Analysis
-
max time kernel
147s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-04-2024 11:15
Static task
static1
Behavioral task
behavioral1
Sample
ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe
-
Size
168KB
-
MD5
ff27a4ed5c37e9bbeaf94cc15ed5fbe2
-
SHA1
5678d6b8ecb7661e8e5c1a3a2c4d209c3d7a3c1c
-
SHA256
a42d3b58c510be1f7a3cab1c72ec2482f462a71cb402ed4e1d2ab1ee5e448cf2
-
SHA512
a2d85ae8667f267757fab1a0d2e51151a35fcf2f1308df6c5661846fa933e4d82238fa86403441e1b6857111b177e3f87354875a45a2d28a91a7f59c978d407b
-
SSDEEP
3072:kwHbG1J8ZFgf+t5aoO28lXUKaYP6AGK8nsQqlrlgq8OMKZgC2lCDkVDclqL1Xc:B7HZFgfX2GXeYCAGZsBJjrZ8lwTlkXc
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Deletes itself 1 IoCs
Processes:
igfxwk32.exepid process 2716 igfxwk32.exe -
Executes dropped EXE 29 IoCs
Processes:
igfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exepid process 2604 igfxwk32.exe 2716 igfxwk32.exe 2440 igfxwk32.exe 2548 igfxwk32.exe 2664 igfxwk32.exe 2720 igfxwk32.exe 1848 igfxwk32.exe 268 igfxwk32.exe 1116 igfxwk32.exe 2696 igfxwk32.exe 2220 igfxwk32.exe 1652 igfxwk32.exe 2972 igfxwk32.exe 2300 igfxwk32.exe 2908 igfxwk32.exe 864 igfxwk32.exe 1388 igfxwk32.exe 1528 igfxwk32.exe 1480 igfxwk32.exe 1008 igfxwk32.exe 2608 igfxwk32.exe 2140 igfxwk32.exe 2432 igfxwk32.exe 2292 igfxwk32.exe 2668 igfxwk32.exe 2688 igfxwk32.exe 1736 igfxwk32.exe 336 igfxwk32.exe 1260 igfxwk32.exe -
Loads dropped DLL 29 IoCs
Processes:
ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exepid process 1856 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe 2604 igfxwk32.exe 2716 igfxwk32.exe 2440 igfxwk32.exe 2548 igfxwk32.exe 2664 igfxwk32.exe 2720 igfxwk32.exe 1848 igfxwk32.exe 268 igfxwk32.exe 1116 igfxwk32.exe 2696 igfxwk32.exe 2220 igfxwk32.exe 1652 igfxwk32.exe 2972 igfxwk32.exe 2300 igfxwk32.exe 2908 igfxwk32.exe 864 igfxwk32.exe 1388 igfxwk32.exe 1528 igfxwk32.exe 1480 igfxwk32.exe 1008 igfxwk32.exe 2608 igfxwk32.exe 2140 igfxwk32.exe 2432 igfxwk32.exe 2292 igfxwk32.exe 2668 igfxwk32.exe 2688 igfxwk32.exe 1736 igfxwk32.exe 336 igfxwk32.exe -
Processes:
resource yara_rule behavioral1/memory/1856-2-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1856-3-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1856-4-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1856-6-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1856-8-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1856-7-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1856-16-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2716-27-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2716-29-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2716-28-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2716-32-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2548-47-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2720-60-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2720-64-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/268-80-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2696-97-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1652-113-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2300-124-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2300-126-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2300-133-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/864-149-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1528-166-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1008-182-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2140-199-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2292-215-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2688-232-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/336-244-0x0000000000400000-0x0000000000466000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 30 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
igfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exeigfxwk32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe -
Drops file in System32 directory 45 IoCs
Processes:
igfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe -
Suspicious use of SetThreadContext 15 IoCs
Processes:
ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exedescription pid process target process PID 2000 set thread context of 1856 2000 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe PID 2604 set thread context of 2716 2604 igfxwk32.exe igfxwk32.exe PID 2440 set thread context of 2548 2440 igfxwk32.exe igfxwk32.exe PID 2664 set thread context of 2720 2664 igfxwk32.exe igfxwk32.exe PID 1848 set thread context of 268 1848 igfxwk32.exe igfxwk32.exe PID 1116 set thread context of 2696 1116 igfxwk32.exe igfxwk32.exe PID 2220 set thread context of 1652 2220 igfxwk32.exe igfxwk32.exe PID 2972 set thread context of 2300 2972 igfxwk32.exe igfxwk32.exe PID 2908 set thread context of 864 2908 igfxwk32.exe igfxwk32.exe PID 1388 set thread context of 1528 1388 igfxwk32.exe igfxwk32.exe PID 1480 set thread context of 1008 1480 igfxwk32.exe igfxwk32.exe PID 2608 set thread context of 2140 2608 igfxwk32.exe igfxwk32.exe PID 2432 set thread context of 2292 2432 igfxwk32.exe igfxwk32.exe PID 2668 set thread context of 2688 2668 igfxwk32.exe igfxwk32.exe PID 1736 set thread context of 336 1736 igfxwk32.exe igfxwk32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exepid process 1856 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe 1856 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe 2716 igfxwk32.exe 2716 igfxwk32.exe 2548 igfxwk32.exe 2548 igfxwk32.exe 2720 igfxwk32.exe 2720 igfxwk32.exe 268 igfxwk32.exe 268 igfxwk32.exe 2696 igfxwk32.exe 2696 igfxwk32.exe 1652 igfxwk32.exe 1652 igfxwk32.exe 2300 igfxwk32.exe 2300 igfxwk32.exe 864 igfxwk32.exe 864 igfxwk32.exe 1528 igfxwk32.exe 1528 igfxwk32.exe 1008 igfxwk32.exe 1008 igfxwk32.exe 2140 igfxwk32.exe 2140 igfxwk32.exe 2292 igfxwk32.exe 2292 igfxwk32.exe 2688 igfxwk32.exe 2688 igfxwk32.exe 336 igfxwk32.exe 336 igfxwk32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exeff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exedescription pid process target process PID 2000 wrote to memory of 1856 2000 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe PID 2000 wrote to memory of 1856 2000 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe PID 2000 wrote to memory of 1856 2000 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe PID 2000 wrote to memory of 1856 2000 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe PID 2000 wrote to memory of 1856 2000 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe PID 2000 wrote to memory of 1856 2000 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe PID 2000 wrote to memory of 1856 2000 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe PID 1856 wrote to memory of 2604 1856 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe igfxwk32.exe PID 1856 wrote to memory of 2604 1856 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe igfxwk32.exe PID 1856 wrote to memory of 2604 1856 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe igfxwk32.exe PID 1856 wrote to memory of 2604 1856 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe igfxwk32.exe PID 2604 wrote to memory of 2716 2604 igfxwk32.exe igfxwk32.exe PID 2604 wrote to memory of 2716 2604 igfxwk32.exe igfxwk32.exe PID 2604 wrote to memory of 2716 2604 igfxwk32.exe igfxwk32.exe PID 2604 wrote to memory of 2716 2604 igfxwk32.exe igfxwk32.exe PID 2604 wrote to memory of 2716 2604 igfxwk32.exe igfxwk32.exe PID 2604 wrote to memory of 2716 2604 igfxwk32.exe igfxwk32.exe PID 2604 wrote to memory of 2716 2604 igfxwk32.exe igfxwk32.exe PID 2716 wrote to memory of 2440 2716 igfxwk32.exe igfxwk32.exe PID 2716 wrote to memory of 2440 2716 igfxwk32.exe igfxwk32.exe PID 2716 wrote to memory of 2440 2716 igfxwk32.exe igfxwk32.exe PID 2716 wrote to memory of 2440 2716 igfxwk32.exe igfxwk32.exe PID 2440 wrote to memory of 2548 2440 igfxwk32.exe igfxwk32.exe PID 2440 wrote to memory of 2548 2440 igfxwk32.exe igfxwk32.exe PID 2440 wrote to memory of 2548 2440 igfxwk32.exe igfxwk32.exe PID 2440 wrote to memory of 2548 2440 igfxwk32.exe igfxwk32.exe PID 2440 wrote to memory of 2548 2440 igfxwk32.exe igfxwk32.exe PID 2440 wrote to memory of 2548 2440 igfxwk32.exe igfxwk32.exe PID 2440 wrote to memory of 2548 2440 igfxwk32.exe igfxwk32.exe PID 2548 wrote to memory of 2664 2548 igfxwk32.exe igfxwk32.exe PID 2548 wrote to memory of 2664 2548 igfxwk32.exe igfxwk32.exe PID 2548 wrote to memory of 2664 2548 igfxwk32.exe igfxwk32.exe PID 2548 wrote to memory of 2664 2548 igfxwk32.exe igfxwk32.exe PID 2664 wrote to memory of 2720 2664 igfxwk32.exe igfxwk32.exe PID 2664 wrote to memory of 2720 2664 igfxwk32.exe igfxwk32.exe PID 2664 wrote to memory of 2720 2664 igfxwk32.exe igfxwk32.exe PID 2664 wrote to memory of 2720 2664 igfxwk32.exe igfxwk32.exe PID 2664 wrote to memory of 2720 2664 igfxwk32.exe igfxwk32.exe PID 2664 wrote to memory of 2720 2664 igfxwk32.exe igfxwk32.exe PID 2664 wrote to memory of 2720 2664 igfxwk32.exe igfxwk32.exe PID 2720 wrote to memory of 1848 2720 igfxwk32.exe igfxwk32.exe PID 2720 wrote to memory of 1848 2720 igfxwk32.exe igfxwk32.exe PID 2720 wrote to memory of 1848 2720 igfxwk32.exe igfxwk32.exe PID 2720 wrote to memory of 1848 2720 igfxwk32.exe igfxwk32.exe PID 1848 wrote to memory of 268 1848 igfxwk32.exe igfxwk32.exe PID 1848 wrote to memory of 268 1848 igfxwk32.exe igfxwk32.exe PID 1848 wrote to memory of 268 1848 igfxwk32.exe igfxwk32.exe PID 1848 wrote to memory of 268 1848 igfxwk32.exe igfxwk32.exe PID 1848 wrote to memory of 268 1848 igfxwk32.exe igfxwk32.exe PID 1848 wrote to memory of 268 1848 igfxwk32.exe igfxwk32.exe PID 1848 wrote to memory of 268 1848 igfxwk32.exe igfxwk32.exe PID 268 wrote to memory of 1116 268 igfxwk32.exe igfxwk32.exe PID 268 wrote to memory of 1116 268 igfxwk32.exe igfxwk32.exe PID 268 wrote to memory of 1116 268 igfxwk32.exe igfxwk32.exe PID 268 wrote to memory of 1116 268 igfxwk32.exe igfxwk32.exe PID 1116 wrote to memory of 2696 1116 igfxwk32.exe igfxwk32.exe PID 1116 wrote to memory of 2696 1116 igfxwk32.exe igfxwk32.exe PID 1116 wrote to memory of 2696 1116 igfxwk32.exe igfxwk32.exe PID 1116 wrote to memory of 2696 1116 igfxwk32.exe igfxwk32.exe PID 1116 wrote to memory of 2696 1116 igfxwk32.exe igfxwk32.exe PID 1116 wrote to memory of 2696 1116 igfxwk32.exe igfxwk32.exe PID 1116 wrote to memory of 2696 1116 igfxwk32.exe igfxwk32.exe PID 2696 wrote to memory of 2220 2696 igfxwk32.exe igfxwk32.exe PID 2696 wrote to memory of 2220 2696 igfxwk32.exe igfxwk32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Users\Admin\AppData\Local\Temp\FF27A4~1.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Users\Admin\AppData\Local\Temp\FF27A4~1.EXE4⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe31⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Windows\SysWOW64\igfxwk32.exeFilesize
168KB
MD5ff27a4ed5c37e9bbeaf94cc15ed5fbe2
SHA15678d6b8ecb7661e8e5c1a3a2c4d209c3d7a3c1c
SHA256a42d3b58c510be1f7a3cab1c72ec2482f462a71cb402ed4e1d2ab1ee5e448cf2
SHA512a2d85ae8667f267757fab1a0d2e51151a35fcf2f1308df6c5661846fa933e4d82238fa86403441e1b6857111b177e3f87354875a45a2d28a91a7f59c978d407b
-
memory/268-80-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/336-244-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/864-149-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1008-182-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1528-166-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1652-113-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1856-6-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1856-16-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1856-7-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1856-8-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1856-4-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1856-3-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1856-2-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1856-0-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2140-199-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2292-215-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2300-133-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2300-124-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2300-126-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2548-47-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2688-232-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2696-97-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2716-32-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2716-28-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2716-29-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2716-27-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2720-64-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2720-60-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB