Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16/09/2024, 09:14
Static task
static1
Behavioral task
behavioral1
Sample
e4738a81bd3c361d9f72ec9f98bbd8b3_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e4738a81bd3c361d9f72ec9f98bbd8b3_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e4738a81bd3c361d9f72ec9f98bbd8b3_JaffaCakes118.exe
-
Size
304KB
-
MD5
e4738a81bd3c361d9f72ec9f98bbd8b3
-
SHA1
3a2250054c65b4958e20e4044b498d68f6a2144f
-
SHA256
2f9dde3e9d1f26b914480e0b9423d9816212a2c86117697facd8ebe5de77f196
-
SHA512
8ff9aa4c268bb074e521cd9befc394f4315a304a67b73b372e6a5a7c880391a0e787f52172868be1a4e76ee58964cc22318594629a3918dcb0e4cd0fdee5def7
-
SSDEEP
6144:/WGWrq5ny0gcnghN8FOkiHKngXbwqRTiL9:pWe5y0ZRhis
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Deletes itself 1 IoCs
pid Process 2392 igfxpcv32.exe -
Executes dropped EXE 46 IoCs
pid Process 2392 igfxpcv32.exe 2908 igfxpcv32.exe 2744 igfxpcv32.exe 768 igfxpcv32.exe 2660 igfxpcv32.exe 2168 igfxpcv32.exe 2820 igfxpcv32.exe 2436 igfxpcv32.exe 2856 igfxpcv32.exe 376 igfxpcv32.exe 2864 igfxpcv32.exe 2280 igfxpcv32.exe 1132 igfxpcv32.exe 1508 igfxpcv32.exe 496 igfxpcv32.exe 1780 igfxpcv32.exe 2452 igfxpcv32.exe 1860 igfxpcv32.exe 1368 igfxpcv32.exe 1344 igfxpcv32.exe 2556 igfxpcv32.exe 2592 igfxpcv32.exe 1796 igfxpcv32.exe 2892 igfxpcv32.exe 2764 igfxpcv32.exe 2788 igfxpcv32.exe 2648 igfxpcv32.exe 1500 igfxpcv32.exe 2344 igfxpcv32.exe 2632 igfxpcv32.exe 1656 igfxpcv32.exe 2848 igfxpcv32.exe 844 igfxpcv32.exe 2796 igfxpcv32.exe 2984 igfxpcv32.exe 2716 igfxpcv32.exe 944 igfxpcv32.exe 660 igfxpcv32.exe 1864 igfxpcv32.exe 1732 igfxpcv32.exe 628 igfxpcv32.exe 2484 igfxpcv32.exe 1444 igfxpcv32.exe 1476 igfxpcv32.exe 268 igfxpcv32.exe 2572 igfxpcv32.exe -
Loads dropped DLL 64 IoCs
pid Process 2364 e4738a81bd3c361d9f72ec9f98bbd8b3_JaffaCakes118.exe 2364 e4738a81bd3c361d9f72ec9f98bbd8b3_JaffaCakes118.exe 2392 igfxpcv32.exe 2392 igfxpcv32.exe 2908 igfxpcv32.exe 2908 igfxpcv32.exe 2744 igfxpcv32.exe 2744 igfxpcv32.exe 768 igfxpcv32.exe 768 igfxpcv32.exe 2660 igfxpcv32.exe 2660 igfxpcv32.exe 2168 igfxpcv32.exe 2168 igfxpcv32.exe 2820 igfxpcv32.exe 2820 igfxpcv32.exe 2436 igfxpcv32.exe 2436 igfxpcv32.exe 2856 igfxpcv32.exe 2856 igfxpcv32.exe 376 igfxpcv32.exe 376 igfxpcv32.exe 2864 igfxpcv32.exe 2864 igfxpcv32.exe 2280 igfxpcv32.exe 2280 igfxpcv32.exe 1132 igfxpcv32.exe 1132 igfxpcv32.exe 1508 igfxpcv32.exe 1508 igfxpcv32.exe 496 igfxpcv32.exe 496 igfxpcv32.exe 1780 igfxpcv32.exe 1780 igfxpcv32.exe 2452 igfxpcv32.exe 2452 igfxpcv32.exe 1860 igfxpcv32.exe 1860 igfxpcv32.exe 1368 igfxpcv32.exe 1368 igfxpcv32.exe 1344 igfxpcv32.exe 1344 igfxpcv32.exe 2556 igfxpcv32.exe 2556 igfxpcv32.exe 2592 igfxpcv32.exe 2592 igfxpcv32.exe 1796 igfxpcv32.exe 1796 igfxpcv32.exe 2892 igfxpcv32.exe 2892 igfxpcv32.exe 2764 igfxpcv32.exe 2764 igfxpcv32.exe 2788 igfxpcv32.exe 2788 igfxpcv32.exe 2648 igfxpcv32.exe 2648 igfxpcv32.exe 1500 igfxpcv32.exe 1500 igfxpcv32.exe 2344 igfxpcv32.exe 2344 igfxpcv32.exe 2632 igfxpcv32.exe 2632 igfxpcv32.exe 1656 igfxpcv32.exe 1656 igfxpcv32.exe -
resource yara_rule behavioral1/memory/2364-1-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/2364-13-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/2392-15-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/2392-21-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/2908-25-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/2744-29-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/768-33-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/2660-38-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/2168-41-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/2820-47-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/2436-51-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/2856-56-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/376-59-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/2864-65-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/2280-69-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/1132-74-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/1508-78-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/496-82-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/1780-85-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/2452-89-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/1860-90-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/1368-91-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/1344-92-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/2556-93-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/2592-94-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/1796-95-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/2892-96-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/2764-97-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/2788-98-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/2648-99-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/1500-100-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/2344-101-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/2632-102-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/1656-103-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/2848-104-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/844-105-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/2796-106-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/2984-107-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/2716-108-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/944-109-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/660-110-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/1864-111-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/1732-112-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/628-113-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/2484-114-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/1444-115-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/1476-116-0x0000000000400000-0x0000000000487000-memory.dmp upx behavioral1/memory/268-117-0x0000000000400000-0x0000000000487000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 e4738a81bd3c361d9f72ec9f98bbd8b3_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpcv32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\ igfxpcv32.exe File created C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File created C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File created C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File created C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\ igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\igfxpcv32.exe e4738a81bd3c361d9f72ec9f98bbd8b3_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\ igfxpcv32.exe File created C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File created C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\ igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\ igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\ igfxpcv32.exe File created C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File created C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\ igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\ igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\ igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\ igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\ igfxpcv32.exe File created C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\ igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\ igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\ igfxpcv32.exe File created C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File created C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\ igfxpcv32.exe File created C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\ igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\ igfxpcv32.exe File created C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File created C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\ igfxpcv32.exe File created C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\ e4738a81bd3c361d9f72ec9f98bbd8b3_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\ igfxpcv32.exe File created C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File created C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File created C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\ igfxpcv32.exe File opened for modification C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe File created C:\Windows\SysWOW64\igfxpcv32.exe igfxpcv32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 47 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e4738a81bd3c361d9f72ec9f98bbd8b3_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpcv32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2364 e4738a81bd3c361d9f72ec9f98bbd8b3_JaffaCakes118.exe 2364 e4738a81bd3c361d9f72ec9f98bbd8b3_JaffaCakes118.exe 2392 igfxpcv32.exe 2392 igfxpcv32.exe 2908 igfxpcv32.exe 2908 igfxpcv32.exe 2744 igfxpcv32.exe 2744 igfxpcv32.exe 768 igfxpcv32.exe 768 igfxpcv32.exe 2660 igfxpcv32.exe 2660 igfxpcv32.exe 2168 igfxpcv32.exe 2168 igfxpcv32.exe 2820 igfxpcv32.exe 2820 igfxpcv32.exe 2436 igfxpcv32.exe 2436 igfxpcv32.exe 2856 igfxpcv32.exe 2856 igfxpcv32.exe 376 igfxpcv32.exe 376 igfxpcv32.exe 2864 igfxpcv32.exe 2864 igfxpcv32.exe 2280 igfxpcv32.exe 2280 igfxpcv32.exe 1132 igfxpcv32.exe 1132 igfxpcv32.exe 1508 igfxpcv32.exe 1508 igfxpcv32.exe 496 igfxpcv32.exe 496 igfxpcv32.exe 1780 igfxpcv32.exe 1780 igfxpcv32.exe 2452 igfxpcv32.exe 2452 igfxpcv32.exe 1860 igfxpcv32.exe 1860 igfxpcv32.exe 1368 igfxpcv32.exe 1368 igfxpcv32.exe 1344 igfxpcv32.exe 1344 igfxpcv32.exe 2556 igfxpcv32.exe 2556 igfxpcv32.exe 2592 igfxpcv32.exe 2592 igfxpcv32.exe 1796 igfxpcv32.exe 1796 igfxpcv32.exe 2892 igfxpcv32.exe 2892 igfxpcv32.exe 2764 igfxpcv32.exe 2764 igfxpcv32.exe 2788 igfxpcv32.exe 2788 igfxpcv32.exe 2648 igfxpcv32.exe 2648 igfxpcv32.exe 1500 igfxpcv32.exe 1500 igfxpcv32.exe 2344 igfxpcv32.exe 2344 igfxpcv32.exe 2632 igfxpcv32.exe 2632 igfxpcv32.exe 1656 igfxpcv32.exe 1656 igfxpcv32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2392 2364 e4738a81bd3c361d9f72ec9f98bbd8b3_JaffaCakes118.exe 31 PID 2364 wrote to memory of 2392 2364 e4738a81bd3c361d9f72ec9f98bbd8b3_JaffaCakes118.exe 31 PID 2364 wrote to memory of 2392 2364 e4738a81bd3c361d9f72ec9f98bbd8b3_JaffaCakes118.exe 31 PID 2364 wrote to memory of 2392 2364 e4738a81bd3c361d9f72ec9f98bbd8b3_JaffaCakes118.exe 31 PID 2392 wrote to memory of 2908 2392 igfxpcv32.exe 32 PID 2392 wrote to memory of 2908 2392 igfxpcv32.exe 32 PID 2392 wrote to memory of 2908 2392 igfxpcv32.exe 32 PID 2392 wrote to memory of 2908 2392 igfxpcv32.exe 32 PID 2908 wrote to memory of 2744 2908 igfxpcv32.exe 33 PID 2908 wrote to memory of 2744 2908 igfxpcv32.exe 33 PID 2908 wrote to memory of 2744 2908 igfxpcv32.exe 33 PID 2908 wrote to memory of 2744 2908 igfxpcv32.exe 33 PID 2744 wrote to memory of 768 2744 igfxpcv32.exe 34 PID 2744 wrote to memory of 768 2744 igfxpcv32.exe 34 PID 2744 wrote to memory of 768 2744 igfxpcv32.exe 34 PID 2744 wrote to memory of 768 2744 igfxpcv32.exe 34 PID 768 wrote to memory of 2660 768 igfxpcv32.exe 35 PID 768 wrote to memory of 2660 768 igfxpcv32.exe 35 PID 768 wrote to memory of 2660 768 igfxpcv32.exe 35 PID 768 wrote to memory of 2660 768 igfxpcv32.exe 35 PID 2660 wrote to memory of 2168 2660 igfxpcv32.exe 36 PID 2660 wrote to memory of 2168 2660 igfxpcv32.exe 36 PID 2660 wrote to memory of 2168 2660 igfxpcv32.exe 36 PID 2660 wrote to memory of 2168 2660 igfxpcv32.exe 36 PID 2168 wrote to memory of 2820 2168 igfxpcv32.exe 37 PID 2168 wrote to memory of 2820 2168 igfxpcv32.exe 37 PID 2168 wrote to memory of 2820 2168 igfxpcv32.exe 37 PID 2168 wrote to memory of 2820 2168 igfxpcv32.exe 37 PID 2820 wrote to memory of 2436 2820 igfxpcv32.exe 38 PID 2820 wrote to memory of 2436 2820 igfxpcv32.exe 38 PID 2820 wrote to memory of 2436 2820 igfxpcv32.exe 38 PID 2820 wrote to memory of 2436 2820 igfxpcv32.exe 38 PID 2436 wrote to memory of 2856 2436 igfxpcv32.exe 39 PID 2436 wrote to memory of 2856 2436 igfxpcv32.exe 39 PID 2436 wrote to memory of 2856 2436 igfxpcv32.exe 39 PID 2436 wrote to memory of 2856 2436 igfxpcv32.exe 39 PID 2856 wrote to memory of 376 2856 igfxpcv32.exe 40 PID 2856 wrote to memory of 376 2856 igfxpcv32.exe 40 PID 2856 wrote to memory of 376 2856 igfxpcv32.exe 40 PID 2856 wrote to memory of 376 2856 igfxpcv32.exe 40 PID 376 wrote to memory of 2864 376 igfxpcv32.exe 41 PID 376 wrote to memory of 2864 376 igfxpcv32.exe 41 PID 376 wrote to memory of 2864 376 igfxpcv32.exe 41 PID 376 wrote to memory of 2864 376 igfxpcv32.exe 41 PID 2864 wrote to memory of 2280 2864 igfxpcv32.exe 42 PID 2864 wrote to memory of 2280 2864 igfxpcv32.exe 42 PID 2864 wrote to memory of 2280 2864 igfxpcv32.exe 42 PID 2864 wrote to memory of 2280 2864 igfxpcv32.exe 42 PID 2280 wrote to memory of 1132 2280 igfxpcv32.exe 43 PID 2280 wrote to memory of 1132 2280 igfxpcv32.exe 43 PID 2280 wrote to memory of 1132 2280 igfxpcv32.exe 43 PID 2280 wrote to memory of 1132 2280 igfxpcv32.exe 43 PID 1132 wrote to memory of 1508 1132 igfxpcv32.exe 44 PID 1132 wrote to memory of 1508 1132 igfxpcv32.exe 44 PID 1132 wrote to memory of 1508 1132 igfxpcv32.exe 44 PID 1132 wrote to memory of 1508 1132 igfxpcv32.exe 44 PID 1508 wrote to memory of 496 1508 igfxpcv32.exe 45 PID 1508 wrote to memory of 496 1508 igfxpcv32.exe 45 PID 1508 wrote to memory of 496 1508 igfxpcv32.exe 45 PID 1508 wrote to memory of 496 1508 igfxpcv32.exe 45 PID 496 wrote to memory of 1780 496 igfxpcv32.exe 46 PID 496 wrote to memory of 1780 496 igfxpcv32.exe 46 PID 496 wrote to memory of 1780 496 igfxpcv32.exe 46 PID 496 wrote to memory of 1780 496 igfxpcv32.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4738a81bd3c361d9f72ec9f98bbd8b3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e4738a81bd3c361d9f72ec9f98bbd8b3_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Users\Admin\AppData\Local\Temp\E4738A~1.EXE2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE4⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE9⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE11⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE13⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE14⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE15⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:496 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE17⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1780 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2452 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE19⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1860 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1368 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE21⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1344 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2556 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE23⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2592 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE24⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1796 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE25⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2892 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE26⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2764 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE27⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2788 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2648 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE29⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1500 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE30⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2344 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE31⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2632 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE32⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1656 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE33⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2848 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE34⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:844 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE35⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2796 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE36⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2984 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE37⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2716 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE38⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:944 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE39⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:660 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE40⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1864 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE41⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1732 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE42⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:628 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE43⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2484 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE44⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1444 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE45⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:1476 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE46⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:268 -
C:\Windows\SysWOW64\igfxpcv32.exe"C:\Windows\system32\igfxpcv32.exe" C:\Windows\SysWOW64\IGFXPC~1.EXE47⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:2572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
304KB
MD5e4738a81bd3c361d9f72ec9f98bbd8b3
SHA13a2250054c65b4958e20e4044b498d68f6a2144f
SHA2562f9dde3e9d1f26b914480e0b9423d9816212a2c86117697facd8ebe5de77f196
SHA5128ff9aa4c268bb074e521cd9befc394f4315a304a67b73b372e6a5a7c880391a0e787f52172868be1a4e76ee58964cc22318594629a3918dcb0e4cd0fdee5def7