Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    20-09-2024 10:48

General

  • Target

    ed6b9ceb36bc1bdf99bf64be338f127c_JaffaCakes118.exe

  • Size

    199KB

  • MD5

    ed6b9ceb36bc1bdf99bf64be338f127c

  • SHA1

    c55a1919aade8de8177b2f13ce4a7f346d151324

  • SHA256

    d1e8a293ec69c7850f50235a9033edcca1fd99a1a2a104585b218390cb77fa8b

  • SHA512

    f8b03d675b27140abe58128d39448a7865a967cb45ea211aae4f174543276c89bd6fe6d93c4ff8215ce42239d67a2a7b8a94fcfaecb2915348dd7b470e54cdd9

  • SSDEEP

    6144:vKOWDArkO1K8s6gEOFzjF5JfsDgrR0fVEJ:vZWDArN1uoOBlsDtEJ

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 63 IoCs
  • Loads dropped DLL 64 IoCs
  • UPX packed file 18 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Maps connected drives based on registry 3 TTPs 64 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed6b9ceb36bc1bdf99bf64be338f127c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ed6b9ceb36bc1bdf99bf64be338f127c_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3056
    • C:\Windows\SysWOW64\igfxdp32.exe
      "C:\Windows\system32\igfxdp32.exe" C:\Users\Admin\AppData\Local\Temp\ED6B9C~1.EXE
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Loads dropped DLL
      • Maps connected drives based on registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2784
      • C:\Windows\SysWOW64\igfxdp32.exe
        "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2692
        • C:\Windows\SysWOW64\igfxdp32.exe
          "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Maps connected drives based on registry
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2632
          • C:\Windows\SysWOW64\igfxdp32.exe
            "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Maps connected drives based on registry
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1376
            • C:\Windows\SysWOW64\igfxdp32.exe
              "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Maps connected drives based on registry
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1488
              • C:\Windows\SysWOW64\igfxdp32.exe
                "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Maps connected drives based on registry
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2444
                • C:\Windows\SysWOW64\igfxdp32.exe
                  "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:2876
                  • C:\Windows\SysWOW64\igfxdp32.exe
                    "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:2652
                    • C:\Windows\SysWOW64\igfxdp32.exe
                      "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Maps connected drives based on registry
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:320
                      • C:\Windows\SysWOW64\igfxdp32.exe
                        "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Maps connected drives based on registry
                        • Drops file in System32 directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:1948
                        • C:\Windows\SysWOW64\igfxdp32.exe
                          "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Maps connected drives based on registry
                          • Drops file in System32 directory
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:2216
                          • C:\Windows\SysWOW64\igfxdp32.exe
                            "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Maps connected drives based on registry
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:584
                            • C:\Windows\SysWOW64\igfxdp32.exe
                              "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                              14⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Drops file in System32 directory
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:1364
                              • C:\Windows\SysWOW64\igfxdp32.exe
                                "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                15⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Maps connected drives based on registry
                                • Drops file in System32 directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:828
                                • C:\Windows\SysWOW64\igfxdp32.exe
                                  "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                  16⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Maps connected drives based on registry
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of WriteProcessMemory
                                  PID:2124
                                  • C:\Windows\SysWOW64\igfxdp32.exe
                                    "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                    17⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Maps connected drives based on registry
                                    • Drops file in System32 directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:2020
                                    • C:\Windows\SysWOW64\igfxdp32.exe
                                      "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                      18⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Maps connected drives based on registry
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1956
                                      • C:\Windows\SysWOW64\igfxdp32.exe
                                        "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                        19⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Maps connected drives based on registry
                                        • Drops file in System32 directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2440
                                        • C:\Windows\SysWOW64\igfxdp32.exe
                                          "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                          20⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Maps connected drives based on registry
                                          • Drops file in System32 directory
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:1748
                                          • C:\Windows\SysWOW64\igfxdp32.exe
                                            "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                            21⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Maps connected drives based on registry
                                            • Drops file in System32 directory
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:1696
                                            • C:\Windows\SysWOW64\igfxdp32.exe
                                              "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                              22⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:1672
                                              • C:\Windows\SysWOW64\igfxdp32.exe
                                                "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                23⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Maps connected drives based on registry
                                                • Drops file in System32 directory
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:2704
                                                • C:\Windows\SysWOW64\igfxdp32.exe
                                                  "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Drops file in System32 directory
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:2816
                                                  • C:\Windows\SysWOW64\igfxdp32.exe
                                                    "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Maps connected drives based on registry
                                                    • Drops file in System32 directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:2784
                                                    • C:\Windows\SysWOW64\igfxdp32.exe
                                                      "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Maps connected drives based on registry
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:2600
                                                      • C:\Windows\SysWOW64\igfxdp32.exe
                                                        "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Maps connected drives based on registry
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:1128
                                                        • C:\Windows\SysWOW64\igfxdp32.exe
                                                          "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                          28⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Maps connected drives based on registry
                                                          • Drops file in System32 directory
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:1212
                                                          • C:\Windows\SysWOW64\igfxdp32.exe
                                                            "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Maps connected drives based on registry
                                                            • Drops file in System32 directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:2848
                                                            • C:\Windows\SysWOW64\igfxdp32.exe
                                                              "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                              30⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Maps connected drives based on registry
                                                              • Drops file in System32 directory
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:1488
                                                              • C:\Windows\SysWOW64\igfxdp32.exe
                                                                "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Maps connected drives based on registry
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:2812
                                                                • C:\Windows\SysWOW64\igfxdp32.exe
                                                                  "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:2084
                                                                  • C:\Windows\SysWOW64\igfxdp32.exe
                                                                    "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Maps connected drives based on registry
                                                                    • Drops file in System32 directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:1912
                                                                    • C:\Windows\SysWOW64\igfxdp32.exe
                                                                      "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                      34⤵
                                                                      • Executes dropped EXE
                                                                      • Maps connected drives based on registry
                                                                      • Drops file in System32 directory
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:484
                                                                      • C:\Windows\SysWOW64\igfxdp32.exe
                                                                        "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Maps connected drives based on registry
                                                                        • Drops file in System32 directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:2120
                                                                        • C:\Windows\SysWOW64\igfxdp32.exe
                                                                          "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                          36⤵
                                                                          • Executes dropped EXE
                                                                          • Maps connected drives based on registry
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:2344
                                                                          • C:\Windows\SysWOW64\igfxdp32.exe
                                                                            "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Maps connected drives based on registry
                                                                            • Drops file in System32 directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:352
                                                                            • C:\Windows\SysWOW64\igfxdp32.exe
                                                                              "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                              38⤵
                                                                              • Executes dropped EXE
                                                                              • Maps connected drives based on registry
                                                                              • Drops file in System32 directory
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:940
                                                                              • C:\Windows\SysWOW64\igfxdp32.exe
                                                                                "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Maps connected drives based on registry
                                                                                • Drops file in System32 directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:2972
                                                                                • C:\Windows\SysWOW64\igfxdp32.exe
                                                                                  "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                                  40⤵
                                                                                  • Executes dropped EXE
                                                                                  • Maps connected drives based on registry
                                                                                  • Drops file in System32 directory
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:1752
                                                                                  • C:\Windows\SysWOW64\igfxdp32.exe
                                                                                    "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in System32 directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:1508
                                                                                    • C:\Windows\SysWOW64\igfxdp32.exe
                                                                                      "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                                      42⤵
                                                                                      • Executes dropped EXE
                                                                                      • Drops file in System32 directory
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:840
                                                                                      • C:\Windows\SysWOW64\igfxdp32.exe
                                                                                        "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Maps connected drives based on registry
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2896
                                                                                        • C:\Windows\SysWOW64\igfxdp32.exe
                                                                                          "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                                          44⤵
                                                                                          • Executes dropped EXE
                                                                                          • Maps connected drives based on registry
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:1676
                                                                                          • C:\Windows\SysWOW64\igfxdp32.exe
                                                                                            "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Maps connected drives based on registry
                                                                                            • Drops file in System32 directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:1764
                                                                                            • C:\Windows\SysWOW64\igfxdp32.exe
                                                                                              "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                                              46⤵
                                                                                              • Executes dropped EXE
                                                                                              • Maps connected drives based on registry
                                                                                              • Drops file in System32 directory
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:1916
                                                                                              • C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Maps connected drives based on registry
                                                                                                • Drops file in System32 directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:1696
                                                                                                • C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                  "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                  48⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Maps connected drives based on registry
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:2684
                                                                                                  • C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                    "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Maps connected drives based on registry
                                                                                                    • Drops file in System32 directory
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:2700
                                                                                                    • C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                      "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                      50⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Drops file in System32 directory
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:2772
                                                                                                      • C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                        "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Maps connected drives based on registry
                                                                                                        • Drops file in System32 directory
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:2588
                                                                                                        • C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                          "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                          52⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Maps connected drives based on registry
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:1004
                                                                                                          • C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                            "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Maps connected drives based on registry
                                                                                                            • Drops file in System32 directory
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:3048
                                                                                                            • C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                              "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                              54⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:1932
                                                                                                              • C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                                "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in System32 directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:1428
                                                                                                                • C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                                  "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                                  56⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:1964
                                                                                                                  • C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                                    "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:1804
                                                                                                                    • C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                                      "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                                      58⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:768
                                                                                                                      • C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                                        "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Maps connected drives based on registry
                                                                                                                        • Drops file in System32 directory
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:1660
                                                                                                                        • C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                                          "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                                          60⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Drops file in System32 directory
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:2304
                                                                                                                          • C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                                            "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Maps connected drives based on registry
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:2064
                                                                                                                            • C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                                              "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                                              62⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Maps connected drives based on registry
                                                                                                                              • Drops file in System32 directory
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:1316
                                                                                                                              • C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                                                "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in System32 directory
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:2056
                                                                                                                                • C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                                                  "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                                                  64⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Maps connected drives based on registry
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:296
                                                                                                                                  • C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                                                    "C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe
                                                                                                                                    65⤵
                                                                                                                                      PID:3032

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\igfxdp32.exe

      Filesize

      199KB

      MD5

      ed6b9ceb36bc1bdf99bf64be338f127c

      SHA1

      c55a1919aade8de8177b2f13ce4a7f346d151324

      SHA256

      d1e8a293ec69c7850f50235a9033edcca1fd99a1a2a104585b218390cb77fa8b

      SHA512

      f8b03d675b27140abe58128d39448a7865a967cb45ea211aae4f174543276c89bd6fe6d93c4ff8215ce42239d67a2a7b8a94fcfaecb2915348dd7b470e54cdd9

    • memory/320-71-0x00000000032D0000-0x0000000003352000-memory.dmp

      Filesize

      520KB

    • memory/320-73-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/320-67-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/352-168-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/352-166-0x00000000032B0000-0x0000000003332000-memory.dmp

      Filesize

      520KB

    • memory/484-159-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/484-155-0x0000000004B10000-0x0000000004B92000-memory.dmp

      Filesize

      520KB

    • memory/484-156-0x0000000004B10000-0x0000000004B92000-memory.dmp

      Filesize

      520KB

    • memory/584-91-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/584-86-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/828-96-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/828-103-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/840-184-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/940-171-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/940-169-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1004-209-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1128-137-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1128-133-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1212-135-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1212-139-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1364-98-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1364-92-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1376-42-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1376-39-0x0000000003350000-0x00000000033D2000-memory.dmp

      Filesize

      520KB

    • memory/1488-46-0x0000000003290000-0x0000000003312000-memory.dmp

      Filesize

      520KB

    • memory/1488-145-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1488-143-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1488-49-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1488-47-0x0000000003290000-0x0000000003312000-memory.dmp

      Filesize

      520KB

    • memory/1508-181-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1508-180-0x00000000033D0000-0x0000000003452000-memory.dmp

      Filesize

      520KB

    • memory/1672-124-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1676-190-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1676-187-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1676-188-0x00000000031C0000-0x0000000003242000-memory.dmp

      Filesize

      520KB

    • memory/1696-121-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1696-196-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1696-198-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1748-120-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1752-175-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1752-176-0x00000000031C0000-0x0000000003242000-memory.dmp

      Filesize

      520KB

    • memory/1752-178-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1764-192-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1912-154-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1916-195-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1916-193-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1948-79-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1956-116-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/1956-114-0x00000000032C0000-0x0000000003342000-memory.dmp

      Filesize

      520KB

    • memory/2020-113-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2084-150-0x00000000032E0000-0x0000000003362000-memory.dmp

      Filesize

      520KB

    • memory/2084-152-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2120-157-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2120-161-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2124-107-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2216-85-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2216-82-0x0000000003460000-0x00000000034E2000-memory.dmp

      Filesize

      520KB

    • memory/2344-162-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2344-163-0x00000000033A0000-0x0000000003422000-memory.dmp

      Filesize

      520KB

    • memory/2344-165-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2440-118-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2444-55-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2588-207-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2588-205-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2600-134-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2632-30-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2632-35-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2632-33-0x0000000003610000-0x0000000003692000-memory.dmp

      Filesize

      520KB

    • memory/2652-66-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2684-200-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2692-23-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2692-29-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2700-202-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2704-122-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2704-126-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2772-204-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2784-131-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2784-21-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2784-16-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2812-147-0x00000000034C0000-0x0000000003542000-memory.dmp

      Filesize

      520KB

    • memory/2812-146-0x00000000034C0000-0x0000000003542000-memory.dmp

      Filesize

      520KB

    • memory/2812-149-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2816-127-0x00000000032A0000-0x0000000003322000-memory.dmp

      Filesize

      520KB

    • memory/2816-129-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2848-142-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2848-141-0x0000000003320000-0x00000000033A2000-memory.dmp

      Filesize

      520KB

    • memory/2876-58-0x0000000004A70000-0x0000000004AF2000-memory.dmp

      Filesize

      520KB

    • memory/2876-60-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2896-186-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2896-182-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2972-172-0x00000000032A0000-0x0000000003322000-memory.dmp

      Filesize

      520KB

    • memory/2972-174-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3056-12-0x0000000003680000-0x0000000003702000-memory.dmp

      Filesize

      520KB

    • memory/3056-2-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3056-1-0x0000000000250000-0x0000000000252000-memory.dmp

      Filesize

      8KB

    • memory/3056-0-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3056-15-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.