Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
21-04-2024 11:15
Static task
static1
Behavioral task
behavioral1
Sample
ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe
-
Size
168KB
-
MD5
ff27a4ed5c37e9bbeaf94cc15ed5fbe2
-
SHA1
5678d6b8ecb7661e8e5c1a3a2c4d209c3d7a3c1c
-
SHA256
a42d3b58c510be1f7a3cab1c72ec2482f462a71cb402ed4e1d2ab1ee5e448cf2
-
SHA512
a2d85ae8667f267757fab1a0d2e51151a35fcf2f1308df6c5661846fa933e4d82238fa86403441e1b6857111b177e3f87354875a45a2d28a91a7f59c978d407b
-
SSDEEP
3072:kwHbG1J8ZFgf+t5aoO28lXUKaYP6AGK8nsQqlrlgq8OMKZgC2lCDkVDclqL1Xc:B7HZFgfX2GXeYCAGZsBJjrZ8lwTlkXc
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Checks computer location settings 2 TTPs 15 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
igfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exeigfxwk32.exeigfxwk32.exeigfxwk32.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation igfxwk32.exe Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation igfxwk32.exe Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation igfxwk32.exe Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation igfxwk32.exe Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation igfxwk32.exe Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation igfxwk32.exe Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation igfxwk32.exe Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation igfxwk32.exe Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation igfxwk32.exe Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation igfxwk32.exe Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation igfxwk32.exe Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation igfxwk32.exe Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation igfxwk32.exe Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation igfxwk32.exe -
Deletes itself 1 IoCs
Processes:
igfxwk32.exepid process 4848 igfxwk32.exe -
Executes dropped EXE 29 IoCs
Processes:
igfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exepid process 1608 igfxwk32.exe 4848 igfxwk32.exe 1356 igfxwk32.exe 4192 igfxwk32.exe 2384 igfxwk32.exe 468 igfxwk32.exe 3180 igfxwk32.exe 1868 igfxwk32.exe 3216 igfxwk32.exe 3492 igfxwk32.exe 3528 igfxwk32.exe 3448 igfxwk32.exe 4392 igfxwk32.exe 4588 igfxwk32.exe 5096 igfxwk32.exe 516 igfxwk32.exe 3656 igfxwk32.exe 2808 igfxwk32.exe 4864 igfxwk32.exe 1428 igfxwk32.exe 3652 igfxwk32.exe 2864 igfxwk32.exe 2576 igfxwk32.exe 2244 igfxwk32.exe 4132 igfxwk32.exe 2380 igfxwk32.exe 3456 igfxwk32.exe 4364 igfxwk32.exe 4740 igfxwk32.exe -
Processes:
resource yara_rule behavioral2/memory/3832-0-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3832-2-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3832-3-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3832-4-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3832-38-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4848-45-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4848-47-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4192-54-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4192-55-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/468-63-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/468-65-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1868-72-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1868-75-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3492-82-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3492-84-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3448-90-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3448-92-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4588-99-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4588-102-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/516-109-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/516-111-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2808-117-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2808-120-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1428-127-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1428-131-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2864-137-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2864-141-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2244-146-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2244-148-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2244-152-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2380-158-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2380-162-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4364-167-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4364-172-0x0000000000400000-0x0000000000466000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 30 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
igfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwk32.exe -
Drops file in System32 directory 45 IoCs
Processes:
igfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe File created C:\Windows\SysWOW64\igfxwk32.exe ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File created C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe File opened for modification C:\Windows\SysWOW64\ igfxwk32.exe File opened for modification C:\Windows\SysWOW64\igfxwk32.exe igfxwk32.exe -
Suspicious use of SetThreadContext 15 IoCs
Processes:
ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exedescription pid process target process PID 2312 set thread context of 3832 2312 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe PID 1608 set thread context of 4848 1608 igfxwk32.exe igfxwk32.exe PID 1356 set thread context of 4192 1356 igfxwk32.exe igfxwk32.exe PID 2384 set thread context of 468 2384 igfxwk32.exe igfxwk32.exe PID 3180 set thread context of 1868 3180 igfxwk32.exe igfxwk32.exe PID 3216 set thread context of 3492 3216 igfxwk32.exe igfxwk32.exe PID 3528 set thread context of 3448 3528 igfxwk32.exe igfxwk32.exe PID 4392 set thread context of 4588 4392 igfxwk32.exe igfxwk32.exe PID 5096 set thread context of 516 5096 igfxwk32.exe igfxwk32.exe PID 3656 set thread context of 2808 3656 igfxwk32.exe igfxwk32.exe PID 4864 set thread context of 1428 4864 igfxwk32.exe igfxwk32.exe PID 3652 set thread context of 2864 3652 igfxwk32.exe igfxwk32.exe PID 2576 set thread context of 2244 2576 igfxwk32.exe igfxwk32.exe PID 4132 set thread context of 2380 4132 igfxwk32.exe igfxwk32.exe PID 3456 set thread context of 4364 3456 igfxwk32.exe igfxwk32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 15 IoCs
Processes:
igfxwk32.exeigfxwk32.exeigfxwk32.exeff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwk32.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exepid process 3832 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe 3832 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe 3832 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe 3832 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe 4848 igfxwk32.exe 4848 igfxwk32.exe 4848 igfxwk32.exe 4848 igfxwk32.exe 4192 igfxwk32.exe 4192 igfxwk32.exe 4192 igfxwk32.exe 4192 igfxwk32.exe 468 igfxwk32.exe 468 igfxwk32.exe 468 igfxwk32.exe 468 igfxwk32.exe 1868 igfxwk32.exe 1868 igfxwk32.exe 1868 igfxwk32.exe 1868 igfxwk32.exe 3492 igfxwk32.exe 3492 igfxwk32.exe 3492 igfxwk32.exe 3492 igfxwk32.exe 3448 igfxwk32.exe 3448 igfxwk32.exe 3448 igfxwk32.exe 3448 igfxwk32.exe 4588 igfxwk32.exe 4588 igfxwk32.exe 4588 igfxwk32.exe 4588 igfxwk32.exe 516 igfxwk32.exe 516 igfxwk32.exe 516 igfxwk32.exe 516 igfxwk32.exe 2808 igfxwk32.exe 2808 igfxwk32.exe 2808 igfxwk32.exe 2808 igfxwk32.exe 1428 igfxwk32.exe 1428 igfxwk32.exe 1428 igfxwk32.exe 1428 igfxwk32.exe 2864 igfxwk32.exe 2864 igfxwk32.exe 2864 igfxwk32.exe 2864 igfxwk32.exe 2244 igfxwk32.exe 2244 igfxwk32.exe 2244 igfxwk32.exe 2244 igfxwk32.exe 2380 igfxwk32.exe 2380 igfxwk32.exe 2380 igfxwk32.exe 2380 igfxwk32.exe 4364 igfxwk32.exe 4364 igfxwk32.exe 4364 igfxwk32.exe 4364 igfxwk32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exeff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exeigfxwk32.exedescription pid process target process PID 2312 wrote to memory of 3832 2312 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe PID 2312 wrote to memory of 3832 2312 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe PID 2312 wrote to memory of 3832 2312 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe PID 2312 wrote to memory of 3832 2312 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe PID 2312 wrote to memory of 3832 2312 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe PID 2312 wrote to memory of 3832 2312 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe PID 2312 wrote to memory of 3832 2312 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe PID 3832 wrote to memory of 1608 3832 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe igfxwk32.exe PID 3832 wrote to memory of 1608 3832 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe igfxwk32.exe PID 3832 wrote to memory of 1608 3832 ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe igfxwk32.exe PID 1608 wrote to memory of 4848 1608 igfxwk32.exe igfxwk32.exe PID 1608 wrote to memory of 4848 1608 igfxwk32.exe igfxwk32.exe PID 1608 wrote to memory of 4848 1608 igfxwk32.exe igfxwk32.exe PID 1608 wrote to memory of 4848 1608 igfxwk32.exe igfxwk32.exe PID 1608 wrote to memory of 4848 1608 igfxwk32.exe igfxwk32.exe PID 1608 wrote to memory of 4848 1608 igfxwk32.exe igfxwk32.exe PID 1608 wrote to memory of 4848 1608 igfxwk32.exe igfxwk32.exe PID 4848 wrote to memory of 1356 4848 igfxwk32.exe igfxwk32.exe PID 4848 wrote to memory of 1356 4848 igfxwk32.exe igfxwk32.exe PID 4848 wrote to memory of 1356 4848 igfxwk32.exe igfxwk32.exe PID 1356 wrote to memory of 4192 1356 igfxwk32.exe igfxwk32.exe PID 1356 wrote to memory of 4192 1356 igfxwk32.exe igfxwk32.exe PID 1356 wrote to memory of 4192 1356 igfxwk32.exe igfxwk32.exe PID 1356 wrote to memory of 4192 1356 igfxwk32.exe igfxwk32.exe PID 1356 wrote to memory of 4192 1356 igfxwk32.exe igfxwk32.exe PID 1356 wrote to memory of 4192 1356 igfxwk32.exe igfxwk32.exe PID 1356 wrote to memory of 4192 1356 igfxwk32.exe igfxwk32.exe PID 4192 wrote to memory of 2384 4192 igfxwk32.exe igfxwk32.exe PID 4192 wrote to memory of 2384 4192 igfxwk32.exe igfxwk32.exe PID 4192 wrote to memory of 2384 4192 igfxwk32.exe igfxwk32.exe PID 2384 wrote to memory of 468 2384 igfxwk32.exe igfxwk32.exe PID 2384 wrote to memory of 468 2384 igfxwk32.exe igfxwk32.exe PID 2384 wrote to memory of 468 2384 igfxwk32.exe igfxwk32.exe PID 2384 wrote to memory of 468 2384 igfxwk32.exe igfxwk32.exe PID 2384 wrote to memory of 468 2384 igfxwk32.exe igfxwk32.exe PID 2384 wrote to memory of 468 2384 igfxwk32.exe igfxwk32.exe PID 2384 wrote to memory of 468 2384 igfxwk32.exe igfxwk32.exe PID 468 wrote to memory of 3180 468 igfxwk32.exe igfxwk32.exe PID 468 wrote to memory of 3180 468 igfxwk32.exe igfxwk32.exe PID 468 wrote to memory of 3180 468 igfxwk32.exe igfxwk32.exe PID 3180 wrote to memory of 1868 3180 igfxwk32.exe igfxwk32.exe PID 3180 wrote to memory of 1868 3180 igfxwk32.exe igfxwk32.exe PID 3180 wrote to memory of 1868 3180 igfxwk32.exe igfxwk32.exe PID 3180 wrote to memory of 1868 3180 igfxwk32.exe igfxwk32.exe PID 3180 wrote to memory of 1868 3180 igfxwk32.exe igfxwk32.exe PID 3180 wrote to memory of 1868 3180 igfxwk32.exe igfxwk32.exe PID 3180 wrote to memory of 1868 3180 igfxwk32.exe igfxwk32.exe PID 1868 wrote to memory of 3216 1868 igfxwk32.exe igfxwk32.exe PID 1868 wrote to memory of 3216 1868 igfxwk32.exe igfxwk32.exe PID 1868 wrote to memory of 3216 1868 igfxwk32.exe igfxwk32.exe PID 3216 wrote to memory of 3492 3216 igfxwk32.exe igfxwk32.exe PID 3216 wrote to memory of 3492 3216 igfxwk32.exe igfxwk32.exe PID 3216 wrote to memory of 3492 3216 igfxwk32.exe igfxwk32.exe PID 3216 wrote to memory of 3492 3216 igfxwk32.exe igfxwk32.exe PID 3216 wrote to memory of 3492 3216 igfxwk32.exe igfxwk32.exe PID 3216 wrote to memory of 3492 3216 igfxwk32.exe igfxwk32.exe PID 3216 wrote to memory of 3492 3216 igfxwk32.exe igfxwk32.exe PID 3492 wrote to memory of 3528 3492 igfxwk32.exe igfxwk32.exe PID 3492 wrote to memory of 3528 3492 igfxwk32.exe igfxwk32.exe PID 3492 wrote to memory of 3528 3492 igfxwk32.exe igfxwk32.exe PID 3528 wrote to memory of 3448 3528 igfxwk32.exe igfxwk32.exe PID 3528 wrote to memory of 3448 3528 igfxwk32.exe igfxwk32.exe PID 3528 wrote to memory of 3448 3528 igfxwk32.exe igfxwk32.exe PID 3528 wrote to memory of 3448 3528 igfxwk32.exe igfxwk32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ff27a4ed5c37e9bbeaf94cc15ed5fbe2_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Users\Admin\AppData\Local\Temp\FF27A4~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Users\Admin\AppData\Local\Temp\FF27A4~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe30⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\igfxwk32.exe"C:\Windows\system32\igfxwk32.exe" C:\Windows\SysWOW64\igfxwk32.exe31⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\igfxwk32.exeFilesize
168KB
MD5ff27a4ed5c37e9bbeaf94cc15ed5fbe2
SHA15678d6b8ecb7661e8e5c1a3a2c4d209c3d7a3c1c
SHA256a42d3b58c510be1f7a3cab1c72ec2482f462a71cb402ed4e1d2ab1ee5e448cf2
SHA512a2d85ae8667f267757fab1a0d2e51151a35fcf2f1308df6c5661846fa933e4d82238fa86403441e1b6857111b177e3f87354875a45a2d28a91a7f59c978d407b
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/468-65-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/468-63-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/516-111-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/516-109-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1428-131-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1428-127-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1868-72-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1868-75-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2244-146-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2244-148-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2244-152-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2380-158-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2380-162-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2808-120-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2808-117-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2864-137-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2864-141-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/3448-92-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/3448-90-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/3492-82-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/3492-84-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/3832-3-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/3832-0-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/3832-38-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/3832-4-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/3832-2-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/4192-55-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/4192-54-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/4364-167-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/4364-172-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/4588-99-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/4588-102-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/4848-47-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/4848-45-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB