 igfxpk32.exe -
Executes dropped EXE 23 IoCs
pid Process 2652 igfxpk32.exe 3004 igfxpk32.exe 3008 igfxpk32.exe 2736 igfxpk32.exe 1476 igfxpk32.exe 1612 igfxpk32.exe 2000 igfxpk32.exe 2740 igfxpk32.exe 780 igfxpk32.exe 1468 igfxpk32.exe 612 igfxpk32.exe 2288 igfxpk32.exe 824 igfxpk32.exe 1904 igfxpk32.exe 588 igfxpk32.exe 2180 igfxpk32.exe 556 igfxpk32.exe 2100 igfxpk32.exe 1032 igfxpk32.exe 3048 igfxpk32.exe 2532 igfxpk32.exe 2652 igfxpk32.exe 2076 igfxpk32.exe -
Loads dropped DLL 12 IoCs
pid Process 3020 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 3004 igfxpk32.exe 2736 igfxpk32.exe 1612 igfxpk32.exe 2740 igfxpk32.exe 1468 igfxpk32.exe 2288 igfxpk32.exe 1904 igfxpk32.exe 2180 igfxpk32.exe 2100 igfxpk32.exe 3048 igfxpk32.exe 2652 igfxpk32.exe -
resource yara_rule behavioral1/memory/3020-3-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral1/memory/3020-2-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral1/memory/3020-4-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral1/memory/3020-6-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral1/memory/3020-7-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral1/memory/3020-8-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral1/memory/3020-16-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral1/memory/3004-26-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral1/memory/3004-27-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral1/memory/3004-28-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral1/memory/3004-32-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral1/memory/2736-46-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral1/memory/1612-60-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral1/memory/2740-74-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral1/memory/1468-83-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral1/memory/1468-91-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral1/memory/2288-106-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral1/memory/1904-121-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral1/memory/2180-136-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral1/memory/2100-151-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral1/memory/3048-166-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral1/memory/2652-181-0x0000000037170000-0x00000000371D5000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 24 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe -
Drops file in System32 directory 36 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe -
Suspicious use of SetThreadContext 12 IoCs
description pid Process procid_target PID 3060 set thread context of 3020 3060 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 28 PID 2652 set thread context of 3004 2652 igfxpk32.exe 30 PID 3008 set thread context of 2736 3008 igfxpk32.exe 34 PID 1476 set thread context of 1612 1476 igfxpk32.exe 36 PID 2000 set thread context of 2740 2000 igfxpk32.exe 38 PID 780 set thread context of 1468 780 igfxpk32.exe 40 PID 612 set thread context of 2288 612 igfxpk32.exe 42 PID 824 set thread context of 1904 824 igfxpk32.exe 44 PID 588 set thread context of 2180 588 igfxpk32.exe 46 PID 556 set thread context of 2100 556 igfxpk32.exe 48 PID 1032 set thread context of 3048 1032 igfxpk32.exe 50 PID 2532 set thread context of 2652 2532 igfxpk32.exe 52 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 3020 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 3020 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 3004 igfxpk32.exe 3004 igfxpk32.exe 2736 igfxpk32.exe 2736 igfxpk32.exe 1612 igfxpk32.exe 1612 igfxpk32.exe 2740 igfxpk32.exe 2740 igfxpk32.exe 1468 igfxpk32.exe 1468 igfxpk32.exe 2288 igfxpk32.exe 2288 igfxpk32.exe 1904 igfxpk32.exe 1904 igfxpk32.exe 2180 igfxpk32.exe 2180 igfxpk32.exe 2100 igfxpk32.exe 2100 igfxpk32.exe 3048 igfxpk32.exe 3048 igfxpk32.exe 2652 igfxpk32.exe 2652 igfxpk32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3060 wrote to memory of 3020 3060 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 28 PID 3060 wrote to memory of 3020 3060 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 28 PID 3060 wrote to memory of 3020 3060 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 28 PID 3060 wrote to memory of 3020 3060 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 28 PID 3060 wrote to memory of 3020 3060 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 28 PID 3060 wrote to memory of 3020 3060 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 28 PID 3060 wrote to memory of 3020 3060 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 28 PID 3020 wrote to memory of 2652 3020 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 29 PID 3020 wrote to memory of 2652 3020 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 29 PID 3020 wrote to memory of 2652 3020 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 29 PID 3020 wrote to memory of 2652 3020 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 29 PID 2652 wrote to memory of 3004 2652 igfxpk32.exe 30 PID 2652 wrote to memory of 3004 2652 igfxpk32.exe 30 PID 2652 wrote to memory of 3004 2652 igfxpk32.exe 30 PID 2652 wrote to memory of 3004 2652 igfxpk32.exe 30 PID 2652 wrote to memory of 3004 2652 igfxpk32.exe 30 PID 2652 wrote to memory of 3004 2652 igfxpk32.exe 30 PID 2652 wrote to memory of 3004 2652 igfxpk32.exe 30 PID 3004 wrote to memory of 3008 3004 igfxpk32.exe 31 PID 3004 wrote to memory of 3008 3004 igfxpk32.exe 31 PID 3004 wrote to memory of 3008 3004 igfxpk32.exe 31 PID 3004 wrote to memory of 3008 3004 igfxpk32.exe 31 PID 3008 wrote to memory of 2736 3008 igfxpk32.exe 34 PID 3008 wrote to memory of 2736 3008 igfxpk32.exe 34 PID 3008 wrote to memory of 2736 3008 igfxpk32.exe 34 PID 3008 wrote to memory of 2736 3008 igfxpk32.exe 34 PID 3008 wrote to memory of 2736 3008 igfxpk32.exe 34 PID 3008 wrote to memory of 2736 3008 igfxpk32.exe 34 PID 3008 wrote to memory of 2736 3008 igfxpk32.exe 34 PID 2736 wrote to memory of 1476 2736 igfxpk32.exe 35 PID 2736 wrote to memory of 1476 2736 igfxpk32.exe 35 PID 2736 wrote to memory of 1476 2736 igfxpk32.exe 35 PID 2736 wrote to memory of 1476 2736 igfxpk32.exe 35 PID 1476 wrote to memory of 1612 1476 igfxpk32.exe 36 PID 1476 wrote to memory of 1612 1476 igfxpk32.exe 36 PID 1476 wrote to memory of 1612 1476 igfxpk32.exe 36 PID 1476 wrote to memory of 1612 1476 igfxpk32.exe 36 PID 1476 wrote to memory of 1612 1476 igfxpk32.exe 36 PID 1476 wrote to memory of 1612 1476 igfxpk32.exe 36 PID 1476 wrote to memory of 1612 1476 igfxpk32.exe 36 PID 1612 wrote to memory of 2000 1612 igfxpk32.exe 37 PID 1612 wrote to memory of 2000 1612 igfxpk32.exe 37 PID 1612 wrote to memory of 2000 1612 igfxpk32.exe 37 PID 1612 wrote to memory of 2000 1612 igfxpk32.exe 37 PID 2000 wrote to memory of 2740 2000 igfxpk32.exe 38 PID 2000 wrote to memory of 2740 2000 igfxpk32.exe 38 PID 2000 wrote to memory of 2740 2000 igfxpk32.exe 38 PID 2000 wrote to memory of 2740 2000 igfxpk32.exe 38 PID 2000 wrote to memory of 2740 2000 igfxpk32.exe 38 PID 2000 wrote to memory of 2740 2000 igfxpk32.exe 38 PID 2000 wrote to memory of 2740 2000 igfxpk32.exe 38 PID 2740 wrote to memory of 780 2740 igfxpk32.exe 39 PID 2740 wrote to memory of 780 2740 igfxpk32.exe 39 PID 2740 wrote to memory of 780 2740 igfxpk32.exe 39 PID 2740 wrote to memory of 780 2740 igfxpk32.exe 39 PID 780 wrote to memory of 1468 780 igfxpk32.exe 40 PID 780 wrote to memory of 1468 780 igfxpk32.exe 40 PID 780 wrote to memory of 1468 780 igfxpk32.exe 40 PID 780 wrote to memory of 1468 780 igfxpk32.exe 40 PID 780 wrote to memory of 1468 780 igfxpk32.exe 40 PID 780 wrote to memory of 1468 780 igfxpk32.exe 40 PID 780 wrote to memory of 1468 780 igfxpk32.exe 40 PID 1468 wrote to memory of 612 1468 igfxpk32.exe 41 PID 1468 wrote to memory of 612 1468 igfxpk32.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Users\Admin\AppData\Local\Temp\F87D22~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Users\Admin\AppData\Local\Temp\F87D22~1.EXE4⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:612 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2288 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:824 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1904 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:588 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2180 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:556 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2100 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1032 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3048 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2532 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2652 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe25⤵
- Executes dropped EXE
PID:2076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
MD5f87d227c239f2153debe2ed82b791af4
SHA186b7ca4b65925fe8c34346824e7514dec9bc4dc9
SHA2560e3bd9a2273d23017ac49410da451bd01b9972f14a6fbac0551dc45a77e86da5
SHA512cf5fd3e38a2bb4115949cc609c63f436c18538a32986c0b1b314b8c73c86454b2a3a76f9d9b440d31f4176ceb9d924e590a696c06b1030825656140649aeeb51