Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-09-2024 20:29
Behavioral task
behavioral1
Sample
e7a55b3dad8012b94db5662c54538d1f_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
General
-
Target
e7a55b3dad8012b94db5662c54538d1f_JaffaCakes118.exe
-
Size
235KB
-
MD5
e7a55b3dad8012b94db5662c54538d1f
-
SHA1
0fc02df267c0bc76868e7d27e5988d5df824d143
-
SHA256
eab24a0771a5bec6c6214274b731ae3f69aac7c4940e4b1605472a980ad7268b
-
SHA512
f2ba48c4af98cb4160a408344cbd6754ca4326eb6794eeeef5073935d6f2ce7ee1de1d1cc4c33485aacf7ab561c37b8dbe1a651071fe89b0a577fbc8188d467d
-
SSDEEP
3072:6qTepotgn7dNesJUHZfpYfHWkojrNtLZxoa8O+LqTq8A7tSqjU7SB28z2VdKGvH4:PTeWgn7HUHRSve9xNxsrtSI2LKEOca7
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Deletes itself 1 IoCs
pid Process 2468 igfxtsm32.exe -
Executes dropped EXE 31 IoCs
pid Process 2468 igfxtsm32.exe 2664 igfxtsm32.exe 2868 igfxtsm32.exe 2548 igfxtsm32.exe 2212 igfxtsm32.exe 1780 igfxtsm32.exe 1632 igfxtsm32.exe 1564 igfxtsm32.exe 2792 igfxtsm32.exe 2716 igfxtsm32.exe 2140 igfxtsm32.exe 816 igfxtsm32.exe 956 igfxtsm32.exe 1284 igfxtsm32.exe 2132 igfxtsm32.exe 2248 igfxtsm32.exe 1496 igfxtsm32.exe 336 igfxtsm32.exe 2088 igfxtsm32.exe 1696 igfxtsm32.exe 2760 igfxtsm32.exe 2176 igfxtsm32.exe 2768 igfxtsm32.exe 2532 igfxtsm32.exe 3044 igfxtsm32.exe 1676 igfxtsm32.exe 2784 igfxtsm32.exe 812 igfxtsm32.exe 320 igfxtsm32.exe 1952 igfxtsm32.exe 2896 igfxtsm32.exe -
Loads dropped DLL 62 IoCs
pid Process 2612 e7a55b3dad8012b94db5662c54538d1f_JaffaCakes118.exe 2612 e7a55b3dad8012b94db5662c54538d1f_JaffaCakes118.exe 2468 igfxtsm32.exe 2468 igfxtsm32.exe 2664 igfxtsm32.exe 2664 igfxtsm32.exe 2868 igfxtsm32.exe 2868 igfxtsm32.exe 2548 igfxtsm32.exe 2548 igfxtsm32.exe 2212 igfxtsm32.exe 2212 igfxtsm32.exe 1780 igfxtsm32.exe 1780 igfxtsm32.exe 1632 igfxtsm32.exe 1632 igfxtsm32.exe 1564 igfxtsm32.exe 1564 igfxtsm32.exe 2792 igfxtsm32.exe 2792 igfxtsm32.exe 2716 igfxtsm32.exe 2716 igfxtsm32.exe 2140 igfxtsm32.exe 2140 igfxtsm32.exe 816 igfxtsm32.exe 816 igfxtsm32.exe 956 igfxtsm32.exe 956 igfxtsm32.exe 1284 igfxtsm32.exe 1284 igfxtsm32.exe 2132 igfxtsm32.exe 2132 igfxtsm32.exe 2248 igfxtsm32.exe 2248 igfxtsm32.exe 1496 igfxtsm32.exe 1496 igfxtsm32.exe 336 igfxtsm32.exe 336 igfxtsm32.exe 2088 igfxtsm32.exe 2088 igfxtsm32.exe 1696 igfxtsm32.exe 1696 igfxtsm32.exe 2760 igfxtsm32.exe 2760 igfxtsm32.exe 2176 igfxtsm32.exe 2176 igfxtsm32.exe 2768 igfxtsm32.exe 2768 igfxtsm32.exe 2532 igfxtsm32.exe 2532 igfxtsm32.exe 3044 igfxtsm32.exe 3044 igfxtsm32.exe 1676 igfxtsm32.exe 1676 igfxtsm32.exe 2784 igfxtsm32.exe 2784 igfxtsm32.exe 812 igfxtsm32.exe 812 igfxtsm32.exe 320 igfxtsm32.exe 320 igfxtsm32.exe 1952 igfxtsm32.exe 1952 igfxtsm32.exe -
resource yara_rule behavioral1/memory/2612-0-0x0000000000400000-0x0000000001756000-memory.dmp upx behavioral1/files/0x000c0000000122e4-5.dat upx -
Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum e7a55b3dad8012b94db5662c54538d1f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 e7a55b3dad8012b94db5662c54538d1f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsm32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File created C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsm32.exe File created C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File created C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File created C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsm32.exe File created C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File created C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsm32.exe File created C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File created C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File created C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File created C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File created C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File created C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File created C:\Windows\SysWOW64\igfxtsm32.exe e7a55b3dad8012b94db5662c54538d1f_JaffaCakes118.exe File created C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsm32.exe File created C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File created C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File created C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File created C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File created C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File created C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\igfxtsm32.exe e7a55b3dad8012b94db5662c54538d1f_JaffaCakes118.exe File created C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsm32.exe File opened for modification C:\Windows\SysWOW64\igfxtsm32.exe igfxtsm32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 32 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e7a55b3dad8012b94db5662c54538d1f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsm32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2612 e7a55b3dad8012b94db5662c54538d1f_JaffaCakes118.exe 2612 e7a55b3dad8012b94db5662c54538d1f_JaffaCakes118.exe 2468 igfxtsm32.exe 2468 igfxtsm32.exe 2664 igfxtsm32.exe 2664 igfxtsm32.exe 2868 igfxtsm32.exe 2868 igfxtsm32.exe 2548 igfxtsm32.exe 2548 igfxtsm32.exe 2212 igfxtsm32.exe 2212 igfxtsm32.exe 1780 igfxtsm32.exe 1780 igfxtsm32.exe 1632 igfxtsm32.exe 1632 igfxtsm32.exe 1564 igfxtsm32.exe 1564 igfxtsm32.exe 2792 igfxtsm32.exe 2792 igfxtsm32.exe 2716 igfxtsm32.exe 2716 igfxtsm32.exe 2140 igfxtsm32.exe 2140 igfxtsm32.exe 816 igfxtsm32.exe 816 igfxtsm32.exe 956 igfxtsm32.exe 956 igfxtsm32.exe 1284 igfxtsm32.exe 1284 igfxtsm32.exe 2132 igfxtsm32.exe 2132 igfxtsm32.exe 2248 igfxtsm32.exe 2248 igfxtsm32.exe 1496 igfxtsm32.exe 1496 igfxtsm32.exe 336 igfxtsm32.exe 336 igfxtsm32.exe 2088 igfxtsm32.exe 2088 igfxtsm32.exe 1696 igfxtsm32.exe 1696 igfxtsm32.exe 2760 igfxtsm32.exe 2760 igfxtsm32.exe 2176 igfxtsm32.exe 2176 igfxtsm32.exe 2768 igfxtsm32.exe 2768 igfxtsm32.exe 2532 igfxtsm32.exe 2532 igfxtsm32.exe 3044 igfxtsm32.exe 3044 igfxtsm32.exe 1676 igfxtsm32.exe 1676 igfxtsm32.exe 2784 igfxtsm32.exe 2784 igfxtsm32.exe 812 igfxtsm32.exe 812 igfxtsm32.exe 320 igfxtsm32.exe 320 igfxtsm32.exe 1952 igfxtsm32.exe 1952 igfxtsm32.exe 2896 igfxtsm32.exe 2896 igfxtsm32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2612 wrote to memory of 2468 2612 e7a55b3dad8012b94db5662c54538d1f_JaffaCakes118.exe 31 PID 2612 wrote to memory of 2468 2612 e7a55b3dad8012b94db5662c54538d1f_JaffaCakes118.exe 31 PID 2612 wrote to memory of 2468 2612 e7a55b3dad8012b94db5662c54538d1f_JaffaCakes118.exe 31 PID 2612 wrote to memory of 2468 2612 e7a55b3dad8012b94db5662c54538d1f_JaffaCakes118.exe 31 PID 2468 wrote to memory of 2664 2468 igfxtsm32.exe 32 PID 2468 wrote to memory of 2664 2468 igfxtsm32.exe 32 PID 2468 wrote to memory of 2664 2468 igfxtsm32.exe 32 PID 2468 wrote to memory of 2664 2468 igfxtsm32.exe 32 PID 2664 wrote to memory of 2868 2664 igfxtsm32.exe 33 PID 2664 wrote to memory of 2868 2664 igfxtsm32.exe 33 PID 2664 wrote to memory of 2868 2664 igfxtsm32.exe 33 PID 2664 wrote to memory of 2868 2664 igfxtsm32.exe 33 PID 2868 wrote to memory of 2548 2868 igfxtsm32.exe 34 PID 2868 wrote to memory of 2548 2868 igfxtsm32.exe 34 PID 2868 wrote to memory of 2548 2868 igfxtsm32.exe 34 PID 2868 wrote to memory of 2548 2868 igfxtsm32.exe 34 PID 2548 wrote to memory of 2212 2548 igfxtsm32.exe 35 PID 2548 wrote to memory of 2212 2548 igfxtsm32.exe 35 PID 2548 wrote to memory of 2212 2548 igfxtsm32.exe 35 PID 2548 wrote to memory of 2212 2548 igfxtsm32.exe 35 PID 2212 wrote to memory of 1780 2212 igfxtsm32.exe 36 PID 2212 wrote to memory of 1780 2212 igfxtsm32.exe 36 PID 2212 wrote to memory of 1780 2212 igfxtsm32.exe 36 PID 2212 wrote to memory of 1780 2212 igfxtsm32.exe 36 PID 1780 wrote to memory of 1632 1780 igfxtsm32.exe 37 PID 1780 wrote to memory of 1632 1780 igfxtsm32.exe 37 PID 1780 wrote to memory of 1632 1780 igfxtsm32.exe 37 PID 1780 wrote to memory of 1632 1780 igfxtsm32.exe 37 PID 1632 wrote to memory of 1564 1632 igfxtsm32.exe 38 PID 1632 wrote to memory of 1564 1632 igfxtsm32.exe 38 PID 1632 wrote to memory of 1564 1632 igfxtsm32.exe 38 PID 1632 wrote to memory of 1564 1632 igfxtsm32.exe 38 PID 1564 wrote to memory of 2792 1564 igfxtsm32.exe 39 PID 1564 wrote to memory of 2792 1564 igfxtsm32.exe 39 PID 1564 wrote to memory of 2792 1564 igfxtsm32.exe 39 PID 1564 wrote to memory of 2792 1564 igfxtsm32.exe 39 PID 2792 wrote to memory of 2716 2792 igfxtsm32.exe 40 PID 2792 wrote to memory of 2716 2792 igfxtsm32.exe 40 PID 2792 wrote to memory of 2716 2792 igfxtsm32.exe 40 PID 2792 wrote to memory of 2716 2792 igfxtsm32.exe 40 PID 2716 wrote to memory of 2140 2716 igfxtsm32.exe 41 PID 2716 wrote to memory of 2140 2716 igfxtsm32.exe 41 PID 2716 wrote to memory of 2140 2716 igfxtsm32.exe 41 PID 2716 wrote to memory of 2140 2716 igfxtsm32.exe 41 PID 2140 wrote to memory of 816 2140 igfxtsm32.exe 42 PID 2140 wrote to memory of 816 2140 igfxtsm32.exe 42 PID 2140 wrote to memory of 816 2140 igfxtsm32.exe 42 PID 2140 wrote to memory of 816 2140 igfxtsm32.exe 42 PID 816 wrote to memory of 956 816 igfxtsm32.exe 43 PID 816 wrote to memory of 956 816 igfxtsm32.exe 43 PID 816 wrote to memory of 956 816 igfxtsm32.exe 43 PID 816 wrote to memory of 956 816 igfxtsm32.exe 43 PID 956 wrote to memory of 1284 956 igfxtsm32.exe 44 PID 956 wrote to memory of 1284 956 igfxtsm32.exe 44 PID 956 wrote to memory of 1284 956 igfxtsm32.exe 44 PID 956 wrote to memory of 1284 956 igfxtsm32.exe 44 PID 1284 wrote to memory of 2132 1284 igfxtsm32.exe 45 PID 1284 wrote to memory of 2132 1284 igfxtsm32.exe 45 PID 1284 wrote to memory of 2132 1284 igfxtsm32.exe 45 PID 1284 wrote to memory of 2132 1284 igfxtsm32.exe 45 PID 2132 wrote to memory of 2248 2132 igfxtsm32.exe 46 PID 2132 wrote to memory of 2248 2132 igfxtsm32.exe 46 PID 2132 wrote to memory of 2248 2132 igfxtsm32.exe 46 PID 2132 wrote to memory of 2248 2132 igfxtsm32.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7a55b3dad8012b94db5662c54538d1f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e7a55b3dad8012b94db5662c54538d1f_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Users\Admin\AppData\Local\Temp\E7A55B~1.EXE2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE4⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE5⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE9⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE11⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE13⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE14⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE15⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE17⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2248 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1496 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE19⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:336 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2088 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE21⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1696 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2760 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE23⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2176 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE24⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2768 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE25⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2532 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE26⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3044 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE27⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1676 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2784 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE29⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:812 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE30⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:320 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE31⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1952 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE32⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2896 -
C:\Windows\SysWOW64\igfxtsm32.exe"C:\Windows\system32\igfxtsm32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE33⤵PID:2152
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
235KB
MD5e7a55b3dad8012b94db5662c54538d1f
SHA10fc02df267c0bc76868e7d27e5988d5df824d143
SHA256eab24a0771a5bec6c6214274b731ae3f69aac7c4940e4b1605472a980ad7268b
SHA512f2ba48c4af98cb4160a408344cbd6754ca4326eb6794eeeef5073935d6f2ce7ee1de1d1cc4c33485aacf7ab561c37b8dbe1a651071fe89b0a577fbc8188d467d