metasploit | 0e3bd9a2273d23017ac49410da451bd01b9972f14a6fbac0551dc45a77e86da5

General

Target

f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
Size

184KB
MD5

f87d227c239f2153debe2ed82b791af4
SHA1

86b7ca4b65925fe8c34346824e7514dec9bc4dc9
SHA256

0e3bd9a2273d23017ac49410da451bd01b9972f14a6fbac0551dc45a77e86da5
SHA512

cf5fd3e38a2bb4115949cc609c63f436c18538a32986c0b1b314b8c73c86454b2a3a76f9d9b440d31f4176ceb9d924e590a696c06b1030825656140649aeeb51
SSDEEP

3072:42cek9K+k7JeRFr/mt+YrxLbaQrhnUn0NwSsSaD6wtADYzaiFw9Rykw9sQ4SKRfk:42cekCqJzQLbd9p28i2dEsVSI8

Score

10^/10

metasploit backdoor trojan upx

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Checks computer location settings 2 TTPs 10 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

igfxpk32.exeigfxpk32.exeigfxpk32.exef87d227c239f2153debe2ed82b791af4_JaffaCakes118.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation	igfxpk32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation	igfxpk32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation	igfxpk32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation	igfxpk32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation	igfxpk32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation	igfxpk32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation	igfxpk32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation	igfxpk32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation	igfxpk32.exe

Deletes itself 1 IoCs

Processes:

igfxpk32.exe

pid process

3420 igfxpk32.exe

pid	process
3420	igfxpk32.exe

Executes dropped EXE 19 IoCs

Processes:

igfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exe

pid	process
1136	igfxpk32.exe
3420	igfxpk32.exe
2484	igfxpk32.exe
1428	igfxpk32.exe
2652	igfxpk32.exe
380	igfxpk32.exe
4256	igfxpk32.exe
2952	igfxpk32.exe
1388	igfxpk32.exe
3984	igfxpk32.exe
1440	igfxpk32.exe
3524	igfxpk32.exe
1756	igfxpk32.exe
4384	igfxpk32.exe
3264	igfxpk32.exe
1500	igfxpk32.exe
2996	igfxpk32.exe
4348	igfxpk32.exe
1316	igfxpk32.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3568-0-0x0000000037170000-0x00000000371D5000-memory.dmp	upx
behavioral2/memory/3568-2-0x0000000037170000-0x00000000371D5000-memory.dmp	upx
behavioral2/memory/3568-3-0x0000000037170000-0x00000000371D5000-memory.dmp	upx
behavioral2/memory/3568-4-0x0000000037170000-0x00000000371D5000-memory.dmp	upx
behavioral2/memory/3568-38-0x0000000037170000-0x00000000371D5000-memory.dmp	upx
behavioral2/memory/3420-43-0x0000000037170000-0x00000000371D5000-memory.dmp	upx
behavioral2/memory/3420-44-0x0000000037170000-0x00000000371D5000-memory.dmp	upx
behavioral2/memory/3420-45-0x0000000037170000-0x00000000371D5000-memory.dmp	upx
behavioral2/memory/3420-47-0x0000000037170000-0x00000000371D5000-memory.dmp	upx
behavioral2/memory/1428-54-0x0000000037170000-0x00000000371D5000-memory.dmp	upx
behavioral2/memory/1428-55-0x0000000037170000-0x00000000371D5000-memory.dmp	upx
behavioral2/memory/380-63-0x0000000037170000-0x00000000371D5000-memory.dmp	upx
behavioral2/memory/380-65-0x0000000037170000-0x00000000371D5000-memory.dmp	upx
behavioral2/memory/2952-72-0x0000000037170000-0x00000000371D5000-memory.dmp	upx
behavioral2/memory/2952-74-0x0000000037170000-0x00000000371D5000-memory.dmp	upx
behavioral2/memory/3984-81-0x0000000037170000-0x00000000371D5000-memory.dmp	upx
behavioral2/memory/3984-82-0x0000000037170000-0x00000000371D5000-memory.dmp	upx
behavioral2/memory/3524-90-0x0000000037170000-0x00000000371D5000-memory.dmp	upx
behavioral2/memory/3524-92-0x0000000037170000-0x00000000371D5000-memory.dmp	upx
behavioral2/memory/4384-99-0x0000000037170000-0x00000000371D5000-memory.dmp	upx
behavioral2/memory/4384-100-0x0000000037170000-0x00000000371D5000-memory.dmp	upx
behavioral2/memory/1500-108-0x0000000037170000-0x00000000371D5000-memory.dmp	upx
behavioral2/memory/1500-110-0x0000000037170000-0x00000000371D5000-memory.dmp	upx
behavioral2/memory/4348-117-0x0000000037170000-0x00000000371D5000-memory.dmp	upx
behavioral2/memory/4348-119-0x0000000037170000-0x00000000371D5000-memory.dmp	upx

Maps connected drives based on registry 3 TTPs 20 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

igfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exef87d227c239f2153debe2ed82b791af4_JaffaCakes118.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxpk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxpk32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxpk32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxpk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxpk32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxpk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxpk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxpk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxpk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxpk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxpk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxpk32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxpk32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxpk32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxpk32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxpk32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxpk32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	igfxpk32.exe

Drops file in System32 directory 30 IoCs

Processes:

igfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exef87d227c239f2153debe2ed82b791af4_JaffaCakes118.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\igfxpk32.exe	igfxpk32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxpk32.exe
File opened for modification	C:\Windows\SysWOW64\igfxpk32.exe	igfxpk32.exe
File opened for modification	C:\Windows\SysWOW64\igfxpk32.exe	igfxpk32.exe
File opened for modification	C:\Windows\SysWOW64\	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\igfxpk32.exe	igfxpk32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxpk32.exe
File created	C:\Windows\SysWOW64\igfxpk32.exe	igfxpk32.exe
File opened for modification	C:\Windows\SysWOW64\igfxpk32.exe	igfxpk32.exe
File created	C:\Windows\SysWOW64\igfxpk32.exe	igfxpk32.exe
File created	C:\Windows\SysWOW64\igfxpk32.exe	igfxpk32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxpk32.exe
File opened for modification	C:\Windows\SysWOW64\igfxpk32.exe	igfxpk32.exe
File opened for modification	C:\Windows\SysWOW64\igfxpk32.exe	igfxpk32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxpk32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxpk32.exe
File created	C:\Windows\SysWOW64\igfxpk32.exe	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\	igfxpk32.exe
File opened for modification	C:\Windows\SysWOW64\igfxpk32.exe	igfxpk32.exe
File opened for modification	C:\Windows\SysWOW64\igfxpk32.exe	igfxpk32.exe
File created	C:\Windows\SysWOW64\igfxpk32.exe	igfxpk32.exe
File opened for modification	C:\Windows\SysWOW64\igfxpk32.exe	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\igfxpk32.exe	igfxpk32.exe
File opened for modification	C:\Windows\SysWOW64\igfxpk32.exe	igfxpk32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxpk32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxpk32.exe
File opened for modification	C:\Windows\SysWOW64\igfxpk32.exe	igfxpk32.exe
File created	C:\Windows\SysWOW64\igfxpk32.exe	igfxpk32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxpk32.exe
File created	C:\Windows\SysWOW64\igfxpk32.exe	igfxpk32.exe

Suspicious use of SetThreadContext 10 IoCs

Processes:

f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exe

description	pid	process	target process
PID 876 set thread context of 3568	876	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
PID 1136 set thread context of 3420	1136	igfxpk32.exe	igfxpk32.exe
PID 2484 set thread context of 1428	2484	igfxpk32.exe	igfxpk32.exe
PID 2652 set thread context of 380	2652	igfxpk32.exe	igfxpk32.exe
PID 4256 set thread context of 2952	4256	igfxpk32.exe	igfxpk32.exe
PID 1388 set thread context of 3984	1388	igfxpk32.exe	igfxpk32.exe
PID 1440 set thread context of 3524	1440	igfxpk32.exe	igfxpk32.exe
PID 1756 set thread context of 4384	1756	igfxpk32.exe	igfxpk32.exe
PID 3264 set thread context of 1500	3264	igfxpk32.exe	igfxpk32.exe
PID 2996 set thread context of 4348	2996	igfxpk32.exe	igfxpk32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 10 IoCs

Processes:

igfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exef87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxpk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxpk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxpk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxpk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxpk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxpk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxpk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxpk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	igfxpk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

Processes:

f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exe

pid	process
3568	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
3568	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
3568	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
3568	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
3420	igfxpk32.exe
3420	igfxpk32.exe
3420	igfxpk32.exe
3420	igfxpk32.exe
1428	igfxpk32.exe
1428	igfxpk32.exe
1428	igfxpk32.exe
1428	igfxpk32.exe
380	igfxpk32.exe
380	igfxpk32.exe
380	igfxpk32.exe
380	igfxpk32.exe
2952	igfxpk32.exe
2952	igfxpk32.exe
2952	igfxpk32.exe
2952	igfxpk32.exe
3984	igfxpk32.exe
3984	igfxpk32.exe
3984	igfxpk32.exe
3984	igfxpk32.exe
3524	igfxpk32.exe
3524	igfxpk32.exe
3524	igfxpk32.exe
3524	igfxpk32.exe
4384	igfxpk32.exe
4384	igfxpk32.exe
4384	igfxpk32.exe
4384	igfxpk32.exe
1500	igfxpk32.exe
1500	igfxpk32.exe
1500	igfxpk32.exe
1500	igfxpk32.exe
4348	igfxpk32.exe
4348	igfxpk32.exe
4348	igfxpk32.exe
4348	igfxpk32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exef87d227c239f2153debe2ed82b791af4_JaffaCakes118.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exeigfxpk32.exe

description	pid	process	target process
PID 876 wrote to memory of 3568	876	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
PID 876 wrote to memory of 3568	876	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
PID 876 wrote to memory of 3568	876	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
PID 876 wrote to memory of 3568	876	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
PID 876 wrote to memory of 3568	876	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
PID 876 wrote to memory of 3568	876	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
PID 876 wrote to memory of 3568	876	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
PID 3568 wrote to memory of 1136	3568	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe	igfxpk32.exe
PID 3568 wrote to memory of 1136	3568	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe	igfxpk32.exe
PID 3568 wrote to memory of 1136	3568	f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe	igfxpk32.exe
PID 1136 wrote to memory of 3420	1136	igfxpk32.exe	igfxpk32.exe
PID 1136 wrote to memory of 3420	1136	igfxpk32.exe	igfxpk32.exe
PID 1136 wrote to memory of 3420	1136	igfxpk32.exe	igfxpk32.exe
PID 1136 wrote to memory of 3420	1136	igfxpk32.exe	igfxpk32.exe
PID 1136 wrote to memory of 3420	1136	igfxpk32.exe	igfxpk32.exe
PID 1136 wrote to memory of 3420	1136	igfxpk32.exe	igfxpk32.exe
PID 1136 wrote to memory of 3420	1136	igfxpk32.exe	igfxpk32.exe
PID 3420 wrote to memory of 2484	3420	igfxpk32.exe	igfxpk32.exe
PID 3420 wrote to memory of 2484	3420	igfxpk32.exe	igfxpk32.exe
PID 3420 wrote to memory of 2484	3420	igfxpk32.exe	igfxpk32.exe
PID 2484 wrote to memory of 1428	2484	igfxpk32.exe	igfxpk32.exe
PID 2484 wrote to memory of 1428	2484	igfxpk32.exe	igfxpk32.exe
PID 2484 wrote to memory of 1428	2484	igfxpk32.exe	igfxpk32.exe
PID 2484 wrote to memory of 1428	2484	igfxpk32.exe	igfxpk32.exe
PID 2484 wrote to memory of 1428	2484	igfxpk32.exe	igfxpk32.exe
PID 2484 wrote to memory of 1428	2484	igfxpk32.exe	igfxpk32.exe
PID 2484 wrote to memory of 1428	2484	igfxpk32.exe	igfxpk32.exe
PID 1428 wrote to memory of 2652	1428	igfxpk32.exe	igfxpk32.exe
PID 1428 wrote to memory of 2652	1428	igfxpk32.exe	igfxpk32.exe
PID 1428 wrote to memory of 2652	1428	igfxpk32.exe	igfxpk32.exe
PID 2652 wrote to memory of 380	2652	igfxpk32.exe	igfxpk32.exe
PID 2652 wrote to memory of 380	2652	igfxpk32.exe	igfxpk32.exe
PID 2652 wrote to memory of 380	2652	igfxpk32.exe	igfxpk32.exe
PID 2652 wrote to memory of 380	2652	igfxpk32.exe	igfxpk32.exe
PID 2652 wrote to memory of 380	2652	igfxpk32.exe	igfxpk32.exe
PID 2652 wrote to memory of 380	2652	igfxpk32.exe	igfxpk32.exe
PID 2652 wrote to memory of 380	2652	igfxpk32.exe	igfxpk32.exe
PID 380 wrote to memory of 4256	380	igfxpk32.exe	igfxpk32.exe
PID 380 wrote to memory of 4256	380	igfxpk32.exe	igfxpk32.exe
PID 380 wrote to memory of 4256	380	igfxpk32.exe	igfxpk32.exe
PID 4256 wrote to memory of 2952	4256	igfxpk32.exe	igfxpk32.exe
PID 4256 wrote to memory of 2952	4256	igfxpk32.exe	igfxpk32.exe
PID 4256 wrote to memory of 2952	4256	igfxpk32.exe	igfxpk32.exe
PID 4256 wrote to memory of 2952	4256	igfxpk32.exe	igfxpk32.exe
PID 4256 wrote to memory of 2952	4256	igfxpk32.exe	igfxpk32.exe
PID 4256 wrote to memory of 2952	4256	igfxpk32.exe	igfxpk32.exe
PID 4256 wrote to memory of 2952	4256	igfxpk32.exe	igfxpk32.exe
PID 2952 wrote to memory of 1388	2952	igfxpk32.exe	igfxpk32.exe
PID 2952 wrote to memory of 1388	2952	igfxpk32.exe	igfxpk32.exe
PID 2952 wrote to memory of 1388	2952	igfxpk32.exe	igfxpk32.exe
PID 1388 wrote to memory of 3984	1388	igfxpk32.exe	igfxpk32.exe
PID 1388 wrote to memory of 3984	1388	igfxpk32.exe	igfxpk32.exe
PID 1388 wrote to memory of 3984	1388	igfxpk32.exe	igfxpk32.exe
PID 1388 wrote to memory of 3984	1388	igfxpk32.exe	igfxpk32.exe
PID 1388 wrote to memory of 3984	1388	igfxpk32.exe	igfxpk32.exe
PID 1388 wrote to memory of 3984	1388	igfxpk32.exe	igfxpk32.exe
PID 1388 wrote to memory of 3984	1388	igfxpk32.exe	igfxpk32.exe
PID 3984 wrote to memory of 1440	3984	igfxpk32.exe	igfxpk32.exe
PID 3984 wrote to memory of 1440	3984	igfxpk32.exe	igfxpk32.exe
PID 3984 wrote to memory of 1440	3984	igfxpk32.exe	igfxpk32.exe
PID 1440 wrote to memory of 3524	1440	igfxpk32.exe	igfxpk32.exe
PID 1440 wrote to memory of 3524	1440	igfxpk32.exe	igfxpk32.exe
PID 1440 wrote to memory of 3524	1440	igfxpk32.exe	igfxpk32.exe
PID 1440 wrote to memory of 3524	1440	igfxpk32.exe	igfxpk32.exe

C:\Users\Admin\AppData\Local\Temp\f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:876

C:\Users\Admin\AppData\Local\Temp\f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe"
2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3568

C:\Windows\SysWOW64\igfxpk32.exe
"C:\Windows\system32\igfxpk32.exe" C:\Users\Admin\AppData\Local\Temp\F87D22~1.EXE
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1136

C:\Windows\SysWOW64\igfxpk32.exe
"C:\Windows\SysWOW64\igfxpk32.exe" C:\Users\Admin\AppData\Local\Temp\F87D22~1.EXE
4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3420

C:\Windows\SysWOW64\igfxpk32.exe
"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2484

C:\Windows\SysWOW64\igfxpk32.exe
"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe
6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1428

C:\Windows\SysWOW64\igfxpk32.exe
"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2652

C:\Windows\SysWOW64\igfxpk32.exe
"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe
8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:380

C:\Windows\SysWOW64\igfxpk32.exe
"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe
9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4256

C:\Windows\SysWOW64\igfxpk32.exe
"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe
10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2952

C:\Windows\SysWOW64\igfxpk32.exe
"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe
11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\SysWOW64\igfxpk32.exe
"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe
12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3984

C:\Windows\SysWOW64\igfxpk32.exe
"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe
13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1440

C:\Windows\SysWOW64\igfxpk32.exe
"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe
14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3524

C:\Windows\SysWOW64\igfxpk32.exe
"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe
15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1756

C:\Windows\SysWOW64\igfxpk32.exe
"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe
16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4384

C:\Windows\SysWOW64\igfxpk32.exe
"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe
17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3264

C:\Windows\SysWOW64\igfxpk32.exe
"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe
18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1500

C:\Windows\SysWOW64\igfxpk32.exe
"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe
19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2996

C:\Windows\SysWOW64\igfxpk32.exe
"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe
20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4348

C:\Windows\SysWOW64\igfxpk32.exe
"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe
21⤵
- Executes dropped EXE
PID:1316

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\igfxpk32.exe
Filesize
184KB

MD5
f87d227c239f2153debe2ed82b791af4

SHA1
86b7ca4b65925fe8c34346824e7514dec9bc4dc9

SHA256
0e3bd9a2273d23017ac49410da451bd01b9972f14a6fbac0551dc45a77e86da5

SHA512
cf5fd3e38a2bb4115949cc609c63f436c18538a32986c0b1b314b8c73c86454b2a3a76f9d9b440d31f4176ceb9d924e590a696c06b1030825656140649aeeb51

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/380-65-0x0000000037170000-0x00000000371D5000-memory.dmp

Filesize
404KB

Download
memory/380-63-0x0000000037170000-0x00000000371D5000-memory.dmp

Filesize
404KB

Download
memory/1428-54-0x0000000037170000-0x00000000371D5000-memory.dmp

Filesize
404KB

Download
memory/1428-55-0x0000000037170000-0x00000000371D5000-memory.dmp

Filesize
404KB

Download
memory/1500-110-0x0000000037170000-0x00000000371D5000-memory.dmp

Filesize
404KB

Download
memory/1500-108-0x0000000037170000-0x00000000371D5000-memory.dmp

Filesize
404KB

Download
memory/2952-74-0x0000000037170000-0x00000000371D5000-memory.dmp

Filesize
404KB

Download
memory/2952-72-0x0000000037170000-0x00000000371D5000-memory.dmp

Filesize
404KB

Download
memory/3420-43-0x0000000037170000-0x00000000371D5000-memory.dmp

Filesize
404KB

Download
memory/3420-45-0x0000000037170000-0x00000000371D5000-memory.dmp

Filesize
404KB

Download
memory/3420-44-0x0000000037170000-0x00000000371D5000-memory.dmp

Filesize
404KB

Download
memory/3420-47-0x0000000037170000-0x00000000371D5000-memory.dmp

Filesize
404KB

Download
memory/3524-90-0x0000000037170000-0x00000000371D5000-memory.dmp

Filesize
404KB

Download
memory/3524-92-0x0000000037170000-0x00000000371D5000-memory.dmp

Filesize
404KB

Download
memory/3568-38-0x0000000037170000-0x00000000371D5000-memory.dmp

Filesize
404KB

Download
memory/3568-0-0x0000000037170000-0x00000000371D5000-memory.dmp

Filesize
404KB

Download
memory/3568-4-0x0000000037170000-0x00000000371D5000-memory.dmp

Filesize
404KB

Download
memory/3568-3-0x0000000037170000-0x00000000371D5000-memory.dmp

Filesize
404KB

Download
memory/3568-2-0x0000000037170000-0x00000000371D5000-memory.dmp

Filesize
404KB

Download
memory/3984-82-0x0000000037170000-0x00000000371D5000-memory.dmp

Filesize
404KB

Download
memory/3984-81-0x0000000037170000-0x00000000371D5000-memory.dmp

Filesize
404KB

Download
memory/4348-117-0x0000000037170000-0x00000000371D5000-memory.dmp

Filesize
404KB

Download
memory/4348-119-0x0000000037170000-0x00000000371D5000-memory.dmp

Filesize
404KB

Download
memory/4384-99-0x0000000037170000-0x00000000371D5000-memory.dmp

Filesize
404KB

Download
memory/4384-100-0x0000000037170000-0x00000000371D5000-memory.dmp

Filesize
404KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads