Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
16/09/2024, 06:21
Behavioral task
behavioral1
Sample
e42e8d448cbb1418622c4559a8564716_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
e42e8d448cbb1418622c4559a8564716_JaffaCakes118.exe
-
Size
229KB
-
MD5
e42e8d448cbb1418622c4559a8564716
-
SHA1
d82a09b9593931ba3e8dfffd4dc712622092b4ad
-
SHA256
fa0f3b2977c7ef3d90de0192605a1e629692264ce6fccce8b8ea0c3659e0c8b4
-
SHA512
c376a72e4d8f2d87c4ce1484a41c8885ee59478a3071bf8aa71bd9438f60476355388c2abec655d1d44c8e998f631a667bfe147f25604b3bfee452d869781013
-
SSDEEP
6144:N2OFDTwU1Soezc/25ooQkmlA6h80EGMYNAScL7qOzCp9:wCTwU1XWootmdBMDS8jw
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Deletes itself 1 IoCs
pid Process 1748 igfxbs32.exe -
Executes dropped EXE 43 IoCs
pid Process 1748 igfxbs32.exe 2840 igfxbs32.exe 2872 igfxbs32.exe 2864 igfxbs32.exe 1956 igfxbs32.exe 764 igfxbs32.exe 1636 igfxbs32.exe 1480 igfxbs32.exe 596 igfxbs32.exe 2176 igfxbs32.exe 2368 igfxbs32.exe 2180 igfxbs32.exe 3040 igfxbs32.exe 2328 igfxbs32.exe 2504 igfxbs32.exe 2192 igfxbs32.exe 2404 igfxbs32.exe 376 igfxbs32.exe 2376 igfxbs32.exe 3004 igfxbs32.exe 2148 igfxbs32.exe 2760 igfxbs32.exe 2768 igfxbs32.exe 1796 igfxbs32.exe 2240 igfxbs32.exe 576 igfxbs32.exe 1680 igfxbs32.exe 2972 igfxbs32.exe 2956 igfxbs32.exe 580 igfxbs32.exe 868 igfxbs32.exe 1744 igfxbs32.exe 2560 igfxbs32.exe 2072 igfxbs32.exe 912 igfxbs32.exe 1776 igfxbs32.exe 2588 igfxbs32.exe 1320 igfxbs32.exe 1160 igfxbs32.exe 1316 igfxbs32.exe 692 igfxbs32.exe 1372 igfxbs32.exe 2324 igfxbs32.exe -
Loads dropped DLL 64 IoCs
pid Process 2384 e42e8d448cbb1418622c4559a8564716_JaffaCakes118.exe 2384 e42e8d448cbb1418622c4559a8564716_JaffaCakes118.exe 1748 igfxbs32.exe 1748 igfxbs32.exe 2840 igfxbs32.exe 2840 igfxbs32.exe 2872 igfxbs32.exe 2872 igfxbs32.exe 2864 igfxbs32.exe 2864 igfxbs32.exe 1956 igfxbs32.exe 1956 igfxbs32.exe 764 igfxbs32.exe 764 igfxbs32.exe 1636 igfxbs32.exe 1636 igfxbs32.exe 1480 igfxbs32.exe 1480 igfxbs32.exe 596 igfxbs32.exe 596 igfxbs32.exe 2176 igfxbs32.exe 2176 igfxbs32.exe 2368 igfxbs32.exe 2368 igfxbs32.exe 2180 igfxbs32.exe 2180 igfxbs32.exe 3040 igfxbs32.exe 3040 igfxbs32.exe 2328 igfxbs32.exe 2328 igfxbs32.exe 2504 igfxbs32.exe 2504 igfxbs32.exe 2192 igfxbs32.exe 2192 igfxbs32.exe 2404 igfxbs32.exe 2404 igfxbs32.exe 376 igfxbs32.exe 376 igfxbs32.exe 2376 igfxbs32.exe 2376 igfxbs32.exe 3004 igfxbs32.exe 3004 igfxbs32.exe 2148 igfxbs32.exe 2148 igfxbs32.exe 2760 igfxbs32.exe 2760 igfxbs32.exe 2768 igfxbs32.exe 2768 igfxbs32.exe 1796 igfxbs32.exe 1796 igfxbs32.exe 2240 igfxbs32.exe 2240 igfxbs32.exe 576 igfxbs32.exe 576 igfxbs32.exe 1680 igfxbs32.exe 1680 igfxbs32.exe 2972 igfxbs32.exe 2972 igfxbs32.exe 2956 igfxbs32.exe 2956 igfxbs32.exe 580 igfxbs32.exe 580 igfxbs32.exe 868 igfxbs32.exe 868 igfxbs32.exe -
resource yara_rule behavioral1/memory/2384-0-0x0000000000400000-0x00000000004A7000-memory.dmp upx behavioral1/files/0x000700000001211a-6.dat upx behavioral1/memory/1748-16-0x0000000000400000-0x00000000004A7000-memory.dmp upx behavioral1/memory/764-47-0x0000000000400000-0x00000000004A7000-memory.dmp upx behavioral1/memory/596-63-0x0000000000400000-0x00000000004A7000-memory.dmp upx behavioral1/memory/2192-110-0x0000000000400000-0x00000000004A7000-memory.dmp upx behavioral1/memory/2148-127-0x0000000000400000-0x00000000004A7000-memory.dmp upx behavioral1/memory/2768-130-0x0000000000400000-0x00000000004A7000-memory.dmp upx behavioral1/memory/1796-135-0x0000000000400000-0x00000000004A7000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxbs32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ igfxbs32.exe File created C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\ igfxbs32.exe File created C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\ igfxbs32.exe File opened for modification C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\ igfxbs32.exe File created C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File created C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\ igfxbs32.exe File opened for modification C:\Windows\SysWOW64\ igfxbs32.exe File created C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File created C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File created C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\ igfxbs32.exe File opened for modification C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\ igfxbs32.exe File opened for modification C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File created C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File created C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File created C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\ igfxbs32.exe File opened for modification C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\ igfxbs32.exe File created C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File created C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\ igfxbs32.exe File opened for modification C:\Windows\SysWOW64\ e42e8d448cbb1418622c4559a8564716_JaffaCakes118.exe File created C:\Windows\SysWOW64\igfxbs32.exe e42e8d448cbb1418622c4559a8564716_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\ igfxbs32.exe File created C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File created C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\ igfxbs32.exe File opened for modification C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\ igfxbs32.exe File created C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\ igfxbs32.exe File opened for modification C:\Windows\SysWOW64\ igfxbs32.exe File opened for modification C:\Windows\SysWOW64\ igfxbs32.exe File created C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\igfxbs32.exe e42e8d448cbb1418622c4559a8564716_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ igfxbs32.exe File created C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\ igfxbs32.exe File opened for modification C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\ igfxbs32.exe File opened for modification C:\Windows\SysWOW64\ igfxbs32.exe File opened for modification C:\Windows\SysWOW64\igfxbs32.exe igfxbs32.exe File opened for modification C:\Windows\SysWOW64\ igfxbs32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 44 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e42e8d448cbb1418622c4559a8564716_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxbs32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2384 e42e8d448cbb1418622c4559a8564716_JaffaCakes118.exe 2384 e42e8d448cbb1418622c4559a8564716_JaffaCakes118.exe 1748 igfxbs32.exe 1748 igfxbs32.exe 2840 igfxbs32.exe 2840 igfxbs32.exe 2872 igfxbs32.exe 2872 igfxbs32.exe 2864 igfxbs32.exe 2864 igfxbs32.exe 1956 igfxbs32.exe 1956 igfxbs32.exe 764 igfxbs32.exe 764 igfxbs32.exe 1636 igfxbs32.exe 1636 igfxbs32.exe 1480 igfxbs32.exe 1480 igfxbs32.exe 596 igfxbs32.exe 596 igfxbs32.exe 2176 igfxbs32.exe 2176 igfxbs32.exe 2368 igfxbs32.exe 2368 igfxbs32.exe 2180 igfxbs32.exe 2180 igfxbs32.exe 3040 igfxbs32.exe 3040 igfxbs32.exe 2328 igfxbs32.exe 2328 igfxbs32.exe 2504 igfxbs32.exe 2504 igfxbs32.exe 2192 igfxbs32.exe 2192 igfxbs32.exe 2404 igfxbs32.exe 2404 igfxbs32.exe 376 igfxbs32.exe 376 igfxbs32.exe 2376 igfxbs32.exe 2376 igfxbs32.exe 3004 igfxbs32.exe 3004 igfxbs32.exe 2148 igfxbs32.exe 2148 igfxbs32.exe 2760 igfxbs32.exe 2760 igfxbs32.exe 2768 igfxbs32.exe 2768 igfxbs32.exe 1796 igfxbs32.exe 1796 igfxbs32.exe 2240 igfxbs32.exe 2240 igfxbs32.exe 576 igfxbs32.exe 576 igfxbs32.exe 1680 igfxbs32.exe 1680 igfxbs32.exe 2972 igfxbs32.exe 2972 igfxbs32.exe 2956 igfxbs32.exe 2956 igfxbs32.exe 580 igfxbs32.exe 580 igfxbs32.exe 868 igfxbs32.exe 868 igfxbs32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2384 wrote to memory of 1748 2384 e42e8d448cbb1418622c4559a8564716_JaffaCakes118.exe 30 PID 2384 wrote to memory of 1748 2384 e42e8d448cbb1418622c4559a8564716_JaffaCakes118.exe 30 PID 2384 wrote to memory of 1748 2384 e42e8d448cbb1418622c4559a8564716_JaffaCakes118.exe 30 PID 2384 wrote to memory of 1748 2384 e42e8d448cbb1418622c4559a8564716_JaffaCakes118.exe 30 PID 1748 wrote to memory of 2840 1748 igfxbs32.exe 31 PID 1748 wrote to memory of 2840 1748 igfxbs32.exe 31 PID 1748 wrote to memory of 2840 1748 igfxbs32.exe 31 PID 1748 wrote to memory of 2840 1748 igfxbs32.exe 31 PID 2840 wrote to memory of 2872 2840 igfxbs32.exe 33 PID 2840 wrote to memory of 2872 2840 igfxbs32.exe 33 PID 2840 wrote to memory of 2872 2840 igfxbs32.exe 33 PID 2840 wrote to memory of 2872 2840 igfxbs32.exe 33 PID 2872 wrote to memory of 2864 2872 igfxbs32.exe 34 PID 2872 wrote to memory of 2864 2872 igfxbs32.exe 34 PID 2872 wrote to memory of 2864 2872 igfxbs32.exe 34 PID 2872 wrote to memory of 2864 2872 igfxbs32.exe 34 PID 2864 wrote to memory of 1956 2864 igfxbs32.exe 35 PID 2864 wrote to memory of 1956 2864 igfxbs32.exe 35 PID 2864 wrote to memory of 1956 2864 igfxbs32.exe 35 PID 2864 wrote to memory of 1956 2864 igfxbs32.exe 35 PID 1956 wrote to memory of 764 1956 igfxbs32.exe 36 PID 1956 wrote to memory of 764 1956 igfxbs32.exe 36 PID 1956 wrote to memory of 764 1956 igfxbs32.exe 36 PID 1956 wrote to memory of 764 1956 igfxbs32.exe 36 PID 764 wrote to memory of 1636 764 igfxbs32.exe 37 PID 764 wrote to memory of 1636 764 igfxbs32.exe 37 PID 764 wrote to memory of 1636 764 igfxbs32.exe 37 PID 764 wrote to memory of 1636 764 igfxbs32.exe 37 PID 1636 wrote to memory of 1480 1636 igfxbs32.exe 38 PID 1636 wrote to memory of 1480 1636 igfxbs32.exe 38 PID 1636 wrote to memory of 1480 1636 igfxbs32.exe 38 PID 1636 wrote to memory of 1480 1636 igfxbs32.exe 38 PID 1480 wrote to memory of 596 1480 igfxbs32.exe 39 PID 1480 wrote to memory of 596 1480 igfxbs32.exe 39 PID 1480 wrote to memory of 596 1480 igfxbs32.exe 39 PID 1480 wrote to memory of 596 1480 igfxbs32.exe 39 PID 596 wrote to memory of 2176 596 igfxbs32.exe 40 PID 596 wrote to memory of 2176 596 igfxbs32.exe 40 PID 596 wrote to memory of 2176 596 igfxbs32.exe 40 PID 596 wrote to memory of 2176 596 igfxbs32.exe 40 PID 2176 wrote to memory of 2368 2176 igfxbs32.exe 41 PID 2176 wrote to memory of 2368 2176 igfxbs32.exe 41 PID 2176 wrote to memory of 2368 2176 igfxbs32.exe 41 PID 2176 wrote to memory of 2368 2176 igfxbs32.exe 41 PID 2368 wrote to memory of 2180 2368 igfxbs32.exe 42 PID 2368 wrote to memory of 2180 2368 igfxbs32.exe 42 PID 2368 wrote to memory of 2180 2368 igfxbs32.exe 42 PID 2368 wrote to memory of 2180 2368 igfxbs32.exe 42 PID 2180 wrote to memory of 3040 2180 igfxbs32.exe 43 PID 2180 wrote to memory of 3040 2180 igfxbs32.exe 43 PID 2180 wrote to memory of 3040 2180 igfxbs32.exe 43 PID 2180 wrote to memory of 3040 2180 igfxbs32.exe 43 PID 3040 wrote to memory of 2328 3040 igfxbs32.exe 44 PID 3040 wrote to memory of 2328 3040 igfxbs32.exe 44 PID 3040 wrote to memory of 2328 3040 igfxbs32.exe 44 PID 3040 wrote to memory of 2328 3040 igfxbs32.exe 44 PID 2328 wrote to memory of 2504 2328 igfxbs32.exe 45 PID 2328 wrote to memory of 2504 2328 igfxbs32.exe 45 PID 2328 wrote to memory of 2504 2328 igfxbs32.exe 45 PID 2328 wrote to memory of 2504 2328 igfxbs32.exe 45 PID 2504 wrote to memory of 2192 2504 igfxbs32.exe 46 PID 2504 wrote to memory of 2192 2504 igfxbs32.exe 46 PID 2504 wrote to memory of 2192 2504 igfxbs32.exe 46 PID 2504 wrote to memory of 2192 2504 igfxbs32.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\e42e8d448cbb1418622c4559a8564716_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e42e8d448cbb1418622c4559a8564716_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Users\Admin\AppData\Local\Temp\E42E8D~1.EXE2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2192 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2404 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:376 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2376 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3004 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2148 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2760 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2768 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1796 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2240 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:576 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1680 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2972 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2956 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:580 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:868 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe33⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1744 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe34⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2560 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe35⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2072 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe36⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:912 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe37⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1776 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe38⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2588 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe39⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1320 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe40⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1160 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe41⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1316 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe42⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:692 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe43⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1372 -
C:\Windows\SysWOW64\igfxbs32.exe"C:\Windows\system32\igfxbs32.exe" C:\Windows\SysWOW64\igfxbs32.exe44⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2324
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
229KB
MD5e42e8d448cbb1418622c4559a8564716
SHA1d82a09b9593931ba3e8dfffd4dc712622092b4ad
SHA256fa0f3b2977c7ef3d90de0192605a1e629692264ce6fccce8b8ea0c3659e0c8b4
SHA512c376a72e4d8f2d87c4ce1484a41c8885ee59478a3071bf8aa71bd9438f60476355388c2abec655d1d44c8e998f631a667bfe147f25604b3bfee452d869781013