Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
20-09-2024 10:48
Behavioral task
behavioral1
Sample
ed6b9ceb36bc1bdf99bf64be338f127c_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
ed6b9ceb36bc1bdf99bf64be338f127c_JaffaCakes118.exe
-
Size
199KB
-
MD5
ed6b9ceb36bc1bdf99bf64be338f127c
-
SHA1
c55a1919aade8de8177b2f13ce4a7f346d151324
-
SHA256
d1e8a293ec69c7850f50235a9033edcca1fd99a1a2a104585b218390cb77fa8b
-
SHA512
f8b03d675b27140abe58128d39448a7865a967cb45ea211aae4f174543276c89bd6fe6d93c4ff8215ce42239d67a2a7b8a94fcfaecb2915348dd7b470e54cdd9
-
SSDEEP
6144:vKOWDArkO1K8s6gEOFzjF5JfsDgrR0fVEJ:vZWDArN1uoOBlsDtEJ
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Deletes itself 1 IoCs
pid Process 2784 igfxdp32.exe -
Executes dropped EXE 63 IoCs
pid Process 2784 igfxdp32.exe 2692 igfxdp32.exe 2632 igfxdp32.exe 1376 igfxdp32.exe 1488 igfxdp32.exe 2444 igfxdp32.exe 2876 igfxdp32.exe 2652 igfxdp32.exe 320 igfxdp32.exe 1948 igfxdp32.exe 2216 igfxdp32.exe 584 igfxdp32.exe 1364 igfxdp32.exe 828 igfxdp32.exe 2124 igfxdp32.exe 2020 igfxdp32.exe 1956 igfxdp32.exe 2440 igfxdp32.exe 1748 igfxdp32.exe 1696 igfxdp32.exe 1672 igfxdp32.exe 2704 igfxdp32.exe 2816 igfxdp32.exe 2784 igfxdp32.exe 2600 igfxdp32.exe 1128 igfxdp32.exe 1212 igfxdp32.exe 2848 igfxdp32.exe 1488 igfxdp32.exe 2812 igfxdp32.exe 2084 igfxdp32.exe 1912 igfxdp32.exe 484 igfxdp32.exe 2120 igfxdp32.exe 2344 igfxdp32.exe 352 igfxdp32.exe 940 igfxdp32.exe 2972 igfxdp32.exe 1752 igfxdp32.exe 1508 igfxdp32.exe 840 igfxdp32.exe 2896 igfxdp32.exe 1676 igfxdp32.exe 1764 igfxdp32.exe 1916 igfxdp32.exe 1696 igfxdp32.exe 2684 igfxdp32.exe 2700 igfxdp32.exe 2772 igfxdp32.exe 2588 igfxdp32.exe 1004 igfxdp32.exe 3048 igfxdp32.exe 1932 igfxdp32.exe 1428 igfxdp32.exe 1964 igfxdp32.exe 1804 igfxdp32.exe 768 igfxdp32.exe 1660 igfxdp32.exe 2304 igfxdp32.exe 2064 igfxdp32.exe 1316 igfxdp32.exe 2056 igfxdp32.exe 296 igfxdp32.exe -
Loads dropped DLL 64 IoCs
pid Process 3056 ed6b9ceb36bc1bdf99bf64be338f127c_JaffaCakes118.exe 3056 ed6b9ceb36bc1bdf99bf64be338f127c_JaffaCakes118.exe 2784 igfxdp32.exe 2784 igfxdp32.exe 2692 igfxdp32.exe 2692 igfxdp32.exe 2632 igfxdp32.exe 2632 igfxdp32.exe 1376 igfxdp32.exe 1376 igfxdp32.exe 1488 igfxdp32.exe 1488 igfxdp32.exe 2444 igfxdp32.exe 2444 igfxdp32.exe 2876 igfxdp32.exe 2876 igfxdp32.exe 2652 igfxdp32.exe 2652 igfxdp32.exe 320 igfxdp32.exe 320 igfxdp32.exe 1948 igfxdp32.exe 1948 igfxdp32.exe 2216 igfxdp32.exe 2216 igfxdp32.exe 584 igfxdp32.exe 584 igfxdp32.exe 1364 igfxdp32.exe 1364 igfxdp32.exe 828 igfxdp32.exe 828 igfxdp32.exe 2124 igfxdp32.exe 2124 igfxdp32.exe 2020 igfxdp32.exe 2020 igfxdp32.exe 1956 igfxdp32.exe 1956 igfxdp32.exe 2440 igfxdp32.exe 2440 igfxdp32.exe 1748 igfxdp32.exe 1748 igfxdp32.exe 1696 igfxdp32.exe 1696 igfxdp32.exe 1672 igfxdp32.exe 1672 igfxdp32.exe 2704 igfxdp32.exe 2704 igfxdp32.exe 2816 igfxdp32.exe 2816 igfxdp32.exe 2784 igfxdp32.exe 2784 igfxdp32.exe 2600 igfxdp32.exe 2600 igfxdp32.exe 1128 igfxdp32.exe 1128 igfxdp32.exe 1212 igfxdp32.exe 1212 igfxdp32.exe 2848 igfxdp32.exe 2848 igfxdp32.exe 1488 igfxdp32.exe 1488 igfxdp32.exe 2812 igfxdp32.exe 2812 igfxdp32.exe 2084 igfxdp32.exe 2084 igfxdp32.exe -
resource yara_rule behavioral1/files/0x000f000000011b9d-13.dat upx behavioral1/memory/3056-0-0x0000000000400000-0x0000000000482000-memory.dmp upx behavioral1/memory/2692-23-0x0000000000400000-0x0000000000482000-memory.dmp upx behavioral1/memory/584-86-0x0000000000400000-0x0000000000482000-memory.dmp upx behavioral1/memory/1364-92-0x0000000000400000-0x0000000000482000-memory.dmp upx behavioral1/memory/828-96-0x0000000000400000-0x0000000000482000-memory.dmp upx behavioral1/memory/2704-122-0x0000000000400000-0x0000000000482000-memory.dmp upx behavioral1/memory/1128-133-0x0000000000400000-0x0000000000482000-memory.dmp upx behavioral1/memory/1212-135-0x0000000000400000-0x0000000000482000-memory.dmp upx behavioral1/memory/484-155-0x0000000004B10000-0x0000000004B92000-memory.dmp upx behavioral1/memory/2120-157-0x0000000000400000-0x0000000000482000-memory.dmp upx behavioral1/memory/2344-162-0x0000000000400000-0x0000000000482000-memory.dmp upx behavioral1/memory/940-169-0x0000000000400000-0x0000000000482000-memory.dmp upx behavioral1/memory/1752-175-0x0000000000400000-0x0000000000482000-memory.dmp upx behavioral1/memory/2896-182-0x0000000000400000-0x0000000000482000-memory.dmp upx behavioral1/memory/1676-188-0x00000000031C0000-0x0000000003242000-memory.dmp upx behavioral1/memory/1696-196-0x0000000000400000-0x0000000000482000-memory.dmp upx behavioral1/memory/2588-205-0x0000000000400000-0x0000000000482000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdp32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File created C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\ igfxdp32.exe File opened for modification C:\Windows\SysWOW64\ igfxdp32.exe File opened for modification C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File created C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\ igfxdp32.exe File opened for modification C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File created C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\ igfxdp32.exe File opened for modification C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\ igfxdp32.exe File created C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File created C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\ igfxdp32.exe File created C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File created C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File created C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\ igfxdp32.exe File opened for modification C:\Windows\SysWOW64\ igfxdp32.exe File created C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\ igfxdp32.exe File opened for modification C:\Windows\SysWOW64\ igfxdp32.exe File opened for modification C:\Windows\SysWOW64\ igfxdp32.exe File created C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File created C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\ igfxdp32.exe File created C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\ igfxdp32.exe File created C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\ igfxdp32.exe File created C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\ igfxdp32.exe File created C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File created C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\ igfxdp32.exe File created C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File created C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\ igfxdp32.exe File opened for modification C:\Windows\SysWOW64\ igfxdp32.exe File opened for modification C:\Windows\SysWOW64\igfxdp32.exe ed6b9ceb36bc1bdf99bf64be338f127c_JaffaCakes118.exe File created C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\ igfxdp32.exe File created C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File opened for modification C:\Windows\SysWOW64\ igfxdp32.exe File opened for modification C:\Windows\SysWOW64\ igfxdp32.exe File created C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe File created C:\Windows\SysWOW64\igfxdp32.exe igfxdp32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ed6b9ceb36bc1bdf99bf64be338f127c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdp32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3056 ed6b9ceb36bc1bdf99bf64be338f127c_JaffaCakes118.exe 3056 ed6b9ceb36bc1bdf99bf64be338f127c_JaffaCakes118.exe 2784 igfxdp32.exe 2784 igfxdp32.exe 2692 igfxdp32.exe 2692 igfxdp32.exe 2632 igfxdp32.exe 2632 igfxdp32.exe 1376 igfxdp32.exe 1376 igfxdp32.exe 1488 igfxdp32.exe 1488 igfxdp32.exe 2444 igfxdp32.exe 2444 igfxdp32.exe 2876 igfxdp32.exe 2876 igfxdp32.exe 2652 igfxdp32.exe 2652 igfxdp32.exe 320 igfxdp32.exe 320 igfxdp32.exe 1948 igfxdp32.exe 1948 igfxdp32.exe 2216 igfxdp32.exe 2216 igfxdp32.exe 584 igfxdp32.exe 584 igfxdp32.exe 1364 igfxdp32.exe 1364 igfxdp32.exe 828 igfxdp32.exe 828 igfxdp32.exe 2124 igfxdp32.exe 2124 igfxdp32.exe 2020 igfxdp32.exe 2020 igfxdp32.exe 1956 igfxdp32.exe 1956 igfxdp32.exe 2440 igfxdp32.exe 2440 igfxdp32.exe 1748 igfxdp32.exe 1748 igfxdp32.exe 1696 igfxdp32.exe 1696 igfxdp32.exe 1672 igfxdp32.exe 1672 igfxdp32.exe 2704 igfxdp32.exe 2704 igfxdp32.exe 2816 igfxdp32.exe 2816 igfxdp32.exe 2784 igfxdp32.exe 2784 igfxdp32.exe 2600 igfxdp32.exe 2600 igfxdp32.exe 1128 igfxdp32.exe 1128 igfxdp32.exe 1212 igfxdp32.exe 1212 igfxdp32.exe 2848 igfxdp32.exe 2848 igfxdp32.exe 1488 igfxdp32.exe 1488 igfxdp32.exe 2812 igfxdp32.exe 2812 igfxdp32.exe 2084 igfxdp32.exe 2084 igfxdp32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2784 3056 ed6b9ceb36bc1bdf99bf64be338f127c_JaffaCakes118.exe 30 PID 3056 wrote to memory of 2784 3056 ed6b9ceb36bc1bdf99bf64be338f127c_JaffaCakes118.exe 30 PID 3056 wrote to memory of 2784 3056 ed6b9ceb36bc1bdf99bf64be338f127c_JaffaCakes118.exe 30 PID 3056 wrote to memory of 2784 3056 ed6b9ceb36bc1bdf99bf64be338f127c_JaffaCakes118.exe 30 PID 2784 wrote to memory of 2692 2784 igfxdp32.exe 31 PID 2784 wrote to memory of 2692 2784 igfxdp32.exe 31 PID 2784 wrote to memory of 2692 2784 igfxdp32.exe 31 PID 2784 wrote to memory of 2692 2784 igfxdp32.exe 31 PID 2692 wrote to memory of 2632 2692 igfxdp32.exe 32 PID 2692 wrote to memory of 2632 2692 igfxdp32.exe 32 PID 2692 wrote to memory of 2632 2692 igfxdp32.exe 32 PID 2692 wrote to memory of 2632 2692 igfxdp32.exe 32 PID 2632 wrote to memory of 1376 2632 igfxdp32.exe 33 PID 2632 wrote to memory of 1376 2632 igfxdp32.exe 33 PID 2632 wrote to memory of 1376 2632 igfxdp32.exe 33 PID 2632 wrote to memory of 1376 2632 igfxdp32.exe 33 PID 1376 wrote to memory of 1488 1376 igfxdp32.exe 34 PID 1376 wrote to memory of 1488 1376 igfxdp32.exe 34 PID 1376 wrote to memory of 1488 1376 igfxdp32.exe 34 PID 1376 wrote to memory of 1488 1376 igfxdp32.exe 34 PID 1488 wrote to memory of 2444 1488 igfxdp32.exe 35 PID 1488 wrote to memory of 2444 1488 igfxdp32.exe 35 PID 1488 wrote to memory of 2444 1488 igfxdp32.exe 35 PID 1488 wrote to memory of 2444 1488 igfxdp32.exe 35 PID 2444 wrote to memory of 2876 2444 igfxdp32.exe 36 PID 2444 wrote to memory of 2876 2444 igfxdp32.exe 36 PID 2444 wrote to memory of 2876 2444 igfxdp32.exe 36 PID 2444 wrote to memory of 2876 2444 igfxdp32.exe 36 PID 2876 wrote to memory of 2652 2876 igfxdp32.exe 37 PID 2876 wrote to memory of 2652 2876 igfxdp32.exe 37 PID 2876 wrote to memory of 2652 2876 igfxdp32.exe 37 PID 2876 wrote to memory of 2652 2876 igfxdp32.exe 37 PID 2652 wrote to memory of 320 2652 igfxdp32.exe 38 PID 2652 wrote to memory of 320 2652 igfxdp32.exe 38 PID 2652 wrote to memory of 320 2652 igfxdp32.exe 38 PID 2652 wrote to memory of 320 2652 igfxdp32.exe 38 PID 320 wrote to memory of 1948 320 igfxdp32.exe 39 PID 320 wrote to memory of 1948 320 igfxdp32.exe 39 PID 320 wrote to memory of 1948 320 igfxdp32.exe 39 PID 320 wrote to memory of 1948 320 igfxdp32.exe 39 PID 1948 wrote to memory of 2216 1948 igfxdp32.exe 40 PID 1948 wrote to memory of 2216 1948 igfxdp32.exe 40 PID 1948 wrote to memory of 2216 1948 igfxdp32.exe 40 PID 1948 wrote to memory of 2216 1948 igfxdp32.exe 40 PID 2216 wrote to memory of 584 2216 igfxdp32.exe 41 PID 2216 wrote to memory of 584 2216 igfxdp32.exe 41 PID 2216 wrote to memory of 584 2216 igfxdp32.exe 41 PID 2216 wrote to memory of 584 2216 igfxdp32.exe 41 PID 584 wrote to memory of 1364 584 igfxdp32.exe 42 PID 584 wrote to memory of 1364 584 igfxdp32.exe 42 PID 584 wrote to memory of 1364 584 igfxdp32.exe 42 PID 584 wrote to memory of 1364 584 igfxdp32.exe 42 PID 1364 wrote to memory of 828 1364 igfxdp32.exe 43 PID 1364 wrote to memory of 828 1364 igfxdp32.exe 43 PID 1364 wrote to memory of 828 1364 igfxdp32.exe 43 PID 1364 wrote to memory of 828 1364 igfxdp32.exe 43 PID 828 wrote to memory of 2124 828 igfxdp32.exe 44 PID 828 wrote to memory of 2124 828 igfxdp32.exe 44 PID 828 wrote to memory of 2124 828 igfxdp32.exe 44 PID 828 wrote to memory of 2124 828 igfxdp32.exe 44 PID 2124 wrote to memory of 2020 2124 igfxdp32.exe 45 PID 2124 wrote to memory of 2020 2124 igfxdp32.exe 45 PID 2124 wrote to memory of 2020 2124 igfxdp32.exe 45 PID 2124 wrote to memory of 2020 2124 igfxdp32.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed6b9ceb36bc1bdf99bf64be338f127c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ed6b9ceb36bc1bdf99bf64be338f127c_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Users\Admin\AppData\Local\Temp\ED6B9C~1.EXE2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2020 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1956 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2440 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1748 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1696 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1672 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2704 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2816 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2784 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2600 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1128 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1212 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2848 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1488 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2812 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2084 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe33⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1912 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe34⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:484 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe35⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2120 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe36⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:2344 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe37⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:352 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe38⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:940 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe39⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2972 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe40⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1752 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1508 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:840 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe43⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:2896 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe44⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:1676 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe45⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1764 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe46⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1916 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe47⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1696 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe48⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:2684 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe49⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2700 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe50⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2772 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe51⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2588 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe52⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:1004 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe53⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3048 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1932 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1428 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1964 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1804 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:768 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe59⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1660 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2304 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe61⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:2064 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe62⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1316 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2056 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe64⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:296 -
C:\Windows\SysWOW64\igfxdp32.exe"C:\Windows\system32\igfxdp32.exe" C:\Windows\SysWOW64\igfxdp32.exe65⤵PID:3032
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
199KB
MD5ed6b9ceb36bc1bdf99bf64be338f127c
SHA1c55a1919aade8de8177b2f13ce4a7f346d151324
SHA256d1e8a293ec69c7850f50235a9033edcca1fd99a1a2a104585b218390cb77fa8b
SHA512f8b03d675b27140abe58128d39448a7865a967cb45ea211aae4f174543276c89bd6fe6d93c4ff8215ce42239d67a2a7b8a94fcfaecb2915348dd7b470e54cdd9