Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-09-2024 20:23
Behavioral task
behavioral1
Sample
e9e901e051f43ae7c83fee5b52122ab1_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
General
-
Target
e9e901e051f43ae7c83fee5b52122ab1_JaffaCakes118.exe
-
Size
199KB
-
MD5
e9e901e051f43ae7c83fee5b52122ab1
-
SHA1
b22b7f00d518cbe3dd67ebb3cbd2cfa1bba50594
-
SHA256
e9c83989dbb6401dd387267f388c63d2ade2dade618a36272cd7d6ec8223bc93
-
SHA512
08362dcf1b2a6daa927b86f3def058470520bcc910891145d43572bb72b7aa852f1a2c988596831d8f1a967378e2044fc32af4392c4ab5be4430d7f080d39eaf
-
SSDEEP
6144:nOymp9JYg+X3Nozpd8dUj3N7+tX+7JXmC58V:nYudCz38dkN7+tXAJXr58V
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Deletes itself 1 IoCs
pid Process 2700 igfxdkc32.exe -
Executes dropped EXE 46 IoCs
pid Process 2700 igfxdkc32.exe 2720 igfxdkc32.exe 3056 igfxdkc32.exe 1748 igfxdkc32.exe 2360 igfxdkc32.exe 1652 igfxdkc32.exe 2272 igfxdkc32.exe 2848 igfxdkc32.exe 332 igfxdkc32.exe 2256 igfxdkc32.exe 3068 igfxdkc32.exe 2412 igfxdkc32.exe 2520 igfxdkc32.exe 2964 igfxdkc32.exe 2768 igfxdkc32.exe 1612 igfxdkc32.exe 2468 igfxdkc32.exe 2460 igfxdkc32.exe 860 igfxdkc32.exe 1660 igfxdkc32.exe 2780 igfxdkc32.exe 2752 igfxdkc32.exe 2576 igfxdkc32.exe 2544 igfxdkc32.exe 2916 igfxdkc32.exe 2888 igfxdkc32.exe 2364 igfxdkc32.exe 2344 igfxdkc32.exe 2724 igfxdkc32.exe 576 igfxdkc32.exe 2352 igfxdkc32.exe 2372 igfxdkc32.exe 2100 igfxdkc32.exe 2096 igfxdkc32.exe 2144 igfxdkc32.exe 1292 igfxdkc32.exe 1540 igfxdkc32.exe 948 igfxdkc32.exe 1268 igfxdkc32.exe 2316 igfxdkc32.exe 308 igfxdkc32.exe 1836 igfxdkc32.exe 1272 igfxdkc32.exe 2676 igfxdkc32.exe 1020 igfxdkc32.exe 2812 igfxdkc32.exe -
Loads dropped DLL 64 IoCs
pid Process 2656 e9e901e051f43ae7c83fee5b52122ab1_JaffaCakes118.exe 2656 e9e901e051f43ae7c83fee5b52122ab1_JaffaCakes118.exe 2700 igfxdkc32.exe 2700 igfxdkc32.exe 2720 igfxdkc32.exe 2720 igfxdkc32.exe 3056 igfxdkc32.exe 3056 igfxdkc32.exe 1748 igfxdkc32.exe 1748 igfxdkc32.exe 2360 igfxdkc32.exe 2360 igfxdkc32.exe 1652 igfxdkc32.exe 1652 igfxdkc32.exe 2272 igfxdkc32.exe 2272 igfxdkc32.exe 2848 igfxdkc32.exe 2848 igfxdkc32.exe 332 igfxdkc32.exe 332 igfxdkc32.exe 2256 igfxdkc32.exe 2256 igfxdkc32.exe 3068 igfxdkc32.exe 3068 igfxdkc32.exe 2412 igfxdkc32.exe 2412 igfxdkc32.exe 2520 igfxdkc32.exe 2520 igfxdkc32.exe 2964 igfxdkc32.exe 2964 igfxdkc32.exe 2768 igfxdkc32.exe 2768 igfxdkc32.exe 1612 igfxdkc32.exe 1612 igfxdkc32.exe 2468 igfxdkc32.exe 2468 igfxdkc32.exe 2460 igfxdkc32.exe 2460 igfxdkc32.exe 860 igfxdkc32.exe 860 igfxdkc32.exe 1660 igfxdkc32.exe 1660 igfxdkc32.exe 2780 igfxdkc32.exe 2780 igfxdkc32.exe 2752 igfxdkc32.exe 2752 igfxdkc32.exe 2576 igfxdkc32.exe 2576 igfxdkc32.exe 2544 igfxdkc32.exe 2544 igfxdkc32.exe 2916 igfxdkc32.exe 2916 igfxdkc32.exe 2888 igfxdkc32.exe 2888 igfxdkc32.exe 2364 igfxdkc32.exe 2364 igfxdkc32.exe 2344 igfxdkc32.exe 2344 igfxdkc32.exe 2724 igfxdkc32.exe 2724 igfxdkc32.exe 576 igfxdkc32.exe 576 igfxdkc32.exe 2352 igfxdkc32.exe 2352 igfxdkc32.exe -
resource yara_rule behavioral1/memory/2656-0-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2656-2-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/files/0x0003000000012000-6.dat upx behavioral1/memory/2700-16-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2700-15-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2656-14-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2720-23-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2700-25-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/3056-31-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2720-30-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/1748-36-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/3056-38-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/1748-45-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2360-50-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/1652-55-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2272-61-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2848-59-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2848-67-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/332-72-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2256-78-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2412-82-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/3068-84-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2412-89-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2520-96-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2768-103-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2964-102-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2768-109-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/1612-115-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/1612-112-0x0000000003400000-0x0000000003494000-memory.dmp upx behavioral1/memory/2468-118-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2460-120-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/860-121-0x0000000003400000-0x0000000003494000-memory.dmp upx behavioral1/memory/860-123-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/1660-125-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2780-127-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2752-129-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2576-132-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2544-130-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2544-134-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2916-136-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2888-138-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2344-139-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2364-141-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2344-143-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2724-145-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/576-147-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2352-149-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2372-151-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2100-152-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2100-154-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2096-156-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2144-157-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2144-159-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/1292-161-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/1540-163-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/948-166-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/1268-164-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/1268-168-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2316-169-0x00000000031B0000-0x0000000003244000-memory.dmp upx behavioral1/memory/2316-171-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/308-172-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/1836-174-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/1272-176-0x0000000000400000-0x0000000000494000-memory.dmp upx behavioral1/memory/2676-177-0x00000000032E0000-0x0000000003374000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdkc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdkc32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\ igfxdkc32.exe File created C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\ igfxdkc32.exe File created C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File created C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File created C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File created C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File created C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\ igfxdkc32.exe File created C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\ e9e901e051f43ae7c83fee5b52122ab1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\ igfxdkc32.exe File created C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File created C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File created C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File created C:\Windows\SysWOW64\igfxdkc32.exe e9e901e051f43ae7c83fee5b52122ab1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\ igfxdkc32.exe File created C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\ igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File created C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\ igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\ igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File created C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File created C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\ igfxdkc32.exe File created C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\ igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File created C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\ igfxdkc32.exe File created C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\ igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\ igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File created C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\ igfxdkc32.exe File created C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\ igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\ igfxdkc32.exe File created C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\ igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\ igfxdkc32.exe File created C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe File opened for modification C:\Windows\SysWOW64\igfxdkc32.exe igfxdkc32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 47 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e9e901e051f43ae7c83fee5b52122ab1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdkc32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2656 e9e901e051f43ae7c83fee5b52122ab1_JaffaCakes118.exe 2656 e9e901e051f43ae7c83fee5b52122ab1_JaffaCakes118.exe 2700 igfxdkc32.exe 2700 igfxdkc32.exe 2720 igfxdkc32.exe 2720 igfxdkc32.exe 3056 igfxdkc32.exe 3056 igfxdkc32.exe 1748 igfxdkc32.exe 1748 igfxdkc32.exe 2360 igfxdkc32.exe 2360 igfxdkc32.exe 1652 igfxdkc32.exe 1652 igfxdkc32.exe 2272 igfxdkc32.exe 2272 igfxdkc32.exe 2848 igfxdkc32.exe 2848 igfxdkc32.exe 332 igfxdkc32.exe 332 igfxdkc32.exe 2256 igfxdkc32.exe 2256 igfxdkc32.exe 3068 igfxdkc32.exe 3068 igfxdkc32.exe 2412 igfxdkc32.exe 2412 igfxdkc32.exe 2520 igfxdkc32.exe 2520 igfxdkc32.exe 2964 igfxdkc32.exe 2964 igfxdkc32.exe 2768 igfxdkc32.exe 2768 igfxdkc32.exe 1612 igfxdkc32.exe 1612 igfxdkc32.exe 2468 igfxdkc32.exe 2468 igfxdkc32.exe 2460 igfxdkc32.exe 2460 igfxdkc32.exe 860 igfxdkc32.exe 860 igfxdkc32.exe 1660 igfxdkc32.exe 1660 igfxdkc32.exe 2780 igfxdkc32.exe 2780 igfxdkc32.exe 2752 igfxdkc32.exe 2752 igfxdkc32.exe 2576 igfxdkc32.exe 2576 igfxdkc32.exe 2544 igfxdkc32.exe 2544 igfxdkc32.exe 2916 igfxdkc32.exe 2916 igfxdkc32.exe 2888 igfxdkc32.exe 2888 igfxdkc32.exe 2364 igfxdkc32.exe 2364 igfxdkc32.exe 2344 igfxdkc32.exe 2344 igfxdkc32.exe 2724 igfxdkc32.exe 2724 igfxdkc32.exe 576 igfxdkc32.exe 576 igfxdkc32.exe 2352 igfxdkc32.exe 2352 igfxdkc32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2656 wrote to memory of 2700 2656 e9e901e051f43ae7c83fee5b52122ab1_JaffaCakes118.exe 30 PID 2656 wrote to memory of 2700 2656 e9e901e051f43ae7c83fee5b52122ab1_JaffaCakes118.exe 30 PID 2656 wrote to memory of 2700 2656 e9e901e051f43ae7c83fee5b52122ab1_JaffaCakes118.exe 30 PID 2656 wrote to memory of 2700 2656 e9e901e051f43ae7c83fee5b52122ab1_JaffaCakes118.exe 30 PID 2700 wrote to memory of 2720 2700 igfxdkc32.exe 31 PID 2700 wrote to memory of 2720 2700 igfxdkc32.exe 31 PID 2700 wrote to memory of 2720 2700 igfxdkc32.exe 31 PID 2700 wrote to memory of 2720 2700 igfxdkc32.exe 31 PID 2720 wrote to memory of 3056 2720 igfxdkc32.exe 32 PID 2720 wrote to memory of 3056 2720 igfxdkc32.exe 32 PID 2720 wrote to memory of 3056 2720 igfxdkc32.exe 32 PID 2720 wrote to memory of 3056 2720 igfxdkc32.exe 32 PID 3056 wrote to memory of 1748 3056 igfxdkc32.exe 33 PID 3056 wrote to memory of 1748 3056 igfxdkc32.exe 33 PID 3056 wrote to memory of 1748 3056 igfxdkc32.exe 33 PID 3056 wrote to memory of 1748 3056 igfxdkc32.exe 33 PID 1748 wrote to memory of 2360 1748 igfxdkc32.exe 34 PID 1748 wrote to memory of 2360 1748 igfxdkc32.exe 34 PID 1748 wrote to memory of 2360 1748 igfxdkc32.exe 34 PID 1748 wrote to memory of 2360 1748 igfxdkc32.exe 34 PID 2360 wrote to memory of 1652 2360 igfxdkc32.exe 35 PID 2360 wrote to memory of 1652 2360 igfxdkc32.exe 35 PID 2360 wrote to memory of 1652 2360 igfxdkc32.exe 35 PID 2360 wrote to memory of 1652 2360 igfxdkc32.exe 35 PID 1652 wrote to memory of 2272 1652 igfxdkc32.exe 36 PID 1652 wrote to memory of 2272 1652 igfxdkc32.exe 36 PID 1652 wrote to memory of 2272 1652 igfxdkc32.exe 36 PID 1652 wrote to memory of 2272 1652 igfxdkc32.exe 36 PID 2272 wrote to memory of 2848 2272 igfxdkc32.exe 37 PID 2272 wrote to memory of 2848 2272 igfxdkc32.exe 37 PID 2272 wrote to memory of 2848 2272 igfxdkc32.exe 37 PID 2272 wrote to memory of 2848 2272 igfxdkc32.exe 37 PID 2848 wrote to memory of 332 2848 igfxdkc32.exe 38 PID 2848 wrote to memory of 332 2848 igfxdkc32.exe 38 PID 2848 wrote to memory of 332 2848 igfxdkc32.exe 38 PID 2848 wrote to memory of 332 2848 igfxdkc32.exe 38 PID 332 wrote to memory of 2256 332 igfxdkc32.exe 39 PID 332 wrote to memory of 2256 332 igfxdkc32.exe 39 PID 332 wrote to memory of 2256 332 igfxdkc32.exe 39 PID 332 wrote to memory of 2256 332 igfxdkc32.exe 39 PID 2256 wrote to memory of 3068 2256 igfxdkc32.exe 40 PID 2256 wrote to memory of 3068 2256 igfxdkc32.exe 40 PID 2256 wrote to memory of 3068 2256 igfxdkc32.exe 40 PID 2256 wrote to memory of 3068 2256 igfxdkc32.exe 40 PID 3068 wrote to memory of 2412 3068 igfxdkc32.exe 41 PID 3068 wrote to memory of 2412 3068 igfxdkc32.exe 41 PID 3068 wrote to memory of 2412 3068 igfxdkc32.exe 41 PID 3068 wrote to memory of 2412 3068 igfxdkc32.exe 41 PID 2412 wrote to memory of 2520 2412 igfxdkc32.exe 42 PID 2412 wrote to memory of 2520 2412 igfxdkc32.exe 42 PID 2412 wrote to memory of 2520 2412 igfxdkc32.exe 42 PID 2412 wrote to memory of 2520 2412 igfxdkc32.exe 42 PID 2520 wrote to memory of 2964 2520 igfxdkc32.exe 43 PID 2520 wrote to memory of 2964 2520 igfxdkc32.exe 43 PID 2520 wrote to memory of 2964 2520 igfxdkc32.exe 43 PID 2520 wrote to memory of 2964 2520 igfxdkc32.exe 43 PID 2964 wrote to memory of 2768 2964 igfxdkc32.exe 44 PID 2964 wrote to memory of 2768 2964 igfxdkc32.exe 44 PID 2964 wrote to memory of 2768 2964 igfxdkc32.exe 44 PID 2964 wrote to memory of 2768 2964 igfxdkc32.exe 44 PID 2768 wrote to memory of 1612 2768 igfxdkc32.exe 45 PID 2768 wrote to memory of 1612 2768 igfxdkc32.exe 45 PID 2768 wrote to memory of 1612 2768 igfxdkc32.exe 45 PID 2768 wrote to memory of 1612 2768 igfxdkc32.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9e901e051f43ae7c83fee5b52122ab1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e9e901e051f43ae7c83fee5b52122ab1_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Users\Admin\AppData\Local\Temp\E9E901~1.EXE2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE4⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE5⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE9⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE11⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE13⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE14⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE15⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE17⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1612 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2468 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE19⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2460 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:860 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE21⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1660 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2780 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE23⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2752 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE24⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2576 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE25⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2544 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE26⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2916 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE27⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2888 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2364 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE29⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2344 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE30⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2724 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE31⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:576 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE32⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2352 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE33⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2372 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE34⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2100 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE35⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2096 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE36⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2144 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE37⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1292 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE38⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1540 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE39⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:948 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE40⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1268 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE41⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2316 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE42⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:308 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE43⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1836 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE44⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1272 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE45⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:2676 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE46⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1020 -
C:\Windows\SysWOW64\igfxdkc32.exe"C:\Windows\system32\igfxdkc32.exe" C:\Windows\SysWOW64\IGFXDK~1.EXE47⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:2812
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
199KB
MD5e9e901e051f43ae7c83fee5b52122ab1
SHA1b22b7f00d518cbe3dd67ebb3cbd2cfa1bba50594
SHA256e9c83989dbb6401dd387267f388c63d2ade2dade618a36272cd7d6ec8223bc93
SHA51208362dcf1b2a6daa927b86f3def058470520bcc910891145d43572bb72b7aa852f1a2c988596831d8f1a967378e2044fc32af4392c4ab5be4430d7f080d39eaf