Analysis
-
max time kernel
148s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-04-2024 20:29
Static task
static1
Behavioral task
behavioral1
Sample
f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe
-
Size
174KB
-
MD5
f8ae3d04134db63bf814f3165944bdef
-
SHA1
c702c34f97cc79b37c61add307997ab9250dd8f3
-
SHA256
c563f1f45275a004ab9c038692b371b7369ffa0a98fb689b2a8a5ce0d6d51701
-
SHA512
2f6d2abf50847f65a505754d67946cb13ad3fcafd00563569b12f5904169942a934fea809681f345641dca29aa98a141382a23af48d12bdb26b27e94af3c88ac
-
SSDEEP
3072:q6UHMux55t76czZuVf6mm2fWTFphvIPKOcmZN8IjSPhZSeaOjA9/OX:BuT76KGFm28hvIPcmN5IhZSJ9/OX
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Deletes itself 1 IoCs
Processes:
igfxwd32.exepid process 2328 igfxwd32.exe -
Executes dropped EXE 29 IoCs
Processes:
igfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exepid process 2644 igfxwd32.exe 2328 igfxwd32.exe 2480 igfxwd32.exe 2972 igfxwd32.exe 2612 igfxwd32.exe 1968 igfxwd32.exe 268 igfxwd32.exe 484 igfxwd32.exe 1208 igfxwd32.exe 2272 igfxwd32.exe 2016 igfxwd32.exe 2808 igfxwd32.exe 1800 igfxwd32.exe 1684 igfxwd32.exe 1816 igfxwd32.exe 852 igfxwd32.exe 3028 igfxwd32.exe 1220 igfxwd32.exe 1588 igfxwd32.exe 1744 igfxwd32.exe 2636 igfxwd32.exe 2632 igfxwd32.exe 2656 igfxwd32.exe 2332 igfxwd32.exe 2424 igfxwd32.exe 2712 igfxwd32.exe 1924 igfxwd32.exe 2476 igfxwd32.exe 1920 igfxwd32.exe -
Loads dropped DLL 29 IoCs
Processes:
f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exepid process 3044 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe 2644 igfxwd32.exe 2328 igfxwd32.exe 2480 igfxwd32.exe 2972 igfxwd32.exe 2612 igfxwd32.exe 1968 igfxwd32.exe 268 igfxwd32.exe 484 igfxwd32.exe 1208 igfxwd32.exe 2272 igfxwd32.exe 2016 igfxwd32.exe 2808 igfxwd32.exe 1800 igfxwd32.exe 1684 igfxwd32.exe 1816 igfxwd32.exe 852 igfxwd32.exe 3028 igfxwd32.exe 1220 igfxwd32.exe 1588 igfxwd32.exe 1744 igfxwd32.exe 2636 igfxwd32.exe 2632 igfxwd32.exe 2656 igfxwd32.exe 2332 igfxwd32.exe 2424 igfxwd32.exe 2712 igfxwd32.exe 1924 igfxwd32.exe 2476 igfxwd32.exe -
Processes:
resource yara_rule behavioral1/memory/3044-2-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/3044-3-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/3044-4-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/3044-6-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/3044-7-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/3044-8-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/3044-16-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2328-27-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2328-29-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2328-28-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2328-32-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2972-45-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2972-50-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1968-66-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/484-81-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2272-100-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2808-116-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1684-133-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/852-149-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1220-166-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1744-182-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2632-199-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2332-215-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2712-231-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2476-243-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2476-248-0x0000000000400000-0x0000000000466000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 30 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
igfxwd32.exeigfxwd32.exef8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe -
Drops file in System32 directory 45 IoCs
Processes:
f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\igfxwd32.exe f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe -
Suspicious use of SetThreadContext 15 IoCs
Processes:
f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exedescription pid process target process PID 1900 set thread context of 3044 1900 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe PID 2644 set thread context of 2328 2644 igfxwd32.exe igfxwd32.exe PID 2480 set thread context of 2972 2480 igfxwd32.exe igfxwd32.exe PID 2612 set thread context of 1968 2612 igfxwd32.exe igfxwd32.exe PID 268 set thread context of 484 268 igfxwd32.exe igfxwd32.exe PID 1208 set thread context of 2272 1208 igfxwd32.exe igfxwd32.exe PID 2016 set thread context of 2808 2016 igfxwd32.exe igfxwd32.exe PID 1800 set thread context of 1684 1800 igfxwd32.exe igfxwd32.exe PID 1816 set thread context of 852 1816 igfxwd32.exe igfxwd32.exe PID 3028 set thread context of 1220 3028 igfxwd32.exe igfxwd32.exe PID 1588 set thread context of 1744 1588 igfxwd32.exe igfxwd32.exe PID 2636 set thread context of 2632 2636 igfxwd32.exe igfxwd32.exe PID 2656 set thread context of 2332 2656 igfxwd32.exe igfxwd32.exe PID 2424 set thread context of 2712 2424 igfxwd32.exe igfxwd32.exe PID 1924 set thread context of 2476 1924 igfxwd32.exe igfxwd32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exepid process 3044 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe 3044 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe 2328 igfxwd32.exe 2328 igfxwd32.exe 2972 igfxwd32.exe 2972 igfxwd32.exe 1968 igfxwd32.exe 1968 igfxwd32.exe 484 igfxwd32.exe 484 igfxwd32.exe 2272 igfxwd32.exe 2272 igfxwd32.exe 2808 igfxwd32.exe 2808 igfxwd32.exe 1684 igfxwd32.exe 1684 igfxwd32.exe 852 igfxwd32.exe 852 igfxwd32.exe 1220 igfxwd32.exe 1220 igfxwd32.exe 1744 igfxwd32.exe 1744 igfxwd32.exe 2632 igfxwd32.exe 2632 igfxwd32.exe 2332 igfxwd32.exe 2332 igfxwd32.exe 2712 igfxwd32.exe 2712 igfxwd32.exe 2476 igfxwd32.exe 2476 igfxwd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exef8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exeigfxwd32.exedescription pid process target process PID 1900 wrote to memory of 3044 1900 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe PID 1900 wrote to memory of 3044 1900 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe PID 1900 wrote to memory of 3044 1900 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe PID 1900 wrote to memory of 3044 1900 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe PID 1900 wrote to memory of 3044 1900 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe PID 1900 wrote to memory of 3044 1900 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe PID 1900 wrote to memory of 3044 1900 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe PID 3044 wrote to memory of 2644 3044 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe igfxwd32.exe PID 3044 wrote to memory of 2644 3044 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe igfxwd32.exe PID 3044 wrote to memory of 2644 3044 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe igfxwd32.exe PID 3044 wrote to memory of 2644 3044 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe igfxwd32.exe PID 2644 wrote to memory of 2328 2644 igfxwd32.exe igfxwd32.exe PID 2644 wrote to memory of 2328 2644 igfxwd32.exe igfxwd32.exe PID 2644 wrote to memory of 2328 2644 igfxwd32.exe igfxwd32.exe PID 2644 wrote to memory of 2328 2644 igfxwd32.exe igfxwd32.exe PID 2644 wrote to memory of 2328 2644 igfxwd32.exe igfxwd32.exe PID 2644 wrote to memory of 2328 2644 igfxwd32.exe igfxwd32.exe PID 2644 wrote to memory of 2328 2644 igfxwd32.exe igfxwd32.exe PID 2328 wrote to memory of 2480 2328 igfxwd32.exe igfxwd32.exe PID 2328 wrote to memory of 2480 2328 igfxwd32.exe igfxwd32.exe PID 2328 wrote to memory of 2480 2328 igfxwd32.exe igfxwd32.exe PID 2328 wrote to memory of 2480 2328 igfxwd32.exe igfxwd32.exe PID 2480 wrote to memory of 2972 2480 igfxwd32.exe igfxwd32.exe PID 2480 wrote to memory of 2972 2480 igfxwd32.exe igfxwd32.exe PID 2480 wrote to memory of 2972 2480 igfxwd32.exe igfxwd32.exe PID 2480 wrote to memory of 2972 2480 igfxwd32.exe igfxwd32.exe PID 2480 wrote to memory of 2972 2480 igfxwd32.exe igfxwd32.exe PID 2480 wrote to memory of 2972 2480 igfxwd32.exe igfxwd32.exe PID 2480 wrote to memory of 2972 2480 igfxwd32.exe igfxwd32.exe PID 2972 wrote to memory of 2612 2972 igfxwd32.exe igfxwd32.exe PID 2972 wrote to memory of 2612 2972 igfxwd32.exe igfxwd32.exe PID 2972 wrote to memory of 2612 2972 igfxwd32.exe igfxwd32.exe PID 2972 wrote to memory of 2612 2972 igfxwd32.exe igfxwd32.exe PID 2612 wrote to memory of 1968 2612 igfxwd32.exe igfxwd32.exe PID 2612 wrote to memory of 1968 2612 igfxwd32.exe igfxwd32.exe PID 2612 wrote to memory of 1968 2612 igfxwd32.exe igfxwd32.exe PID 2612 wrote to memory of 1968 2612 igfxwd32.exe igfxwd32.exe PID 2612 wrote to memory of 1968 2612 igfxwd32.exe igfxwd32.exe PID 2612 wrote to memory of 1968 2612 igfxwd32.exe igfxwd32.exe PID 2612 wrote to memory of 1968 2612 igfxwd32.exe igfxwd32.exe PID 1968 wrote to memory of 268 1968 igfxwd32.exe igfxwd32.exe PID 1968 wrote to memory of 268 1968 igfxwd32.exe igfxwd32.exe PID 1968 wrote to memory of 268 1968 igfxwd32.exe igfxwd32.exe PID 1968 wrote to memory of 268 1968 igfxwd32.exe igfxwd32.exe PID 268 wrote to memory of 484 268 igfxwd32.exe igfxwd32.exe PID 268 wrote to memory of 484 268 igfxwd32.exe igfxwd32.exe PID 268 wrote to memory of 484 268 igfxwd32.exe igfxwd32.exe PID 268 wrote to memory of 484 268 igfxwd32.exe igfxwd32.exe PID 268 wrote to memory of 484 268 igfxwd32.exe igfxwd32.exe PID 268 wrote to memory of 484 268 igfxwd32.exe igfxwd32.exe PID 268 wrote to memory of 484 268 igfxwd32.exe igfxwd32.exe PID 484 wrote to memory of 1208 484 igfxwd32.exe igfxwd32.exe PID 484 wrote to memory of 1208 484 igfxwd32.exe igfxwd32.exe PID 484 wrote to memory of 1208 484 igfxwd32.exe igfxwd32.exe PID 484 wrote to memory of 1208 484 igfxwd32.exe igfxwd32.exe PID 1208 wrote to memory of 2272 1208 igfxwd32.exe igfxwd32.exe PID 1208 wrote to memory of 2272 1208 igfxwd32.exe igfxwd32.exe PID 1208 wrote to memory of 2272 1208 igfxwd32.exe igfxwd32.exe PID 1208 wrote to memory of 2272 1208 igfxwd32.exe igfxwd32.exe PID 1208 wrote to memory of 2272 1208 igfxwd32.exe igfxwd32.exe PID 1208 wrote to memory of 2272 1208 igfxwd32.exe igfxwd32.exe PID 1208 wrote to memory of 2272 1208 igfxwd32.exe igfxwd32.exe PID 2272 wrote to memory of 2016 2272 igfxwd32.exe igfxwd32.exe PID 2272 wrote to memory of 2016 2272 igfxwd32.exe igfxwd32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Users\Admin\AppData\Local\Temp\F8AE3D~1.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Users\Admin\AppData\Local\Temp\F8AE3D~1.EXE4⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe31⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\igfxwd32.exeFilesize
174KB
MD5f8ae3d04134db63bf814f3165944bdef
SHA1c702c34f97cc79b37c61add307997ab9250dd8f3
SHA256c563f1f45275a004ab9c038692b371b7369ffa0a98fb689b2a8a5ce0d6d51701
SHA5122f6d2abf50847f65a505754d67946cb13ad3fcafd00563569b12f5904169942a934fea809681f345641dca29aa98a141382a23af48d12bdb26b27e94af3c88ac
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/484-81-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/852-149-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1220-166-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1684-133-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1744-182-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1968-66-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2272-100-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2328-32-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2328-28-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2328-27-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2328-29-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2332-215-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2476-243-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2476-248-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2632-199-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2712-231-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2808-116-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2972-45-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2972-50-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/3044-4-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/3044-0-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/3044-8-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/3044-7-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/3044-6-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/3044-16-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/3044-3-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/3044-2-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB