Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 18:42
Behavioral task
behavioral1
Sample
f06be3b64c821532398808707c021706_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
General
-
Target
f06be3b64c821532398808707c021706_JaffaCakes118.exe
-
Size
199KB
-
MD5
f06be3b64c821532398808707c021706
-
SHA1
0c98a1d3bb270a93ddbd881f184201f54ec88e5b
-
SHA256
a2a3de0abe80a878339ece99f1a2d60f47010c8123aa038d1f0337c9e99ab092
-
SHA512
7d66b326cc1f665dcfb46ac68240d0470b62abec4e7da921c48093c62f0219a67bc42c0eab5c65335fe6cecca1acafd3cd84359b0664e953405ccdc105b5260f
-
SSDEEP
6144:iexr1w8DvTfxBqUiTljE8EaX0KAQY2g6:ie3bJyj37Y2g6
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Deletes itself 1 IoCs
pid Process 2212 igfxtsk32.exe -
Executes dropped EXE 31 IoCs
pid Process 2212 igfxtsk32.exe 2648 igfxtsk32.exe 1072 igfxtsk32.exe 2524 igfxtsk32.exe 2984 igfxtsk32.exe 2644 igfxtsk32.exe 1268 igfxtsk32.exe 1688 igfxtsk32.exe 972 igfxtsk32.exe 2444 igfxtsk32.exe 1588 igfxtsk32.exe 2536 igfxtsk32.exe 2080 igfxtsk32.exe 1656 igfxtsk32.exe 236 igfxtsk32.exe 2180 igfxtsk32.exe 888 igfxtsk32.exe 1632 igfxtsk32.exe 2792 igfxtsk32.exe 2592 igfxtsk32.exe 2068 igfxtsk32.exe 1008 igfxtsk32.exe 2368 igfxtsk32.exe 2860 igfxtsk32.exe 2940 igfxtsk32.exe 2868 igfxtsk32.exe 3056 igfxtsk32.exe 2980 igfxtsk32.exe 1244 igfxtsk32.exe 1956 igfxtsk32.exe 2432 igfxtsk32.exe -
Loads dropped DLL 62 IoCs
pid Process 2792 f06be3b64c821532398808707c021706_JaffaCakes118.exe 2792 f06be3b64c821532398808707c021706_JaffaCakes118.exe 2212 igfxtsk32.exe 2212 igfxtsk32.exe 2648 igfxtsk32.exe 2648 igfxtsk32.exe 1072 igfxtsk32.exe 1072 igfxtsk32.exe 2524 igfxtsk32.exe 2524 igfxtsk32.exe 2984 igfxtsk32.exe 2984 igfxtsk32.exe 2644 igfxtsk32.exe 2644 igfxtsk32.exe 1268 igfxtsk32.exe 1268 igfxtsk32.exe 1688 igfxtsk32.exe 1688 igfxtsk32.exe 972 igfxtsk32.exe 972 igfxtsk32.exe 2444 igfxtsk32.exe 2444 igfxtsk32.exe 1588 igfxtsk32.exe 1588 igfxtsk32.exe 2536 igfxtsk32.exe 2536 igfxtsk32.exe 2080 igfxtsk32.exe 2080 igfxtsk32.exe 1656 igfxtsk32.exe 1656 igfxtsk32.exe 236 igfxtsk32.exe 236 igfxtsk32.exe 2180 igfxtsk32.exe 2180 igfxtsk32.exe 888 igfxtsk32.exe 888 igfxtsk32.exe 1632 igfxtsk32.exe 1632 igfxtsk32.exe 2792 igfxtsk32.exe 2792 igfxtsk32.exe 2592 igfxtsk32.exe 2592 igfxtsk32.exe 2068 igfxtsk32.exe 2068 igfxtsk32.exe 1008 igfxtsk32.exe 1008 igfxtsk32.exe 2368 igfxtsk32.exe 2368 igfxtsk32.exe 2860 igfxtsk32.exe 2860 igfxtsk32.exe 2940 igfxtsk32.exe 2940 igfxtsk32.exe 2868 igfxtsk32.exe 2868 igfxtsk32.exe 3056 igfxtsk32.exe 3056 igfxtsk32.exe 2980 igfxtsk32.exe 2980 igfxtsk32.exe 1244 igfxtsk32.exe 1244 igfxtsk32.exe 1956 igfxtsk32.exe 1956 igfxtsk32.exe -
resource yara_rule behavioral1/memory/2792-0-0x0000000000400000-0x000000000074F000-memory.dmp upx behavioral1/files/0x00090000000120f6-5.dat upx behavioral1/memory/2792-11-0x0000000004DE0000-0x000000000512F000-memory.dmp upx behavioral1/memory/1268-57-0x0000000000400000-0x000000000074F000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 f06be3b64c821532398808707c021706_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum f06be3b64c821532398808707c021706_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtsk32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File created C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File created C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsk32.exe File created C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File created C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsk32.exe File created C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsk32.exe File created C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File created C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File created C:\Windows\SysWOW64\igfxtsk32.exe f06be3b64c821532398808707c021706_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsk32.exe File created C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File created C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File created C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File created C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File created C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File created C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsk32.exe File created C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File created C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File created C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File created C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File created C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsk32.exe File created C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\ igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File created C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe File opened for modification C:\Windows\SysWOW64\igfxtsk32.exe igfxtsk32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 32 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f06be3b64c821532398808707c021706_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtsk32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2792 f06be3b64c821532398808707c021706_JaffaCakes118.exe 2792 f06be3b64c821532398808707c021706_JaffaCakes118.exe 2212 igfxtsk32.exe 2212 igfxtsk32.exe 2648 igfxtsk32.exe 2648 igfxtsk32.exe 1072 igfxtsk32.exe 1072 igfxtsk32.exe 2524 igfxtsk32.exe 2524 igfxtsk32.exe 2984 igfxtsk32.exe 2984 igfxtsk32.exe 2644 igfxtsk32.exe 2644 igfxtsk32.exe 1268 igfxtsk32.exe 1268 igfxtsk32.exe 1688 igfxtsk32.exe 1688 igfxtsk32.exe 972 igfxtsk32.exe 972 igfxtsk32.exe 2444 igfxtsk32.exe 2444 igfxtsk32.exe 1588 igfxtsk32.exe 1588 igfxtsk32.exe 2536 igfxtsk32.exe 2536 igfxtsk32.exe 2080 igfxtsk32.exe 2080 igfxtsk32.exe 1656 igfxtsk32.exe 1656 igfxtsk32.exe 236 igfxtsk32.exe 236 igfxtsk32.exe 2180 igfxtsk32.exe 2180 igfxtsk32.exe 888 igfxtsk32.exe 888 igfxtsk32.exe 1632 igfxtsk32.exe 1632 igfxtsk32.exe 2792 igfxtsk32.exe 2792 igfxtsk32.exe 2592 igfxtsk32.exe 2592 igfxtsk32.exe 2068 igfxtsk32.exe 2068 igfxtsk32.exe 1008 igfxtsk32.exe 1008 igfxtsk32.exe 2368 igfxtsk32.exe 2368 igfxtsk32.exe 2860 igfxtsk32.exe 2860 igfxtsk32.exe 2940 igfxtsk32.exe 2940 igfxtsk32.exe 2868 igfxtsk32.exe 2868 igfxtsk32.exe 3056 igfxtsk32.exe 3056 igfxtsk32.exe 2980 igfxtsk32.exe 2980 igfxtsk32.exe 1244 igfxtsk32.exe 1244 igfxtsk32.exe 1956 igfxtsk32.exe 1956 igfxtsk32.exe 2432 igfxtsk32.exe 2432 igfxtsk32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2792 wrote to memory of 2212 2792 f06be3b64c821532398808707c021706_JaffaCakes118.exe 30 PID 2792 wrote to memory of 2212 2792 f06be3b64c821532398808707c021706_JaffaCakes118.exe 30 PID 2792 wrote to memory of 2212 2792 f06be3b64c821532398808707c021706_JaffaCakes118.exe 30 PID 2792 wrote to memory of 2212 2792 f06be3b64c821532398808707c021706_JaffaCakes118.exe 30 PID 2212 wrote to memory of 2648 2212 igfxtsk32.exe 31 PID 2212 wrote to memory of 2648 2212 igfxtsk32.exe 31 PID 2212 wrote to memory of 2648 2212 igfxtsk32.exe 31 PID 2212 wrote to memory of 2648 2212 igfxtsk32.exe 31 PID 2648 wrote to memory of 1072 2648 igfxtsk32.exe 32 PID 2648 wrote to memory of 1072 2648 igfxtsk32.exe 32 PID 2648 wrote to memory of 1072 2648 igfxtsk32.exe 32 PID 2648 wrote to memory of 1072 2648 igfxtsk32.exe 32 PID 1072 wrote to memory of 2524 1072 igfxtsk32.exe 33 PID 1072 wrote to memory of 2524 1072 igfxtsk32.exe 33 PID 1072 wrote to memory of 2524 1072 igfxtsk32.exe 33 PID 1072 wrote to memory of 2524 1072 igfxtsk32.exe 33 PID 2524 wrote to memory of 2984 2524 igfxtsk32.exe 34 PID 2524 wrote to memory of 2984 2524 igfxtsk32.exe 34 PID 2524 wrote to memory of 2984 2524 igfxtsk32.exe 34 PID 2524 wrote to memory of 2984 2524 igfxtsk32.exe 34 PID 2984 wrote to memory of 2644 2984 igfxtsk32.exe 36 PID 2984 wrote to memory of 2644 2984 igfxtsk32.exe 36 PID 2984 wrote to memory of 2644 2984 igfxtsk32.exe 36 PID 2984 wrote to memory of 2644 2984 igfxtsk32.exe 36 PID 2644 wrote to memory of 1268 2644 igfxtsk32.exe 37 PID 2644 wrote to memory of 1268 2644 igfxtsk32.exe 37 PID 2644 wrote to memory of 1268 2644 igfxtsk32.exe 37 PID 2644 wrote to memory of 1268 2644 igfxtsk32.exe 37 PID 1268 wrote to memory of 1688 1268 igfxtsk32.exe 38 PID 1268 wrote to memory of 1688 1268 igfxtsk32.exe 38 PID 1268 wrote to memory of 1688 1268 igfxtsk32.exe 38 PID 1268 wrote to memory of 1688 1268 igfxtsk32.exe 38 PID 1688 wrote to memory of 972 1688 igfxtsk32.exe 39 PID 1688 wrote to memory of 972 1688 igfxtsk32.exe 39 PID 1688 wrote to memory of 972 1688 igfxtsk32.exe 39 PID 1688 wrote to memory of 972 1688 igfxtsk32.exe 39 PID 972 wrote to memory of 2444 972 igfxtsk32.exe 40 PID 972 wrote to memory of 2444 972 igfxtsk32.exe 40 PID 972 wrote to memory of 2444 972 igfxtsk32.exe 40 PID 972 wrote to memory of 2444 972 igfxtsk32.exe 40 PID 2444 wrote to memory of 1588 2444 igfxtsk32.exe 41 PID 2444 wrote to memory of 1588 2444 igfxtsk32.exe 41 PID 2444 wrote to memory of 1588 2444 igfxtsk32.exe 41 PID 2444 wrote to memory of 1588 2444 igfxtsk32.exe 41 PID 1588 wrote to memory of 2536 1588 igfxtsk32.exe 42 PID 1588 wrote to memory of 2536 1588 igfxtsk32.exe 42 PID 1588 wrote to memory of 2536 1588 igfxtsk32.exe 42 PID 1588 wrote to memory of 2536 1588 igfxtsk32.exe 42 PID 2536 wrote to memory of 2080 2536 igfxtsk32.exe 43 PID 2536 wrote to memory of 2080 2536 igfxtsk32.exe 43 PID 2536 wrote to memory of 2080 2536 igfxtsk32.exe 43 PID 2536 wrote to memory of 2080 2536 igfxtsk32.exe 43 PID 2080 wrote to memory of 1656 2080 igfxtsk32.exe 44 PID 2080 wrote to memory of 1656 2080 igfxtsk32.exe 44 PID 2080 wrote to memory of 1656 2080 igfxtsk32.exe 44 PID 2080 wrote to memory of 1656 2080 igfxtsk32.exe 44 PID 1656 wrote to memory of 236 1656 igfxtsk32.exe 45 PID 1656 wrote to memory of 236 1656 igfxtsk32.exe 45 PID 1656 wrote to memory of 236 1656 igfxtsk32.exe 45 PID 1656 wrote to memory of 236 1656 igfxtsk32.exe 45 PID 236 wrote to memory of 2180 236 igfxtsk32.exe 46 PID 236 wrote to memory of 2180 236 igfxtsk32.exe 46 PID 236 wrote to memory of 2180 236 igfxtsk32.exe 46 PID 236 wrote to memory of 2180 236 igfxtsk32.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\f06be3b64c821532398808707c021706_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f06be3b64c821532398808707c021706_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Users\Admin\AppData\Local\Temp\F06BE3~1.EXE2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE4⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE5⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE9⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE11⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE13⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE14⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE15⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE17⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2180 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:888 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE19⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1632 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2792 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE21⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2592 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2068 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE23⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1008 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE24⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2368 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE25⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2860 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE26⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2940 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE27⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2868 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3056 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE29⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2980 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE30⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1244 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE31⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1956 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE32⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2432 -
C:\Windows\SysWOW64\igfxtsk32.exe"C:\Windows\system32\igfxtsk32.exe" C:\Windows\SysWOW64\IGFXTS~1.EXE33⤵PID:2164
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
199KB
MD5f06be3b64c821532398808707c021706
SHA10c98a1d3bb270a93ddbd881f184201f54ec88e5b
SHA256a2a3de0abe80a878339ece99f1a2d60f47010c8123aa038d1f0337c9e99ab092
SHA5127d66b326cc1f665dcfb46ac68240d0470b62abec4e7da921c48093c62f0219a67bc42c0eab5c65335fe6cecca1acafd3cd84359b0664e953405ccdc105b5260f