Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 18:02
Static task
static1
Behavioral task
behavioral1
Sample
f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
-
Size
184KB
-
MD5
f87d227c239f2153debe2ed82b791af4
-
SHA1
86b7ca4b65925fe8c34346824e7514dec9bc4dc9
-
SHA256
0e3bd9a2273d23017ac49410da451bd01b9972f14a6fbac0551dc45a77e86da5
-
SHA512
cf5fd3e38a2bb4115949cc609c63f436c18538a32986c0b1b314b8c73c86454b2a3a76f9d9b440d31f4176ceb9d924e590a696c06b1030825656140649aeeb51
-
SSDEEP
3072:42cek9K+k7JeRFr/mt+YrxLbaQrhnUn0NwSsSaD6wtADYzaiFw9Rykw9sQ4SKRfk:42cekCqJzQLbd9p28i2dEsVSI8
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Checks computer location settings 2 TTPs 10 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation igfxpk32.exe Key value queried \REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation igfxpk32.exe Key value queried \REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation igfxpk32.exe Key value queried \REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation igfxpk32.exe Key value queried \REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation igfxpk32.exe Key value queried \REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation igfxpk32.exe Key value queried \REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation igfxpk32.exe Key value queried \REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation igfxpk32.exe Key value queried \REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation igfxpk32.exe -
Deletes itself 1 IoCs
pid Process 3420 igfxpk32.exe -
Executes dropped EXE 19 IoCs
pid Process 1136 igfxpk32.exe 3420 igfxpk32.exe 2484 igfxpk32.exe 1428 igfxpk32.exe 2652 igfxpk32.exe 380 igfxpk32.exe 4256 igfxpk32.exe 2952 igfxpk32.exe 1388 igfxpk32.exe 3984 igfxpk32.exe 1440 igfxpk32.exe 3524 igfxpk32.exe 1756 igfxpk32.exe 4384 igfxpk32.exe 3264 igfxpk32.exe 1500 igfxpk32.exe 2996 igfxpk32.exe 4348 igfxpk32.exe 1316 igfxpk32.exe -
resource yara_rule behavioral2/memory/3568-0-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/3568-2-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/3568-3-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/3568-4-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/3568-38-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/3420-43-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/3420-44-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/3420-45-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/3420-47-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/1428-54-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/1428-55-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/380-63-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/380-65-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/2952-72-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/2952-74-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/3984-81-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/3984-82-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/3524-90-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/3524-92-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/4384-99-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/4384-100-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/1500-108-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/1500-110-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/4348-117-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/4348-119-0x0000000037170000-0x00000000371D5000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 20 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpk32.exe -
Drops file in System32 directory 30 IoCs
description ioc Process File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe -
Suspicious use of SetThreadContext 10 IoCs
description pid Process procid_target PID 876 set thread context of 3568 876 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 88 PID 1136 set thread context of 3420 1136 igfxpk32.exe 90 PID 2484 set thread context of 1428 2484 igfxpk32.exe 94 PID 2652 set thread context of 380 2652 igfxpk32.exe 97 PID 4256 set thread context of 2952 4256 igfxpk32.exe 99 PID 1388 set thread context of 3984 1388 igfxpk32.exe 101 PID 1440 set thread context of 3524 1440 igfxpk32.exe 103 PID 1756 set thread context of 4384 1756 igfxpk32.exe 105 PID 3264 set thread context of 1500 3264 igfxpk32.exe 107 PID 2996 set thread context of 4348 2996 igfxpk32.exe 109 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 3568 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 3568 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 3568 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 3568 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 3420 igfxpk32.exe 3420 igfxpk32.exe 3420 igfxpk32.exe 3420 igfxpk32.exe 1428 igfxpk32.exe 1428 igfxpk32.exe 1428 igfxpk32.exe 1428 igfxpk32.exe 380 igfxpk32.exe 380 igfxpk32.exe 380 igfxpk32.exe 380 igfxpk32.exe 2952 igfxpk32.exe 2952 igfxpk32.exe 2952 igfxpk32.exe 2952 igfxpk32.exe 3984 igfxpk32.exe 3984 igfxpk32.exe 3984 igfxpk32.exe 3984 igfxpk32.exe 3524 igfxpk32.exe 3524 igfxpk32.exe 3524 igfxpk32.exe 3524 igfxpk32.exe 4384 igfxpk32.exe 4384 igfxpk32.exe 4384 igfxpk32.exe 4384 igfxpk32.exe 1500 igfxpk32.exe 1500 igfxpk32.exe 1500 igfxpk32.exe 1500 igfxpk32.exe 4348 igfxpk32.exe 4348 igfxpk32.exe 4348 igfxpk32.exe 4348 igfxpk32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 876 wrote to memory of 3568 876 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 88 PID 876 wrote to memory of 3568 876 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 88 PID 876 wrote to memory of 3568 876 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 88 PID 876 wrote to memory of 3568 876 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 88 PID 876 wrote to memory of 3568 876 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 88 PID 876 wrote to memory of 3568 876 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 88 PID 876 wrote to memory of 3568 876 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 88 PID 3568 wrote to memory of 1136 3568 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 89 PID 3568 wrote to memory of 1136 3568 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 89 PID 3568 wrote to memory of 1136 3568 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 89 PID 1136 wrote to memory of 3420 1136 igfxpk32.exe 90 PID 1136 wrote to memory of 3420 1136 igfxpk32.exe 90 PID 1136 wrote to memory of 3420 1136 igfxpk32.exe 90 PID 1136 wrote to memory of 3420 1136 igfxpk32.exe 90 PID 1136 wrote to memory of 3420 1136 igfxpk32.exe 90 PID 1136 wrote to memory of 3420 1136 igfxpk32.exe 90 PID 1136 wrote to memory of 3420 1136 igfxpk32.exe 90 PID 3420 wrote to memory of 2484 3420 igfxpk32.exe 93 PID 3420 wrote to memory of 2484 3420 igfxpk32.exe 93 PID 3420 wrote to memory of 2484 3420 igfxpk32.exe 93 PID 2484 wrote to memory of 1428 2484 igfxpk32.exe 94 PID 2484 wrote to memory of 1428 2484 igfxpk32.exe 94 PID 2484 wrote to memory of 1428 2484 igfxpk32.exe 94 PID 2484 wrote to memory of 1428 2484 igfxpk32.exe 94 PID 2484 wrote to memory of 1428 2484 igfxpk32.exe 94 PID 2484 wrote to memory of 1428 2484 igfxpk32.exe 94 PID 2484 wrote to memory of 1428 2484 igfxpk32.exe 94 PID 1428 wrote to memory of 2652 1428 igfxpk32.exe 96 PID 1428 wrote to memory of 2652 1428 igfxpk32.exe 96 PID 1428 wrote to memory of 2652 1428 igfxpk32.exe 96 PID 2652 wrote to memory of 380 2652 igfxpk32.exe 97 PID 2652 wrote to memory of 380 2652 igfxpk32.exe 97 PID 2652 wrote to memory of 380 2652 igfxpk32.exe 97 PID 2652 wrote to memory of 380 2652 igfxpk32.exe 97 PID 2652 wrote to memory of 380 2652 igfxpk32.exe 97 PID 2652 wrote to memory of 380 2652 igfxpk32.exe 97 PID 2652 wrote to memory of 380 2652 igfxpk32.exe 97 PID 380 wrote to memory of 4256 380 igfxpk32.exe 98 PID 380 wrote to memory of 4256 380 igfxpk32.exe 98 PID 380 wrote to memory of 4256 380 igfxpk32.exe 98 PID 4256 wrote to memory of 2952 4256 igfxpk32.exe 99 PID 4256 wrote to memory of 2952 4256 igfxpk32.exe 99 PID 4256 wrote to memory of 2952 4256 igfxpk32.exe 99 PID 4256 wrote to memory of 2952 4256 igfxpk32.exe 99 PID 4256 wrote to memory of 2952 4256 igfxpk32.exe 99 PID 4256 wrote to memory of 2952 4256 igfxpk32.exe 99 PID 4256 wrote to memory of 2952 4256 igfxpk32.exe 99 PID 2952 wrote to memory of 1388 2952 igfxpk32.exe 100 PID 2952 wrote to memory of 1388 2952 igfxpk32.exe 100 PID 2952 wrote to memory of 1388 2952 igfxpk32.exe 100 PID 1388 wrote to memory of 3984 1388 igfxpk32.exe 101 PID 1388 wrote to memory of 3984 1388 igfxpk32.exe 101 PID 1388 wrote to memory of 3984 1388 igfxpk32.exe 101 PID 1388 wrote to memory of 3984 1388 igfxpk32.exe 101 PID 1388 wrote to memory of 3984 1388 igfxpk32.exe 101 PID 1388 wrote to memory of 3984 1388 igfxpk32.exe 101 PID 1388 wrote to memory of 3984 1388 igfxpk32.exe 101 PID 3984 wrote to memory of 1440 3984 igfxpk32.exe 102 PID 3984 wrote to memory of 1440 3984 igfxpk32.exe 102 PID 3984 wrote to memory of 1440 3984 igfxpk32.exe 102 PID 1440 wrote to memory of 3524 1440 igfxpk32.exe 103 PID 1440 wrote to memory of 3524 1440 igfxpk32.exe 103 PID 1440 wrote to memory of 3524 1440 igfxpk32.exe 103 PID 1440 wrote to memory of 3524 1440 igfxpk32.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Users\Admin\AppData\Local\Temp\F87D22~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Users\Admin\AppData\Local\Temp\F87D22~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3524 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1756 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4384 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3264 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1500 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2996 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4348 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe21⤵
- Executes dropped EXE
PID:1316
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
MD5f87d227c239f2153debe2ed82b791af4
SHA186b7ca4b65925fe8c34346824e7514dec9bc4dc9
SHA2560e3bd9a2273d23017ac49410da451bd01b9972f14a6fbac0551dc45a77e86da5
SHA512cf5fd3e38a2bb4115949cc609c63f436c18538a32986c0b1b314b8c73c86454b2a3a76f9d9b440d31f4176ceb9d924e590a696c06b1030825656140649aeeb51