Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 16:23
Static task
static1
Behavioral task
behavioral1
Sample
e09155cc0e772fe041bb674d031b6a73_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e09155cc0e772fe041bb674d031b6a73_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e09155cc0e772fe041bb674d031b6a73_JaffaCakes118.exe
-
Size
280KB
-
MD5
e09155cc0e772fe041bb674d031b6a73
-
SHA1
ad5fcdc004d2e0cdf1008fb6226cec4e7c8ad16e
-
SHA256
a1dd383e02eae90830a58562b26886ac2c61a6694ff7ef6f5b1edf0b46067892
-
SHA512
5fbb4715d15a118afe8f08bd35720a44caa7e7a57c30abafa7e8c2a00a616b54b340d768a5ab5ceff0eb11eecc50002442769d5dc6db66f8fec2425ee7b9ee08
-
SSDEEP
3072:68OBtebeDXSjdLikfVb1oPGtyNjQK+M76WDzpSd0zMkqRk5V11LVZnVF85LPhNik:j8RXSjA2K+KDzpdzF5X35VypD
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Deletes itself 1 IoCs
pid Process 2876 igfxwp32.exe -
Executes dropped EXE 64 IoCs
pid Process 2812 igfxwp32.exe 2876 igfxwp32.exe 3032 igfxwp32.exe 2676 igfxwp32.exe 2828 igfxwp32.exe 2972 igfxwp32.exe 2996 igfxwp32.exe 284 igfxwp32.exe 836 igfxwp32.exe 1936 igfxwp32.exe 2108 igfxwp32.exe 352 igfxwp32.exe 2612 igfxwp32.exe 604 igfxwp32.exe 1980 igfxwp32.exe 1480 igfxwp32.exe 2604 igfxwp32.exe 1676 igfxwp32.exe 1888 igfxwp32.exe 2012 igfxwp32.exe 2256 igfxwp32.exe 336 igfxwp32.exe 1504 igfxwp32.exe 2776 igfxwp32.exe 2888 igfxwp32.exe 2180 igfxwp32.exe 2748 igfxwp32.exe 828 igfxwp32.exe 1976 igfxwp32.exe 1508 igfxwp32.exe 3020 igfxwp32.exe 2900 igfxwp32.exe 1020 igfxwp32.exe 1996 igfxwp32.exe 2336 igfxwp32.exe 1736 igfxwp32.exe 2480 igfxwp32.exe 444 igfxwp32.exe 1856 igfxwp32.exe 1824 igfxwp32.exe 1588 igfxwp32.exe 2380 igfxwp32.exe 768 igfxwp32.exe 880 igfxwp32.exe 1632 igfxwp32.exe 2708 igfxwp32.exe 1868 igfxwp32.exe 2288 igfxwp32.exe 2744 igfxwp32.exe 2752 igfxwp32.exe 2848 igfxwp32.exe 380 igfxwp32.exe 2696 igfxwp32.exe 308 igfxwp32.exe 2936 igfxwp32.exe 3040 igfxwp32.exe 2396 igfxwp32.exe 1880 igfxwp32.exe 988 igfxwp32.exe 3068 igfxwp32.exe 2128 igfxwp32.exe 2736 igfxwp32.exe 1232 igfxwp32.exe 1068 igfxwp32.exe -
Loads dropped DLL 64 IoCs
pid Process 2228 e09155cc0e772fe041bb674d031b6a73_JaffaCakes118.exe 2228 e09155cc0e772fe041bb674d031b6a73_JaffaCakes118.exe 2812 igfxwp32.exe 2812 igfxwp32.exe 2876 igfxwp32.exe 2876 igfxwp32.exe 3032 igfxwp32.exe 3032 igfxwp32.exe 2676 igfxwp32.exe 2676 igfxwp32.exe 2828 igfxwp32.exe 2828 igfxwp32.exe 2972 igfxwp32.exe 2972 igfxwp32.exe 2996 igfxwp32.exe 2996 igfxwp32.exe 284 igfxwp32.exe 284 igfxwp32.exe 836 igfxwp32.exe 836 igfxwp32.exe 1936 igfxwp32.exe 1936 igfxwp32.exe 2108 igfxwp32.exe 2108 igfxwp32.exe 352 igfxwp32.exe 352 igfxwp32.exe 2612 igfxwp32.exe 2612 igfxwp32.exe 604 igfxwp32.exe 604 igfxwp32.exe 1980 igfxwp32.exe 1980 igfxwp32.exe 1480 igfxwp32.exe 1480 igfxwp32.exe 2604 igfxwp32.exe 2604 igfxwp32.exe 1676 igfxwp32.exe 1676 igfxwp32.exe 1888 igfxwp32.exe 1888 igfxwp32.exe 2012 igfxwp32.exe 2012 igfxwp32.exe 2256 igfxwp32.exe 2256 igfxwp32.exe 336 igfxwp32.exe 336 igfxwp32.exe 1504 igfxwp32.exe 1504 igfxwp32.exe 2776 igfxwp32.exe 2776 igfxwp32.exe 2888 igfxwp32.exe 2888 igfxwp32.exe 2180 igfxwp32.exe 2180 igfxwp32.exe 2748 igfxwp32.exe 2748 igfxwp32.exe 828 igfxwp32.exe 828 igfxwp32.exe 1976 igfxwp32.exe 1976 igfxwp32.exe 1508 igfxwp32.exe 1508 igfxwp32.exe 3020 igfxwp32.exe 3020 igfxwp32.exe -
resource yara_rule behavioral1/memory/2228-9-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2228-11-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2228-10-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2228-8-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2228-4-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2228-2-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2228-7-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2228-24-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2876-40-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2876-39-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2876-38-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2876-37-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2876-45-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2676-59-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2676-58-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2676-57-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2676-65-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2972-78-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2972-79-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2972-85-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/284-97-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/284-98-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/284-104-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1936-122-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/352-134-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/352-142-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/604-154-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/604-162-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1480-180-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1676-192-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1676-200-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/336-224-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2776-233-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2776-237-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2012-238-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2180-247-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2180-251-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/828-263-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1508-275-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2900-287-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1996-296-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1996-300-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1736-308-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1736-313-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/444-325-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1824-333-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1824-338-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2380-350-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/880-359-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/880-363-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2708-375-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2288-387-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2752-396-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2752-400-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/380-409-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/380-413-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/308-425-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/3040-437-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1880-449-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/3068-458-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/3068-462-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1068-485-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/468-494-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/468-498-0x0000000000400000-0x0000000000466000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum e09155cc0e772fe041bb674d031b6a73_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 e09155cc0e772fe041bb674d031b6a73_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxwp32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File created C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File opened for modification C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File opened for modification C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File opened for modification C:\Windows\SysWOW64\ igfxwp32.exe File opened for modification C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File created C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File opened for modification C:\Windows\SysWOW64\ igfxwp32.exe File opened for modification C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File created C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File created C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File opened for modification C:\Windows\SysWOW64\ igfxwp32.exe File opened for modification C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File created C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File opened for modification C:\Windows\SysWOW64\ igfxwp32.exe File opened for modification C:\Windows\SysWOW64\ igfxwp32.exe File opened for modification C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File opened for modification C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File opened for modification C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File created C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File opened for modification C:\Windows\SysWOW64\ igfxwp32.exe File created C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File opened for modification C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File opened for modification C:\Windows\SysWOW64\ igfxwp32.exe File created C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File opened for modification C:\Windows\SysWOW64\ igfxwp32.exe File opened for modification C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File opened for modification C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File opened for modification C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File opened for modification C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File opened for modification C:\Windows\SysWOW64\ igfxwp32.exe File opened for modification C:\Windows\SysWOW64\ igfxwp32.exe File opened for modification C:\Windows\SysWOW64\ igfxwp32.exe File created C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File opened for modification C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File opened for modification C:\Windows\SysWOW64\ igfxwp32.exe File opened for modification C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File opened for modification C:\Windows\SysWOW64\ e09155cc0e772fe041bb674d031b6a73_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File created C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File created C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File created C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File opened for modification C:\Windows\SysWOW64\ igfxwp32.exe File opened for modification C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File created C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File opened for modification C:\Windows\SysWOW64\ igfxwp32.exe File opened for modification C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File created C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File created C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File created C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File opened for modification C:\Windows\SysWOW64\ igfxwp32.exe File opened for modification C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File opened for modification C:\Windows\SysWOW64\ igfxwp32.exe File opened for modification C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File opened for modification C:\Windows\SysWOW64\ igfxwp32.exe File created C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File opened for modification C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File opened for modification C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File created C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File created C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File created C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File opened for modification C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File opened for modification C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe File opened for modification C:\Windows\SysWOW64\igfxwp32.exe igfxwp32.exe -
Suspicious use of SetThreadContext 38 IoCs
description pid Process procid_target PID 2404 set thread context of 2228 2404 e09155cc0e772fe041bb674d031b6a73_JaffaCakes118.exe 31 PID 2812 set thread context of 2876 2812 igfxwp32.exe 33 PID 3032 set thread context of 2676 3032 igfxwp32.exe 35 PID 2828 set thread context of 2972 2828 igfxwp32.exe 37 PID 2996 set thread context of 284 2996 igfxwp32.exe 39 PID 836 set thread context of 1936 836 igfxwp32.exe 41 PID 2108 set thread context of 352 2108 igfxwp32.exe 43 PID 2612 set thread context of 604 2612 igfxwp32.exe 45 PID 1980 set thread context of 1480 1980 igfxwp32.exe 47 PID 2604 set thread context of 1676 2604 igfxwp32.exe 49 PID 1888 set thread context of 2012 1888 igfxwp32.exe 51 PID 2256 set thread context of 336 2256 igfxwp32.exe 53 PID 1504 set thread context of 2776 1504 igfxwp32.exe 55 PID 2888 set thread context of 2180 2888 igfxwp32.exe 57 PID 2748 set thread context of 828 2748 igfxwp32.exe 59 PID 1976 set thread context of 1508 1976 igfxwp32.exe 61 PID 3020 set thread context of 2900 3020 igfxwp32.exe 63 PID 1020 set thread context of 1996 1020 igfxwp32.exe 65 PID 2336 set thread context of 1736 2336 igfxwp32.exe 67 PID 2480 set thread context of 444 2480 igfxwp32.exe 69 PID 1856 set thread context of 1824 1856 igfxwp32.exe 71 PID 1588 set thread context of 2380 1588 igfxwp32.exe 73 PID 768 set thread context of 880 768 igfxwp32.exe 75 PID 1632 set thread context of 2708 1632 igfxwp32.exe 77 PID 1868 set thread context of 2288 1868 igfxwp32.exe 79 PID 2744 set thread context of 2752 2744 igfxwp32.exe 81 PID 2848 set thread context of 380 2848 igfxwp32.exe 83 PID 2696 set thread context of 308 2696 igfxwp32.exe 85 PID 2936 set thread context of 3040 2936 igfxwp32.exe 87 PID 2396 set thread context of 1880 2396 igfxwp32.exe 89 PID 988 set thread context of 3068 988 igfxwp32.exe 91 PID 2128 set thread context of 2736 2128 igfxwp32.exe 93 PID 1232 set thread context of 1068 1232 igfxwp32.exe 95 PID 896 set thread context of 468 896 igfxwp32.exe 97 PID 2584 set thread context of 1040 2584 igfxwp32.exe 99 PID 1896 set thread context of 268 1896 igfxwp32.exe 101 PID 1528 set thread context of 2404 1528 igfxwp32.exe 103 PID 2240 set thread context of 1100 2240 igfxwp32.exe 105 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e09155cc0e772fe041bb674d031b6a73_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e09155cc0e772fe041bb674d031b6a73_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwp32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2228 e09155cc0e772fe041bb674d031b6a73_JaffaCakes118.exe 2228 e09155cc0e772fe041bb674d031b6a73_JaffaCakes118.exe 2876 igfxwp32.exe 2876 igfxwp32.exe 2676 igfxwp32.exe 2676 igfxwp32.exe 2972 igfxwp32.exe 2972 igfxwp32.exe 284 igfxwp32.exe 284 igfxwp32.exe 1936 igfxwp32.exe 1936 igfxwp32.exe 352 igfxwp32.exe 352 igfxwp32.exe 604 igfxwp32.exe 604 igfxwp32.exe 1480 igfxwp32.exe 1480 igfxwp32.exe 1676 igfxwp32.exe 1676 igfxwp32.exe 2012 igfxwp32.exe 2012 igfxwp32.exe 336 igfxwp32.exe 336 igfxwp32.exe 2776 igfxwp32.exe 2776 igfxwp32.exe 2180 igfxwp32.exe 2180 igfxwp32.exe 828 igfxwp32.exe 828 igfxwp32.exe 1508 igfxwp32.exe 1508 igfxwp32.exe 2900 igfxwp32.exe 2900 igfxwp32.exe 1996 igfxwp32.exe 1996 igfxwp32.exe 1736 igfxwp32.exe 1736 igfxwp32.exe 444 igfxwp32.exe 444 igfxwp32.exe 1824 igfxwp32.exe 1824 igfxwp32.exe 2380 igfxwp32.exe 2380 igfxwp32.exe 880 igfxwp32.exe 880 igfxwp32.exe 2708 igfxwp32.exe 2708 igfxwp32.exe 2288 igfxwp32.exe 2288 igfxwp32.exe 2752 igfxwp32.exe 2752 igfxwp32.exe 380 igfxwp32.exe 380 igfxwp32.exe 308 igfxwp32.exe 308 igfxwp32.exe 3040 igfxwp32.exe 3040 igfxwp32.exe 1880 igfxwp32.exe 1880 igfxwp32.exe 3068 igfxwp32.exe 3068 igfxwp32.exe 2736 igfxwp32.exe 2736 igfxwp32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2404 wrote to memory of 2228 2404 e09155cc0e772fe041bb674d031b6a73_JaffaCakes118.exe 31 PID 2404 wrote to memory of 2228 2404 e09155cc0e772fe041bb674d031b6a73_JaffaCakes118.exe 31 PID 2404 wrote to memory of 2228 2404 e09155cc0e772fe041bb674d031b6a73_JaffaCakes118.exe 31 PID 2404 wrote to memory of 2228 2404 e09155cc0e772fe041bb674d031b6a73_JaffaCakes118.exe 31 PID 2404 wrote to memory of 2228 2404 e09155cc0e772fe041bb674d031b6a73_JaffaCakes118.exe 31 PID 2404 wrote to memory of 2228 2404 e09155cc0e772fe041bb674d031b6a73_JaffaCakes118.exe 31 PID 2404 wrote to memory of 2228 2404 e09155cc0e772fe041bb674d031b6a73_JaffaCakes118.exe 31 PID 2228 wrote to memory of 2812 2228 e09155cc0e772fe041bb674d031b6a73_JaffaCakes118.exe 32 PID 2228 wrote to memory of 2812 2228 e09155cc0e772fe041bb674d031b6a73_JaffaCakes118.exe 32 PID 2228 wrote to memory of 2812 2228 e09155cc0e772fe041bb674d031b6a73_JaffaCakes118.exe 32 PID 2228 wrote to memory of 2812 2228 e09155cc0e772fe041bb674d031b6a73_JaffaCakes118.exe 32 PID 2812 wrote to memory of 2876 2812 igfxwp32.exe 33 PID 2812 wrote to memory of 2876 2812 igfxwp32.exe 33 PID 2812 wrote to memory of 2876 2812 igfxwp32.exe 33 PID 2812 wrote to memory of 2876 2812 igfxwp32.exe 33 PID 2812 wrote to memory of 2876 2812 igfxwp32.exe 33 PID 2812 wrote to memory of 2876 2812 igfxwp32.exe 33 PID 2812 wrote to memory of 2876 2812 igfxwp32.exe 33 PID 2876 wrote to memory of 3032 2876 igfxwp32.exe 34 PID 2876 wrote to memory of 3032 2876 igfxwp32.exe 34 PID 2876 wrote to memory of 3032 2876 igfxwp32.exe 34 PID 2876 wrote to memory of 3032 2876 igfxwp32.exe 34 PID 3032 wrote to memory of 2676 3032 igfxwp32.exe 35 PID 3032 wrote to memory of 2676 3032 igfxwp32.exe 35 PID 3032 wrote to memory of 2676 3032 igfxwp32.exe 35 PID 3032 wrote to memory of 2676 3032 igfxwp32.exe 35 PID 3032 wrote to memory of 2676 3032 igfxwp32.exe 35 PID 3032 wrote to memory of 2676 3032 igfxwp32.exe 35 PID 3032 wrote to memory of 2676 3032 igfxwp32.exe 35 PID 2676 wrote to memory of 2828 2676 igfxwp32.exe 36 PID 2676 wrote to memory of 2828 2676 igfxwp32.exe 36 PID 2676 wrote to memory of 2828 2676 igfxwp32.exe 36 PID 2676 wrote to memory of 2828 2676 igfxwp32.exe 36 PID 2828 wrote to memory of 2972 2828 igfxwp32.exe 37 PID 2828 wrote to memory of 2972 2828 igfxwp32.exe 37 PID 2828 wrote to memory of 2972 2828 igfxwp32.exe 37 PID 2828 wrote to memory of 2972 2828 igfxwp32.exe 37 PID 2828 wrote to memory of 2972 2828 igfxwp32.exe 37 PID 2828 wrote to memory of 2972 2828 igfxwp32.exe 37 PID 2828 wrote to memory of 2972 2828 igfxwp32.exe 37 PID 2972 wrote to memory of 2996 2972 igfxwp32.exe 38 PID 2972 wrote to memory of 2996 2972 igfxwp32.exe 38 PID 2972 wrote to memory of 2996 2972 igfxwp32.exe 38 PID 2972 wrote to memory of 2996 2972 igfxwp32.exe 38 PID 2996 wrote to memory of 284 2996 igfxwp32.exe 39 PID 2996 wrote to memory of 284 2996 igfxwp32.exe 39 PID 2996 wrote to memory of 284 2996 igfxwp32.exe 39 PID 2996 wrote to memory of 284 2996 igfxwp32.exe 39 PID 2996 wrote to memory of 284 2996 igfxwp32.exe 39 PID 2996 wrote to memory of 284 2996 igfxwp32.exe 39 PID 2996 wrote to memory of 284 2996 igfxwp32.exe 39 PID 284 wrote to memory of 836 284 igfxwp32.exe 40 PID 284 wrote to memory of 836 284 igfxwp32.exe 40 PID 284 wrote to memory of 836 284 igfxwp32.exe 40 PID 284 wrote to memory of 836 284 igfxwp32.exe 40 PID 836 wrote to memory of 1936 836 igfxwp32.exe 41 PID 836 wrote to memory of 1936 836 igfxwp32.exe 41 PID 836 wrote to memory of 1936 836 igfxwp32.exe 41 PID 836 wrote to memory of 1936 836 igfxwp32.exe 41 PID 836 wrote to memory of 1936 836 igfxwp32.exe 41 PID 836 wrote to memory of 1936 836 igfxwp32.exe 41 PID 836 wrote to memory of 1936 836 igfxwp32.exe 41 PID 1936 wrote to memory of 2108 1936 igfxwp32.exe 42 PID 1936 wrote to memory of 2108 1936 igfxwp32.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\e09155cc0e772fe041bb674d031b6a73_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e09155cc0e772fe041bb674d031b6a73_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\e09155cc0e772fe041bb674d031b6a73_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e09155cc0e772fe041bb674d031b6a73_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Users\Admin\AppData\Local\Temp\E09155~1.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Users\Admin\AppData\Local\Temp\E09155~1.EXE4⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:284 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2108 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:352 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2612 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:604 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1980 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1480 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2604 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1676 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1888 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2012 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2256 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:336 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1504 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2776 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2888 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2180 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2748 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:828 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1976 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1508 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe33⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3020 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe34⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2900 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1020 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe36⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1996 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2336 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe38⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1736 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2480 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe40⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:444 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1856 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe42⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1824 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1588 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe44⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2380 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:768 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe46⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:880 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1632 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe48⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2708 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1868 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe50⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2288 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2744 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe52⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2752 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2848 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe54⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:380 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2696 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe56⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:308 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2936 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3040 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2396 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe60⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1880 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:988 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe62⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3068 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe63⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2128 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe64⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2736 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe65⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1232 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe66⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1068 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe67⤵
- Suspicious use of SetThreadContext
PID:896 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe68⤵
- Maps connected drives based on registry
- Drops file in System32 directory
PID:468 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe69⤵
- Suspicious use of SetThreadContext
PID:2584 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe70⤵
- Maps connected drives based on registry
- Drops file in System32 directory
PID:1040 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe71⤵
- Suspicious use of SetThreadContext
PID:1896 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe72⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:268 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe73⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1528 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe74⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2404 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe75⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2240 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe76⤵
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:1100 -
C:\Windows\SysWOW64\igfxwp32.exe"C:\Windows\system32\igfxwp32.exe" C:\Windows\SysWOW64\igfxwp32.exe77⤵PID:2664
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280KB
MD5e09155cc0e772fe041bb674d031b6a73
SHA1ad5fcdc004d2e0cdf1008fb6226cec4e7c8ad16e
SHA256a1dd383e02eae90830a58562b26886ac2c61a6694ff7ef6f5b1edf0b46067892
SHA5125fbb4715d15a118afe8f08bd35720a44caa7e7a57c30abafa7e8c2a00a616b54b340d768a5ab5ceff0eb11eecc50002442769d5dc6db66f8fec2425ee7b9ee08