Analysis
-
max time kernel
149s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05-07-2024 15:35
Static task
static1
Behavioral task
behavioral1
Sample
27017a553fdedfb67e2955cc6990c645_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
27017a553fdedfb67e2955cc6990c645_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
27017a553fdedfb67e2955cc6990c645_JaffaCakes118.exe
-
Size
220KB
-
MD5
27017a553fdedfb67e2955cc6990c645
-
SHA1
5468af808f5436ed3530d56b6b838dadbc53ff0d
-
SHA256
ef37c53930298403b1ca65c4fbadbfbdd530543b020adef40e58bd4ef02b6737
-
SHA512
c839aceb38236dfb573f51c631c39442af3e8fff563457028c8aecb29f197d558e616fa98be1b619e9336e97ea0900c404d94df9e47e96f67c12a22ba2c350ef
-
SSDEEP
3072:lcCUEATLiAFD7iObfcAtmmrMWsJAr2VZB6/iE5ZKUYVBWbNPJY1o22NsEjLLYNdS:+REA/F3OAaVZB66E5Zjy8NwIsSwS
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Checks computer location settings 2 TTPs 32 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation 27017a553fdedfb67e2955cc6990c645_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe Key value queried \REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation igfxsk32.exe -
Deletes itself 1 IoCs
pid Process 1144 igfxsk32.exe -
Executes dropped EXE 64 IoCs
pid Process 3160 igfxsk32.exe 1144 igfxsk32.exe 4992 igfxsk32.exe 4916 igfxsk32.exe 4564 igfxsk32.exe 1396 igfxsk32.exe 4644 igfxsk32.exe 4568 igfxsk32.exe 4640 igfxsk32.exe 4908 igfxsk32.exe 4928 igfxsk32.exe 5044 igfxsk32.exe 2676 igfxsk32.exe 704 igfxsk32.exe 1164 igfxsk32.exe 2712 igfxsk32.exe 208 igfxsk32.exe 216 igfxsk32.exe 2084 igfxsk32.exe 1132 igfxsk32.exe 4968 igfxsk32.exe 4804 igfxsk32.exe 1400 igfxsk32.exe 3928 igfxsk32.exe 752 igfxsk32.exe 4644 igfxsk32.exe 1572 igfxsk32.exe 2572 igfxsk32.exe 5112 igfxsk32.exe 1576 igfxsk32.exe 1340 igfxsk32.exe 2928 igfxsk32.exe 2872 igfxsk32.exe 4508 igfxsk32.exe 2528 igfxsk32.exe 4080 igfxsk32.exe 2020 igfxsk32.exe 3836 igfxsk32.exe 1604 igfxsk32.exe 532 igfxsk32.exe 1732 igfxsk32.exe 948 igfxsk32.exe 1244 igfxsk32.exe 4968 igfxsk32.exe 3992 igfxsk32.exe 4024 igfxsk32.exe 4564 igfxsk32.exe 684 igfxsk32.exe 3004 igfxsk32.exe 3632 igfxsk32.exe 3472 igfxsk32.exe 4540 igfxsk32.exe 3916 igfxsk32.exe 4088 igfxsk32.exe 3236 igfxsk32.exe 1340 igfxsk32.exe 3636 igfxsk32.exe 4772 igfxsk32.exe 3100 igfxsk32.exe 1412 igfxsk32.exe 1288 igfxsk32.exe 2640 igfxsk32.exe 3420 igfxsk32.exe 1904 igfxsk32.exe -
resource yara_rule behavioral2/memory/1692-0-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1692-2-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1692-3-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1692-4-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1692-67-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1144-74-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1144-73-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1144-72-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1144-71-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1144-76-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4916-86-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1396-91-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4568-100-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4908-106-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4908-107-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/5044-114-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/704-121-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/704-123-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2712-129-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2712-131-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/216-137-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/216-139-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1132-146-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4804-153-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3928-160-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3928-164-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4644-169-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4644-173-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2572-181-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1576-190-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2928-194-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2928-199-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4508-207-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4080-212-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4080-217-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3836-225-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/532-234-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/948-242-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4968-250-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4024-259-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/684-263-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/684-266-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3632-272-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4540-276-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4540-279-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4088-285-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1340-291-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4772-297-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1412-301-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1412-304-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/2640-310-0x0000000000400000-0x0000000000466000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 27017a553fdedfb67e2955cc6990c645_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 27017a553fdedfb67e2955cc6990c645_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsk32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File opened for modification C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File opened for modification C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File opened for modification C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxsk32.exe File opened for modification C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxsk32.exe File created C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File opened for modification C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File created C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File created C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File opened for modification C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File created C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File opened for modification C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxsk32.exe File created C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File created C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxsk32.exe File created C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File opened for modification C:\Windows\SysWOW64\igfxsk32.exe 27017a553fdedfb67e2955cc6990c645_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ igfxsk32.exe File opened for modification C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxsk32.exe File created C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File opened for modification C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxsk32.exe File created C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File opened for modification C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File opened for modification C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File created C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxsk32.exe File opened for modification C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File created C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxsk32.exe File created C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxsk32.exe File created C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File created C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File created C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File opened for modification C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File created C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxsk32.exe File opened for modification C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File opened for modification C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File opened for modification C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File opened for modification C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File created C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File created C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File created C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxsk32.exe File opened for modification C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxsk32.exe File created C:\Windows\SysWOW64\igfxsk32.exe igfxsk32.exe -
Suspicious use of SetThreadContext 33 IoCs
description pid Process procid_target PID 3096 set thread context of 1692 3096 27017a553fdedfb67e2955cc6990c645_JaffaCakes118.exe 92 PID 3160 set thread context of 1144 3160 igfxsk32.exe 94 PID 4992 set thread context of 4916 4992 igfxsk32.exe 97 PID 4564 set thread context of 1396 4564 igfxsk32.exe 99 PID 4644 set thread context of 4568 4644 igfxsk32.exe 101 PID 4640 set thread context of 4908 4640 igfxsk32.exe 103 PID 4928 set thread context of 5044 4928 igfxsk32.exe 107 PID 2676 set thread context of 704 2676 igfxsk32.exe 110 PID 1164 set thread context of 2712 1164 igfxsk32.exe 112 PID 208 set thread context of 216 208 igfxsk32.exe 114 PID 2084 set thread context of 1132 2084 igfxsk32.exe 116 PID 4968 set thread context of 4804 4968 igfxsk32.exe 118 PID 1400 set thread context of 3928 1400 igfxsk32.exe 120 PID 752 set thread context of 4644 752 igfxsk32.exe 122 PID 1572 set thread context of 2572 1572 igfxsk32.exe 124 PID 5112 set thread context of 1576 5112 igfxsk32.exe 126 PID 1340 set thread context of 2928 1340 igfxsk32.exe 128 PID 2872 set thread context of 4508 2872 igfxsk32.exe 130 PID 2528 set thread context of 4080 2528 igfxsk32.exe 132 PID 2020 set thread context of 3836 2020 igfxsk32.exe 134 PID 1604 set thread context of 532 1604 igfxsk32.exe 136 PID 1732 set thread context of 948 1732 igfxsk32.exe 138 PID 1244 set thread context of 4968 1244 igfxsk32.exe 140 PID 3992 set thread context of 4024 3992 igfxsk32.exe 142 PID 4564 set thread context of 684 4564 igfxsk32.exe 144 PID 3004 set thread context of 3632 3004 igfxsk32.exe 146 PID 3472 set thread context of 4540 3472 igfxsk32.exe 148 PID 3916 set thread context of 4088 3916 igfxsk32.exe 150 PID 3236 set thread context of 1340 3236 igfxsk32.exe 152 PID 3636 set thread context of 4772 3636 igfxsk32.exe 154 PID 3100 set thread context of 1412 3100 igfxsk32.exe 156 PID 1288 set thread context of 2640 1288 igfxsk32.exe 158 PID 3420 set thread context of 1904 3420 igfxsk32.exe 160 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 32 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 27017a553fdedfb67e2955cc6990c645_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxsk32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1692 27017a553fdedfb67e2955cc6990c645_JaffaCakes118.exe 1692 27017a553fdedfb67e2955cc6990c645_JaffaCakes118.exe 1692 27017a553fdedfb67e2955cc6990c645_JaffaCakes118.exe 1692 27017a553fdedfb67e2955cc6990c645_JaffaCakes118.exe 1144 igfxsk32.exe 1144 igfxsk32.exe 1144 igfxsk32.exe 1144 igfxsk32.exe 4916 igfxsk32.exe 4916 igfxsk32.exe 4916 igfxsk32.exe 4916 igfxsk32.exe 1396 igfxsk32.exe 1396 igfxsk32.exe 1396 igfxsk32.exe 1396 igfxsk32.exe 4568 igfxsk32.exe 4568 igfxsk32.exe 4568 igfxsk32.exe 4568 igfxsk32.exe 4908 igfxsk32.exe 4908 igfxsk32.exe 4908 igfxsk32.exe 4908 igfxsk32.exe 5044 igfxsk32.exe 5044 igfxsk32.exe 5044 igfxsk32.exe 5044 igfxsk32.exe 704 igfxsk32.exe 704 igfxsk32.exe 704 igfxsk32.exe 704 igfxsk32.exe 2712 igfxsk32.exe 2712 igfxsk32.exe 2712 igfxsk32.exe 2712 igfxsk32.exe 216 igfxsk32.exe 216 igfxsk32.exe 216 igfxsk32.exe 216 igfxsk32.exe 1132 igfxsk32.exe 1132 igfxsk32.exe 1132 igfxsk32.exe 1132 igfxsk32.exe 4804 igfxsk32.exe 4804 igfxsk32.exe 4804 igfxsk32.exe 4804 igfxsk32.exe 3928 igfxsk32.exe 3928 igfxsk32.exe 3928 igfxsk32.exe 3928 igfxsk32.exe 4644 igfxsk32.exe 4644 igfxsk32.exe 4644 igfxsk32.exe 4644 igfxsk32.exe 2572 igfxsk32.exe 2572 igfxsk32.exe 2572 igfxsk32.exe 2572 igfxsk32.exe 1576 igfxsk32.exe 1576 igfxsk32.exe 1576 igfxsk32.exe 1576 igfxsk32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3096 wrote to memory of 1692 3096 27017a553fdedfb67e2955cc6990c645_JaffaCakes118.exe 92 PID 3096 wrote to memory of 1692 3096 27017a553fdedfb67e2955cc6990c645_JaffaCakes118.exe 92 PID 3096 wrote to memory of 1692 3096 27017a553fdedfb67e2955cc6990c645_JaffaCakes118.exe 92 PID 3096 wrote to memory of 1692 3096 27017a553fdedfb67e2955cc6990c645_JaffaCakes118.exe 92 PID 3096 wrote to memory of 1692 3096 27017a553fdedfb67e2955cc6990c645_JaffaCakes118.exe 92 PID 3096 wrote to memory of 1692 3096 27017a553fdedfb67e2955cc6990c645_JaffaCakes118.exe 92 PID 3096 wrote to memory of 1692 3096 27017a553fdedfb67e2955cc6990c645_JaffaCakes118.exe 92 PID 1692 wrote to memory of 3160 1692 27017a553fdedfb67e2955cc6990c645_JaffaCakes118.exe 93 PID 1692 wrote to memory of 3160 1692 27017a553fdedfb67e2955cc6990c645_JaffaCakes118.exe 93 PID 1692 wrote to memory of 3160 1692 27017a553fdedfb67e2955cc6990c645_JaffaCakes118.exe 93 PID 3160 wrote to memory of 1144 3160 igfxsk32.exe 94 PID 3160 wrote to memory of 1144 3160 igfxsk32.exe 94 PID 3160 wrote to memory of 1144 3160 igfxsk32.exe 94 PID 3160 wrote to memory of 1144 3160 igfxsk32.exe 94 PID 3160 wrote to memory of 1144 3160 igfxsk32.exe 94 PID 3160 wrote to memory of 1144 3160 igfxsk32.exe 94 PID 3160 wrote to memory of 1144 3160 igfxsk32.exe 94 PID 1144 wrote to memory of 4992 1144 igfxsk32.exe 95 PID 1144 wrote to memory of 4992 1144 igfxsk32.exe 95 PID 1144 wrote to memory of 4992 1144 igfxsk32.exe 95 PID 4992 wrote to memory of 4916 4992 igfxsk32.exe 97 PID 4992 wrote to memory of 4916 4992 igfxsk32.exe 97 PID 4992 wrote to memory of 4916 4992 igfxsk32.exe 97 PID 4992 wrote to memory of 4916 4992 igfxsk32.exe 97 PID 4992 wrote to memory of 4916 4992 igfxsk32.exe 97 PID 4992 wrote to memory of 4916 4992 igfxsk32.exe 97 PID 4992 wrote to memory of 4916 4992 igfxsk32.exe 97 PID 4916 wrote to memory of 4564 4916 igfxsk32.exe 98 PID 4916 wrote to memory of 4564 4916 igfxsk32.exe 98 PID 4916 wrote to memory of 4564 4916 igfxsk32.exe 98 PID 4564 wrote to memory of 1396 4564 igfxsk32.exe 99 PID 4564 wrote to memory of 1396 4564 igfxsk32.exe 99 PID 4564 wrote to memory of 1396 4564 igfxsk32.exe 99 PID 4564 wrote to memory of 1396 4564 igfxsk32.exe 99 PID 4564 wrote to memory of 1396 4564 igfxsk32.exe 99 PID 4564 wrote to memory of 1396 4564 igfxsk32.exe 99 PID 4564 wrote to memory of 1396 4564 igfxsk32.exe 99 PID 1396 wrote to memory of 4644 1396 igfxsk32.exe 100 PID 1396 wrote to memory of 4644 1396 igfxsk32.exe 100 PID 1396 wrote to memory of 4644 1396 igfxsk32.exe 100 PID 4644 wrote to memory of 4568 4644 igfxsk32.exe 101 PID 4644 wrote to memory of 4568 4644 igfxsk32.exe 101 PID 4644 wrote to memory of 4568 4644 igfxsk32.exe 101 PID 4644 wrote to memory of 4568 4644 igfxsk32.exe 101 PID 4644 wrote to memory of 4568 4644 igfxsk32.exe 101 PID 4644 wrote to memory of 4568 4644 igfxsk32.exe 101 PID 4644 wrote to memory of 4568 4644 igfxsk32.exe 101 PID 4568 wrote to memory of 4640 4568 igfxsk32.exe 102 PID 4568 wrote to memory of 4640 4568 igfxsk32.exe 102 PID 4568 wrote to memory of 4640 4568 igfxsk32.exe 102 PID 4640 wrote to memory of 4908 4640 igfxsk32.exe 103 PID 4640 wrote to memory of 4908 4640 igfxsk32.exe 103 PID 4640 wrote to memory of 4908 4640 igfxsk32.exe 103 PID 4640 wrote to memory of 4908 4640 igfxsk32.exe 103 PID 4640 wrote to memory of 4908 4640 igfxsk32.exe 103 PID 4640 wrote to memory of 4908 4640 igfxsk32.exe 103 PID 4640 wrote to memory of 4908 4640 igfxsk32.exe 103 PID 4908 wrote to memory of 4928 4908 igfxsk32.exe 104 PID 4908 wrote to memory of 4928 4908 igfxsk32.exe 104 PID 4908 wrote to memory of 4928 4908 igfxsk32.exe 104 PID 4928 wrote to memory of 5044 4928 igfxsk32.exe 107 PID 4928 wrote to memory of 5044 4928 igfxsk32.exe 107 PID 4928 wrote to memory of 5044 4928 igfxsk32.exe 107 PID 4928 wrote to memory of 5044 4928 igfxsk32.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\27017a553fdedfb67e2955cc6990c645_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\27017a553fdedfb67e2955cc6990c645_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\27017a553fdedfb67e2955cc6990c645_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\27017a553fdedfb67e2955cc6990c645_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Users\Admin\AppData\Local\Temp\27017A~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Users\Admin\AppData\Local\Temp\27017A~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5044 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2676 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:704 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1164 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2712 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:208 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:216 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2084 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1132 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4968 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4804 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1400 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3928 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:752 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4644 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1572 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe30⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2572 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5112 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe32⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1576 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1340 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe34⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
PID:2928 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2872 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe36⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
PID:4508 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2528 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe38⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
PID:4080 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2020 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe40⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
PID:3836 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1604 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe42⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
PID:532 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1732 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe44⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
PID:948 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1244 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe46⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
PID:4968 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3992 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe48⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
PID:4024 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4564 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe50⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
PID:684 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3004 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe52⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Modifies registry class
PID:3632 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3472 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe54⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
PID:4540 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3916 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe56⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
PID:4088 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3236 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe58⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
PID:1340 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3636 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe60⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
PID:4772 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3100 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe62⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
PID:1412 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe63⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1288 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe64⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
PID:2640 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe65⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3420 -
C:\Windows\SysWOW64\igfxsk32.exe"C:\Windows\system32\igfxsk32.exe" C:\Windows\SysWOW64\igfxsk32.exe66⤵
- Executes dropped EXE
- Maps connected drives based on registry
PID:1904
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4348,i,3027467512973953085,11878940668304988630,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:81⤵PID:1604
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
220KB
MD527017a553fdedfb67e2955cc6990c645
SHA15468af808f5436ed3530d56b6b838dadbc53ff0d
SHA256ef37c53930298403b1ca65c4fbadbfbdd530543b020adef40e58bd4ef02b6737
SHA512c839aceb38236dfb573f51c631c39442af3e8fff563457028c8aecb29f197d558e616fa98be1b619e9336e97ea0900c404d94df9e47e96f67c12a22ba2c350ef