Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-09-2024 23:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ea303063e08daf8e3a2f681f43f99d98_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
ea303063e08daf8e3a2f681f43f99d98_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
ea303063e08daf8e3a2f681f43f99d98_JaffaCakes118.exe
-
Size
228KB
-
MD5
ea303063e08daf8e3a2f681f43f99d98
-
SHA1
b628f5439cd990fdb0e394fbe70a25a0d8989f87
-
SHA256
14fe6f3564aa67459d8c71631c7fc4571394bfeeeffea9c20e3e954c34e14aaa
-
SHA512
8665329b593680b9507201fa9e87d54255c7032ef268d316c2e1a59ce8f03fbabbf946005433b0d69e18fd309892ca8cc30a52d8689e9deedba32a44ad6c4e1f
-
SSDEEP
3072:Lsr0rpQfJNsEEPlr9+q5DhqGonmv0CGebUCQEtDRQ2myWZEdJevwd:ggS/sBd+m0CrbP3tt0E
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Deletes itself 1 IoCs
pid Process 2836 igfxdw32.exe -
Executes dropped EXE 64 IoCs
pid Process 2716 igfxdw32.exe 2836 igfxdw32.exe 2816 igfxdw32.exe 1980 igfxdw32.exe 1924 igfxdw32.exe 1936 igfxdw32.exe 2948 igfxdw32.exe 3040 igfxdw32.exe 2028 igfxdw32.exe 2428 igfxdw32.exe 2448 igfxdw32.exe 772 igfxdw32.exe 2172 igfxdw32.exe 1584 igfxdw32.exe 1608 igfxdw32.exe 2092 igfxdw32.exe 2368 igfxdw32.exe 2400 igfxdw32.exe 1804 igfxdw32.exe 2476 igfxdw32.exe 1212 igfxdw32.exe 2224 igfxdw32.exe 2848 igfxdw32.exe 2392 igfxdw32.exe 2144 igfxdw32.exe 2748 igfxdw32.exe 1932 igfxdw32.exe 2960 igfxdw32.exe 2876 igfxdw32.exe 1508 igfxdw32.exe 2016 igfxdw32.exe 1564 igfxdw32.exe 748 igfxdw32.exe 2404 igfxdw32.exe 1124 igfxdw32.exe 1576 igfxdw32.exe 1752 igfxdw32.exe 1096 igfxdw32.exe 1964 igfxdw32.exe 1488 igfxdw32.exe 1572 igfxdw32.exe 2416 igfxdw32.exe 1836 igfxdw32.exe 1808 igfxdw32.exe 1592 igfxdw32.exe 1740 igfxdw32.exe 1628 igfxdw32.exe 2840 igfxdw32.exe 2888 igfxdw32.exe 2360 igfxdw32.exe 2656 igfxdw32.exe 2668 igfxdw32.exe 2972 igfxdw32.exe 2932 igfxdw32.exe 2736 igfxdw32.exe 3028 igfxdw32.exe 2016 igfxdw32.exe 2408 igfxdw32.exe 2456 igfxdw32.exe 984 igfxdw32.exe 1764 igfxdw32.exe 1712 igfxdw32.exe 2100 igfxdw32.exe 960 igfxdw32.exe -
Loads dropped DLL 64 IoCs
pid Process 1632 ea303063e08daf8e3a2f681f43f99d98_JaffaCakes118.exe 1632 ea303063e08daf8e3a2f681f43f99d98_JaffaCakes118.exe 2716 igfxdw32.exe 2716 igfxdw32.exe 2836 igfxdw32.exe 2836 igfxdw32.exe 2816 igfxdw32.exe 2816 igfxdw32.exe 1980 igfxdw32.exe 1980 igfxdw32.exe 1924 igfxdw32.exe 1924 igfxdw32.exe 1936 igfxdw32.exe 1936 igfxdw32.exe 2948 igfxdw32.exe 2948 igfxdw32.exe 3040 igfxdw32.exe 3040 igfxdw32.exe 2028 igfxdw32.exe 2028 igfxdw32.exe 2428 igfxdw32.exe 2428 igfxdw32.exe 2448 igfxdw32.exe 2448 igfxdw32.exe 772 igfxdw32.exe 772 igfxdw32.exe 2172 igfxdw32.exe 2172 igfxdw32.exe 1584 igfxdw32.exe 1584 igfxdw32.exe 1608 igfxdw32.exe 1608 igfxdw32.exe 2092 igfxdw32.exe 2092 igfxdw32.exe 2368 igfxdw32.exe 2368 igfxdw32.exe 2400 igfxdw32.exe 2400 igfxdw32.exe 1804 igfxdw32.exe 1804 igfxdw32.exe 2476 igfxdw32.exe 2476 igfxdw32.exe 1212 igfxdw32.exe 1212 igfxdw32.exe 2224 igfxdw32.exe 2224 igfxdw32.exe 2848 igfxdw32.exe 2848 igfxdw32.exe 2392 igfxdw32.exe 2392 igfxdw32.exe 2144 igfxdw32.exe 2144 igfxdw32.exe 2748 igfxdw32.exe 2748 igfxdw32.exe 1932 igfxdw32.exe 1932 igfxdw32.exe 2960 igfxdw32.exe 2960 igfxdw32.exe 2876 igfxdw32.exe 2876 igfxdw32.exe 1508 igfxdw32.exe 1508 igfxdw32.exe 2016 igfxdw32.exe 2016 igfxdw32.exe -
resource yara_rule behavioral1/memory/1632-4-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1632-7-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1632-3-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1632-2-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1632-8-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1632-9-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1632-22-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2836-34-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2836-36-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2836-35-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2836-42-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1980-54-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1980-61-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1936-79-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/3040-90-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/3040-91-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/3040-92-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/3040-98-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2428-110-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2428-111-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2428-109-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2428-117-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/772-129-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/772-137-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1584-155-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2092-168-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2092-175-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2400-186-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2400-194-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2476-203-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2476-212-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2224-221-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2224-225-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2392-237-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2748-246-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2748-250-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2960-262-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1508-271-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1508-275-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1564-283-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1564-288-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2404-300-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1576-312-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1488-335-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1096-343-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2416-345-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2416-349-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1808-361-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1740-369-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1740-374-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2840-382-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2840-387-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2360-395-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2360-400-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2668-412-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2932-424-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/3028-432-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/3028-437-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2408-445-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/2408-450-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/984-462-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1712-474-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/960-486-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral1/memory/1248-498-0x0000000000400000-0x0000000000466000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 ea303063e08daf8e3a2f681f43f99d98_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum ea303063e08daf8e3a2f681f43f99d98_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdw32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File created C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File opened for modification C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File created C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File created C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File opened for modification C:\Windows\SysWOW64\ igfxdw32.exe File opened for modification C:\Windows\SysWOW64\ igfxdw32.exe File created C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File created C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File opened for modification C:\Windows\SysWOW64\ igfxdw32.exe File created C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File opened for modification C:\Windows\SysWOW64\ igfxdw32.exe File opened for modification C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File opened for modification C:\Windows\SysWOW64\ igfxdw32.exe File opened for modification C:\Windows\SysWOW64\ igfxdw32.exe File opened for modification C:\Windows\SysWOW64\ igfxdw32.exe File opened for modification C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File opened for modification C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File created C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File created C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File created C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File created C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File opened for modification C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File created C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File opened for modification C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File created C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File opened for modification C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File created C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File opened for modification C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File opened for modification C:\Windows\SysWOW64\ igfxdw32.exe File created C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File created C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File created C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File created C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File opened for modification C:\Windows\SysWOW64\ igfxdw32.exe File opened for modification C:\Windows\SysWOW64\ igfxdw32.exe File opened for modification C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File opened for modification C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File opened for modification C:\Windows\SysWOW64\ igfxdw32.exe File opened for modification C:\Windows\SysWOW64\ igfxdw32.exe File opened for modification C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File opened for modification C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File opened for modification C:\Windows\SysWOW64\ igfxdw32.exe File created C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File opened for modification C:\Windows\SysWOW64\ igfxdw32.exe File created C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File opened for modification C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File created C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File created C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File opened for modification C:\Windows\SysWOW64\ igfxdw32.exe File opened for modification C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File created C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File opened for modification C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File opened for modification C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File opened for modification C:\Windows\SysWOW64\ igfxdw32.exe File opened for modification C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File opened for modification C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File created C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File opened for modification C:\Windows\SysWOW64\ igfxdw32.exe File opened for modification C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File opened for modification C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe File opened for modification C:\Windows\SysWOW64\ igfxdw32.exe File opened for modification C:\Windows\SysWOW64\ igfxdw32.exe File opened for modification C:\Windows\SysWOW64\igfxdw32.exe igfxdw32.exe -
Suspicious use of SetThreadContext 35 IoCs
description pid Process procid_target PID 2008 set thread context of 1632 2008 ea303063e08daf8e3a2f681f43f99d98_JaffaCakes118.exe 30 PID 2716 set thread context of 2836 2716 igfxdw32.exe 32 PID 2816 set thread context of 1980 2816 igfxdw32.exe 34 PID 1924 set thread context of 1936 1924 igfxdw32.exe 36 PID 2948 set thread context of 3040 2948 igfxdw32.exe 39 PID 2028 set thread context of 2428 2028 igfxdw32.exe 41 PID 2448 set thread context of 772 2448 igfxdw32.exe 43 PID 2172 set thread context of 1584 2172 igfxdw32.exe 45 PID 1608 set thread context of 2092 1608 igfxdw32.exe 47 PID 2368 set thread context of 2400 2368 igfxdw32.exe 49 PID 1804 set thread context of 2476 1804 igfxdw32.exe 51 PID 1212 set thread context of 2224 1212 igfxdw32.exe 53 PID 2848 set thread context of 2392 2848 igfxdw32.exe 55 PID 2144 set thread context of 2748 2144 igfxdw32.exe 57 PID 1932 set thread context of 2960 1932 igfxdw32.exe 59 PID 2876 set thread context of 1508 2876 igfxdw32.exe 61 PID 2016 set thread context of 1564 2016 igfxdw32.exe 63 PID 748 set thread context of 2404 748 igfxdw32.exe 65 PID 1124 set thread context of 1576 1124 igfxdw32.exe 67 PID 1752 set thread context of 1096 1752 igfxdw32.exe 69 PID 1964 set thread context of 1488 1964 igfxdw32.exe 71 PID 1572 set thread context of 2416 1572 igfxdw32.exe 73 PID 1836 set thread context of 1808 1836 igfxdw32.exe 75 PID 1592 set thread context of 1740 1592 igfxdw32.exe 77 PID 1628 set thread context of 2840 1628 igfxdw32.exe 79 PID 2888 set thread context of 2360 2888 igfxdw32.exe 81 PID 2656 set thread context of 2668 2656 igfxdw32.exe 83 PID 2972 set thread context of 2932 2972 igfxdw32.exe 85 PID 2736 set thread context of 3028 2736 igfxdw32.exe 87 PID 2016 set thread context of 2408 2016 igfxdw32.exe 89 PID 2456 set thread context of 984 2456 igfxdw32.exe 91 PID 1764 set thread context of 1712 1764 igfxdw32.exe 93 PID 2100 set thread context of 960 2100 igfxdw32.exe 95 PID 1552 set thread context of 1248 1552 igfxdw32.exe 97 PID 1376 set thread context of 1572 1376 igfxdw32.exe 99 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea303063e08daf8e3a2f681f43f99d98_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea303063e08daf8e3a2f681f43f99d98_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdw32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1632 ea303063e08daf8e3a2f681f43f99d98_JaffaCakes118.exe 1632 ea303063e08daf8e3a2f681f43f99d98_JaffaCakes118.exe 2836 igfxdw32.exe 2836 igfxdw32.exe 1980 igfxdw32.exe 1980 igfxdw32.exe 1936 igfxdw32.exe 1936 igfxdw32.exe 3040 igfxdw32.exe 3040 igfxdw32.exe 2428 igfxdw32.exe 2428 igfxdw32.exe 772 igfxdw32.exe 772 igfxdw32.exe 1584 igfxdw32.exe 1584 igfxdw32.exe 2092 igfxdw32.exe 2092 igfxdw32.exe 2400 igfxdw32.exe 2400 igfxdw32.exe 2224 igfxdw32.exe 2224 igfxdw32.exe 2392 igfxdw32.exe 2392 igfxdw32.exe 2748 igfxdw32.exe 2748 igfxdw32.exe 2960 igfxdw32.exe 2960 igfxdw32.exe 1508 igfxdw32.exe 1508 igfxdw32.exe 1564 igfxdw32.exe 1564 igfxdw32.exe 2404 igfxdw32.exe 2404 igfxdw32.exe 1576 igfxdw32.exe 1576 igfxdw32.exe 1096 igfxdw32.exe 1096 igfxdw32.exe 1488 igfxdw32.exe 1488 igfxdw32.exe 2416 igfxdw32.exe 2416 igfxdw32.exe 1808 igfxdw32.exe 1808 igfxdw32.exe 1740 igfxdw32.exe 1740 igfxdw32.exe 2840 igfxdw32.exe 2840 igfxdw32.exe 2360 igfxdw32.exe 2360 igfxdw32.exe 2668 igfxdw32.exe 2668 igfxdw32.exe 2932 igfxdw32.exe 2932 igfxdw32.exe 3028 igfxdw32.exe 3028 igfxdw32.exe 2408 igfxdw32.exe 2408 igfxdw32.exe 984 igfxdw32.exe 984 igfxdw32.exe 1712 igfxdw32.exe 1712 igfxdw32.exe 960 igfxdw32.exe 960 igfxdw32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2008 wrote to memory of 1632 2008 ea303063e08daf8e3a2f681f43f99d98_JaffaCakes118.exe 30 PID 2008 wrote to memory of 1632 2008 ea303063e08daf8e3a2f681f43f99d98_JaffaCakes118.exe 30 PID 2008 wrote to memory of 1632 2008 ea303063e08daf8e3a2f681f43f99d98_JaffaCakes118.exe 30 PID 2008 wrote to memory of 1632 2008 ea303063e08daf8e3a2f681f43f99d98_JaffaCakes118.exe 30 PID 2008 wrote to memory of 1632 2008 ea303063e08daf8e3a2f681f43f99d98_JaffaCakes118.exe 30 PID 2008 wrote to memory of 1632 2008 ea303063e08daf8e3a2f681f43f99d98_JaffaCakes118.exe 30 PID 2008 wrote to memory of 1632 2008 ea303063e08daf8e3a2f681f43f99d98_JaffaCakes118.exe 30 PID 1632 wrote to memory of 2716 1632 ea303063e08daf8e3a2f681f43f99d98_JaffaCakes118.exe 31 PID 1632 wrote to memory of 2716 1632 ea303063e08daf8e3a2f681f43f99d98_JaffaCakes118.exe 31 PID 1632 wrote to memory of 2716 1632 ea303063e08daf8e3a2f681f43f99d98_JaffaCakes118.exe 31 PID 1632 wrote to memory of 2716 1632 ea303063e08daf8e3a2f681f43f99d98_JaffaCakes118.exe 31 PID 2716 wrote to memory of 2836 2716 igfxdw32.exe 32 PID 2716 wrote to memory of 2836 2716 igfxdw32.exe 32 PID 2716 wrote to memory of 2836 2716 igfxdw32.exe 32 PID 2716 wrote to memory of 2836 2716 igfxdw32.exe 32 PID 2716 wrote to memory of 2836 2716 igfxdw32.exe 32 PID 2716 wrote to memory of 2836 2716 igfxdw32.exe 32 PID 2716 wrote to memory of 2836 2716 igfxdw32.exe 32 PID 2836 wrote to memory of 2816 2836 igfxdw32.exe 33 PID 2836 wrote to memory of 2816 2836 igfxdw32.exe 33 PID 2836 wrote to memory of 2816 2836 igfxdw32.exe 33 PID 2836 wrote to memory of 2816 2836 igfxdw32.exe 33 PID 2816 wrote to memory of 1980 2816 igfxdw32.exe 34 PID 2816 wrote to memory of 1980 2816 igfxdw32.exe 34 PID 2816 wrote to memory of 1980 2816 igfxdw32.exe 34 PID 2816 wrote to memory of 1980 2816 igfxdw32.exe 34 PID 2816 wrote to memory of 1980 2816 igfxdw32.exe 34 PID 2816 wrote to memory of 1980 2816 igfxdw32.exe 34 PID 2816 wrote to memory of 1980 2816 igfxdw32.exe 34 PID 1980 wrote to memory of 1924 1980 igfxdw32.exe 35 PID 1980 wrote to memory of 1924 1980 igfxdw32.exe 35 PID 1980 wrote to memory of 1924 1980 igfxdw32.exe 35 PID 1980 wrote to memory of 1924 1980 igfxdw32.exe 35 PID 1924 wrote to memory of 1936 1924 igfxdw32.exe 36 PID 1924 wrote to memory of 1936 1924 igfxdw32.exe 36 PID 1924 wrote to memory of 1936 1924 igfxdw32.exe 36 PID 1924 wrote to memory of 1936 1924 igfxdw32.exe 36 PID 1924 wrote to memory of 1936 1924 igfxdw32.exe 36 PID 1924 wrote to memory of 1936 1924 igfxdw32.exe 36 PID 1924 wrote to memory of 1936 1924 igfxdw32.exe 36 PID 1936 wrote to memory of 2948 1936 igfxdw32.exe 38 PID 1936 wrote to memory of 2948 1936 igfxdw32.exe 38 PID 1936 wrote to memory of 2948 1936 igfxdw32.exe 38 PID 1936 wrote to memory of 2948 1936 igfxdw32.exe 38 PID 2948 wrote to memory of 3040 2948 igfxdw32.exe 39 PID 2948 wrote to memory of 3040 2948 igfxdw32.exe 39 PID 2948 wrote to memory of 3040 2948 igfxdw32.exe 39 PID 2948 wrote to memory of 3040 2948 igfxdw32.exe 39 PID 2948 wrote to memory of 3040 2948 igfxdw32.exe 39 PID 2948 wrote to memory of 3040 2948 igfxdw32.exe 39 PID 2948 wrote to memory of 3040 2948 igfxdw32.exe 39 PID 3040 wrote to memory of 2028 3040 igfxdw32.exe 40 PID 3040 wrote to memory of 2028 3040 igfxdw32.exe 40 PID 3040 wrote to memory of 2028 3040 igfxdw32.exe 40 PID 3040 wrote to memory of 2028 3040 igfxdw32.exe 40 PID 2028 wrote to memory of 2428 2028 igfxdw32.exe 41 PID 2028 wrote to memory of 2428 2028 igfxdw32.exe 41 PID 2028 wrote to memory of 2428 2028 igfxdw32.exe 41 PID 2028 wrote to memory of 2428 2028 igfxdw32.exe 41 PID 2028 wrote to memory of 2428 2028 igfxdw32.exe 41 PID 2028 wrote to memory of 2428 2028 igfxdw32.exe 41 PID 2028 wrote to memory of 2428 2028 igfxdw32.exe 41 PID 2428 wrote to memory of 2448 2428 igfxdw32.exe 42 PID 2428 wrote to memory of 2448 2428 igfxdw32.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea303063e08daf8e3a2f681f43f99d98_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea303063e08daf8e3a2f681f43f99d98_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\ea303063e08daf8e3a2f681f43f99d98_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea303063e08daf8e3a2f681f43f99d98_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Users\Admin\AppData\Local\Temp\EA3030~1.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Users\Admin\AppData\Local\Temp\EA3030~1.EXE4⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2448 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:772 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2172 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1584 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1608 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2092 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2368 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2400 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1804 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:2476 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1212 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2224 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2848 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2392 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2144 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2748 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1932 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2960 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2876 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1508 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe33⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2016 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe34⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1564 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:748 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe36⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2404 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1124 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe38⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1576 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1752 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe40⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1096 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1964 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe42⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1488 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1572 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe44⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2416 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1836 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe46⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1808 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1592 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe48⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1740 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1628 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe50⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2840 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2888 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe52⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2360 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2656 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe54⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2668 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2972 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe56⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2932 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2736 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe58⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3028 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2016 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe60⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2408 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2456 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe62⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:984 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe63⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1764 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe64⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1712 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe65⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2100 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe66⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:960 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe67⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1552 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe68⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1248 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe69⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1376 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe70⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1572 -
C:\Windows\SysWOW64\igfxdw32.exe"C:\Windows\system32\igfxdw32.exe" C:\Windows\SysWOW64\igfxdw32.exe71⤵PID:3068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228KB
MD5ea303063e08daf8e3a2f681f43f99d98
SHA1b628f5439cd990fdb0e394fbe70a25a0d8989f87
SHA25614fe6f3564aa67459d8c71631c7fc4571394bfeeeffea9c20e3e954c34e14aaa
SHA5128665329b593680b9507201fa9e87d54255c7032ef268d316c2e1a59ce8f03fbabbf946005433b0d69e18fd309892ca8cc30a52d8689e9deedba32a44ad6c4e1f