Analysis
-
max time kernel
148s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-04-2024 20:29
Static task
static1
Behavioral task
behavioral1
Sample
f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe
-
Size
174KB
-
MD5
f8ae3d04134db63bf814f3165944bdef
-
SHA1
c702c34f97cc79b37c61add307997ab9250dd8f3
-
SHA256
c563f1f45275a004ab9c038692b371b7369ffa0a98fb689b2a8a5ce0d6d51701
-
SHA512
2f6d2abf50847f65a505754d67946cb13ad3fcafd00563569b12f5904169942a934fea809681f345641dca29aa98a141382a23af48d12bdb26b27e94af3c88ac
-
SSDEEP
3072:q6UHMux55t76czZuVf6mm2fWTFphvIPKOcmZN8IjSPhZSeaOjA9/OX:BuT76KGFm28hvIPcmN5IhZSJ9/OX
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Deletes itself 1 IoCs
pid Process 2328 igfxwd32.exe -
Executes dropped EXE 29 IoCs
pid Process 2644 igfxwd32.exe 2328 igfxwd32.exe 2480 igfxwd32.exe 2972 igfxwd32.exe 2612 igfxwd32.exe 1968 igfxwd32.exe 268 igfxwd32.exe 484 igfxwd32.exe 1208 igfxwd32.exe 2272 igfxwd32.exe 2016 igfxwd32.exe 2808 igfxwd32.exe 1800 igfxwd32.exe 1684 igfxwd32.exe 1816 igfxwd32.exe 852 igfxwd32.exe 3028 igfxwd32.exe 1220 igfxwd32.exe 1588 igfxwd32.exe 1744 igfxwd32.exe 2636 igfxwd32.exe 2632 igfxwd32.exe 2656 igfxwd32.exe 2332 igfxwd32.exe 2424 igfxwd32.exe 2712 igfxwd32.exe 1924 igfxwd32.exe 2476 igfxwd32.exe 1920 igfxwd32.exe -
Loads dropped DLL 29 IoCs
pid Process 3044 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe 2644 igfxwd32.exe 2328 igfxwd32.exe 2480 igfxwd32.exe 2972 igfxwd32.exe 2612 igfxwd32.exe 1968 igfxwd32.exe 268 igfxwd32.exe 484 igfxwd32.exe 1208 igfxwd32.exe 2272 igfxwd32.exe 2016 igfxwd32.exe 2808 igfxwd32.exe 1800 igfxwd32.exe 1684 igfxwd32.exe 1816 igfxwd32.exe 852 igfxwd32.exe 3028 igfxwd32.exe 1220 igfxwd32.exe 1588 igfxwd32.exe 1744 igfxwd32.exe 2636 igfxwd32.exe 2632 igfxwd32.exe 2656 igfxwd32.exe 2332 igfxwd32.exe 2424 igfxwd32.exe 2712 igfxwd32.exe 1924 igfxwd32.exe 2476 igfxwd32.exe -
resource yara_rule behavioral1/memory/3044-2-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/3044-3-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/3044-4-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/3044-6-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/3044-7-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/3044-8-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/3044-16-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2328-27-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2328-29-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2328-28-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2328-32-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2972-45-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2972-50-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1968-66-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/484-81-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2272-100-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2808-116-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1684-133-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/852-149-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1220-166-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1744-182-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2632-199-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2332-215-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2712-231-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2476-243-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2476-248-0x0000000000400000-0x0000000000466000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 30 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwd32.exe -
Drops file in System32 directory 45 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\igfxwd32.exe f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File created C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe File opened for modification C:\Windows\SysWOW64\ igfxwd32.exe File opened for modification C:\Windows\SysWOW64\igfxwd32.exe igfxwd32.exe -
Suspicious use of SetThreadContext 15 IoCs
description pid Process procid_target PID 1900 set thread context of 3044 1900 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe 28 PID 2644 set thread context of 2328 2644 igfxwd32.exe 30 PID 2480 set thread context of 2972 2480 igfxwd32.exe 32 PID 2612 set thread context of 1968 2612 igfxwd32.exe 34 PID 268 set thread context of 484 268 igfxwd32.exe 38 PID 1208 set thread context of 2272 1208 igfxwd32.exe 40 PID 2016 set thread context of 2808 2016 igfxwd32.exe 42 PID 1800 set thread context of 1684 1800 igfxwd32.exe 44 PID 1816 set thread context of 852 1816 igfxwd32.exe 46 PID 3028 set thread context of 1220 3028 igfxwd32.exe 48 PID 1588 set thread context of 1744 1588 igfxwd32.exe 50 PID 2636 set thread context of 2632 2636 igfxwd32.exe 52 PID 2656 set thread context of 2332 2656 igfxwd32.exe 54 PID 2424 set thread context of 2712 2424 igfxwd32.exe 56 PID 1924 set thread context of 2476 1924 igfxwd32.exe 58 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 3044 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe 3044 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe 2328 igfxwd32.exe 2328 igfxwd32.exe 2972 igfxwd32.exe 2972 igfxwd32.exe 1968 igfxwd32.exe 1968 igfxwd32.exe 484 igfxwd32.exe 484 igfxwd32.exe 2272 igfxwd32.exe 2272 igfxwd32.exe 2808 igfxwd32.exe 2808 igfxwd32.exe 1684 igfxwd32.exe 1684 igfxwd32.exe 852 igfxwd32.exe 852 igfxwd32.exe 1220 igfxwd32.exe 1220 igfxwd32.exe 1744 igfxwd32.exe 1744 igfxwd32.exe 2632 igfxwd32.exe 2632 igfxwd32.exe 2332 igfxwd32.exe 2332 igfxwd32.exe 2712 igfxwd32.exe 2712 igfxwd32.exe 2476 igfxwd32.exe 2476 igfxwd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1900 wrote to memory of 3044 1900 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe 28 PID 1900 wrote to memory of 3044 1900 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe 28 PID 1900 wrote to memory of 3044 1900 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe 28 PID 1900 wrote to memory of 3044 1900 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe 28 PID 1900 wrote to memory of 3044 1900 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe 28 PID 1900 wrote to memory of 3044 1900 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe 28 PID 1900 wrote to memory of 3044 1900 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe 28 PID 3044 wrote to memory of 2644 3044 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe 29 PID 3044 wrote to memory of 2644 3044 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe 29 PID 3044 wrote to memory of 2644 3044 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe 29 PID 3044 wrote to memory of 2644 3044 f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe 29 PID 2644 wrote to memory of 2328 2644 igfxwd32.exe 30 PID 2644 wrote to memory of 2328 2644 igfxwd32.exe 30 PID 2644 wrote to memory of 2328 2644 igfxwd32.exe 30 PID 2644 wrote to memory of 2328 2644 igfxwd32.exe 30 PID 2644 wrote to memory of 2328 2644 igfxwd32.exe 30 PID 2644 wrote to memory of 2328 2644 igfxwd32.exe 30 PID 2644 wrote to memory of 2328 2644 igfxwd32.exe 30 PID 2328 wrote to memory of 2480 2328 igfxwd32.exe 31 PID 2328 wrote to memory of 2480 2328 igfxwd32.exe 31 PID 2328 wrote to memory of 2480 2328 igfxwd32.exe 31 PID 2328 wrote to memory of 2480 2328 igfxwd32.exe 31 PID 2480 wrote to memory of 2972 2480 igfxwd32.exe 32 PID 2480 wrote to memory of 2972 2480 igfxwd32.exe 32 PID 2480 wrote to memory of 2972 2480 igfxwd32.exe 32 PID 2480 wrote to memory of 2972 2480 igfxwd32.exe 32 PID 2480 wrote to memory of 2972 2480 igfxwd32.exe 32 PID 2480 wrote to memory of 2972 2480 igfxwd32.exe 32 PID 2480 wrote to memory of 2972 2480 igfxwd32.exe 32 PID 2972 wrote to memory of 2612 2972 igfxwd32.exe 33 PID 2972 wrote to memory of 2612 2972 igfxwd32.exe 33 PID 2972 wrote to memory of 2612 2972 igfxwd32.exe 33 PID 2972 wrote to memory of 2612 2972 igfxwd32.exe 33 PID 2612 wrote to memory of 1968 2612 igfxwd32.exe 34 PID 2612 wrote to memory of 1968 2612 igfxwd32.exe 34 PID 2612 wrote to memory of 1968 2612 igfxwd32.exe 34 PID 2612 wrote to memory of 1968 2612 igfxwd32.exe 34 PID 2612 wrote to memory of 1968 2612 igfxwd32.exe 34 PID 2612 wrote to memory of 1968 2612 igfxwd32.exe 34 PID 2612 wrote to memory of 1968 2612 igfxwd32.exe 34 PID 1968 wrote to memory of 268 1968 igfxwd32.exe 37 PID 1968 wrote to memory of 268 1968 igfxwd32.exe 37 PID 1968 wrote to memory of 268 1968 igfxwd32.exe 37 PID 1968 wrote to memory of 268 1968 igfxwd32.exe 37 PID 268 wrote to memory of 484 268 igfxwd32.exe 38 PID 268 wrote to memory of 484 268 igfxwd32.exe 38 PID 268 wrote to memory of 484 268 igfxwd32.exe 38 PID 268 wrote to memory of 484 268 igfxwd32.exe 38 PID 268 wrote to memory of 484 268 igfxwd32.exe 38 PID 268 wrote to memory of 484 268 igfxwd32.exe 38 PID 268 wrote to memory of 484 268 igfxwd32.exe 38 PID 484 wrote to memory of 1208 484 igfxwd32.exe 39 PID 484 wrote to memory of 1208 484 igfxwd32.exe 39 PID 484 wrote to memory of 1208 484 igfxwd32.exe 39 PID 484 wrote to memory of 1208 484 igfxwd32.exe 39 PID 1208 wrote to memory of 2272 1208 igfxwd32.exe 40 PID 1208 wrote to memory of 2272 1208 igfxwd32.exe 40 PID 1208 wrote to memory of 2272 1208 igfxwd32.exe 40 PID 1208 wrote to memory of 2272 1208 igfxwd32.exe 40 PID 1208 wrote to memory of 2272 1208 igfxwd32.exe 40 PID 1208 wrote to memory of 2272 1208 igfxwd32.exe 40 PID 1208 wrote to memory of 2272 1208 igfxwd32.exe 40 PID 2272 wrote to memory of 2016 2272 igfxwd32.exe 41 PID 2272 wrote to memory of 2016 2272 igfxwd32.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f8ae3d04134db63bf814f3165944bdef_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Users\Admin\AppData\Local\Temp\F8AE3D~1.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Users\Admin\AppData\Local\Temp\F8AE3D~1.EXE4⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2016 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2808 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1800 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1684 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1816 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:852 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:3028 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1220 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1588 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1744 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2636 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2632 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2656 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2332 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2424 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2712 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1924 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2476 -
C:\Windows\SysWOW64\igfxwd32.exe"C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe31⤵
- Executes dropped EXE
PID:1920
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
174KB
MD5f8ae3d04134db63bf814f3165944bdef
SHA1c702c34f97cc79b37c61add307997ab9250dd8f3
SHA256c563f1f45275a004ab9c038692b371b7369ffa0a98fb689b2a8a5ce0d6d51701
SHA5122f6d2abf50847f65a505754d67946cb13ad3fcafd00563569b12f5904169942a934fea809681f345641dca29aa98a141382a23af48d12bdb26b27e94af3c88ac