Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-09-2024 00:59
Static task
static1
Behavioral task
behavioral1
Sample
f0f79ce9732c138fd3c0a0b87a15c959_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f0f79ce9732c138fd3c0a0b87a15c959_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f0f79ce9732c138fd3c0a0b87a15c959_JaffaCakes118.exe
-
Size
269KB
-
MD5
f0f79ce9732c138fd3c0a0b87a15c959
-
SHA1
843da60e763e41adcf29b11015750a2ebe61d4d0
-
SHA256
9b0b5463072d7e88c879bd7f07821a0ef5c2befff9ee06d81e2f4e33a6de63f8
-
SHA512
f3eb88c146e3cfe55aa5be5bcd10aab8d656a0250f0ee47cf86a47b3d08b64fb5351c4fcffb589c79cb8cdeec57a92bc564af6b9c7240007e27b61f831b0ac92
-
SSDEEP
6144:F/wZGRTexiv5qo3m04QNr4haGhhjZeib:F2imJhaQb
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Deletes itself 1 IoCs
pid Process 2852 igfxpt32.exe -
Executes dropped EXE 41 IoCs
pid Process 2852 igfxpt32.exe 2768 igfxpt32.exe 2716 igfxpt32.exe 2604 igfxpt32.exe 1656 igfxpt32.exe 2196 igfxpt32.exe 2896 igfxpt32.exe 2040 igfxpt32.exe 2908 igfxpt32.exe 1692 igfxpt32.exe 2132 igfxpt32.exe 2168 igfxpt32.exe 3012 igfxpt32.exe 3028 igfxpt32.exe 1052 igfxpt32.exe 1768 igfxpt32.exe 392 igfxpt32.exe 1108 igfxpt32.exe 236 igfxpt32.exe 2212 igfxpt32.exe 1696 igfxpt32.exe 2160 igfxpt32.exe 2688 igfxpt32.exe 2972 igfxpt32.exe 2596 igfxpt32.exe 2648 igfxpt32.exe 1576 igfxpt32.exe 3048 igfxpt32.exe 2952 igfxpt32.exe 2920 igfxpt32.exe 2284 igfxpt32.exe 1540 igfxpt32.exe 1780 igfxpt32.exe 1964 igfxpt32.exe 1716 igfxpt32.exe 2060 igfxpt32.exe 1960 igfxpt32.exe 1096 igfxpt32.exe 696 igfxpt32.exe 776 igfxpt32.exe 1264 igfxpt32.exe -
Loads dropped DLL 64 IoCs
pid Process 2252 f0f79ce9732c138fd3c0a0b87a15c959_JaffaCakes118.exe 2252 f0f79ce9732c138fd3c0a0b87a15c959_JaffaCakes118.exe 2852 igfxpt32.exe 2852 igfxpt32.exe 2768 igfxpt32.exe 2768 igfxpt32.exe 2716 igfxpt32.exe 2716 igfxpt32.exe 2604 igfxpt32.exe 2604 igfxpt32.exe 1656 igfxpt32.exe 1656 igfxpt32.exe 2196 igfxpt32.exe 2196 igfxpt32.exe 2896 igfxpt32.exe 2896 igfxpt32.exe 2040 igfxpt32.exe 2040 igfxpt32.exe 2908 igfxpt32.exe 2908 igfxpt32.exe 1692 igfxpt32.exe 1692 igfxpt32.exe 2132 igfxpt32.exe 2132 igfxpt32.exe 2168 igfxpt32.exe 2168 igfxpt32.exe 3012 igfxpt32.exe 3012 igfxpt32.exe 3028 igfxpt32.exe 3028 igfxpt32.exe 1052 igfxpt32.exe 1052 igfxpt32.exe 1768 igfxpt32.exe 1768 igfxpt32.exe 392 igfxpt32.exe 392 igfxpt32.exe 1108 igfxpt32.exe 1108 igfxpt32.exe 236 igfxpt32.exe 236 igfxpt32.exe 2212 igfxpt32.exe 2212 igfxpt32.exe 1696 igfxpt32.exe 1696 igfxpt32.exe 2160 igfxpt32.exe 2160 igfxpt32.exe 2688 igfxpt32.exe 2688 igfxpt32.exe 2972 igfxpt32.exe 2972 igfxpt32.exe 2596 igfxpt32.exe 2596 igfxpt32.exe 2648 igfxpt32.exe 2648 igfxpt32.exe 1576 igfxpt32.exe 1576 igfxpt32.exe 3048 igfxpt32.exe 3048 igfxpt32.exe 2952 igfxpt32.exe 2952 igfxpt32.exe 2920 igfxpt32.exe 2920 igfxpt32.exe 2284 igfxpt32.exe 2284 igfxpt32.exe -
Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 f0f79ce9732c138fd3c0a0b87a15c959_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum f0f79ce9732c138fd3c0a0b87a15c959_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpt32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ igfxpt32.exe File created C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File opened for modification C:\Windows\SysWOW64\ igfxpt32.exe File opened for modification C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File created C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File created C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File created C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File opened for modification C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File created C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File created C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File created C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File opened for modification C:\Windows\SysWOW64\ igfxpt32.exe File opened for modification C:\Windows\SysWOW64\ igfxpt32.exe File opened for modification C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File created C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File created C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File opened for modification C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File opened for modification C:\Windows\SysWOW64\ igfxpt32.exe File opened for modification C:\Windows\SysWOW64\ igfxpt32.exe File created C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File opened for modification C:\Windows\SysWOW64\ igfxpt32.exe File created C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File created C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File opened for modification C:\Windows\SysWOW64\ igfxpt32.exe File opened for modification C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File opened for modification C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File opened for modification C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File opened for modification C:\Windows\SysWOW64\ igfxpt32.exe File opened for modification C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File opened for modification C:\Windows\SysWOW64\ igfxpt32.exe File opened for modification C:\Windows\SysWOW64\ igfxpt32.exe File created C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File opened for modification C:\Windows\SysWOW64\ f0f79ce9732c138fd3c0a0b87a15c959_JaffaCakes118.exe File created C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File opened for modification C:\Windows\SysWOW64\ igfxpt32.exe File opened for modification C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File opened for modification C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File opened for modification C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File opened for modification C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File opened for modification C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File opened for modification C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File created C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File created C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File opened for modification C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File opened for modification C:\Windows\SysWOW64\ igfxpt32.exe File created C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File opened for modification C:\Windows\SysWOW64\ igfxpt32.exe File opened for modification C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File created C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File opened for modification C:\Windows\SysWOW64\ igfxpt32.exe File created C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File opened for modification C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File opened for modification C:\Windows\SysWOW64\ igfxpt32.exe File created C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File created C:\Windows\SysWOW64\igfxpt32.exe f0f79ce9732c138fd3c0a0b87a15c959_JaffaCakes118.exe File created C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File opened for modification C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File opened for modification C:\Windows\SysWOW64\ igfxpt32.exe File opened for modification C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File opened for modification C:\Windows\SysWOW64\ igfxpt32.exe File opened for modification C:\Windows\SysWOW64\igfxpt32.exe f0f79ce9732c138fd3c0a0b87a15c959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe File opened for modification C:\Windows\SysWOW64\ igfxpt32.exe File opened for modification C:\Windows\SysWOW64\igfxpt32.exe igfxpt32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f0f79ce9732c138fd3c0a0b87a15c959_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpt32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2252 f0f79ce9732c138fd3c0a0b87a15c959_JaffaCakes118.exe 2252 f0f79ce9732c138fd3c0a0b87a15c959_JaffaCakes118.exe 2852 igfxpt32.exe 2852 igfxpt32.exe 2768 igfxpt32.exe 2768 igfxpt32.exe 2716 igfxpt32.exe 2716 igfxpt32.exe 2604 igfxpt32.exe 2604 igfxpt32.exe 1656 igfxpt32.exe 1656 igfxpt32.exe 2196 igfxpt32.exe 2196 igfxpt32.exe 2896 igfxpt32.exe 2896 igfxpt32.exe 2040 igfxpt32.exe 2040 igfxpt32.exe 2908 igfxpt32.exe 2908 igfxpt32.exe 1692 igfxpt32.exe 1692 igfxpt32.exe 2132 igfxpt32.exe 2132 igfxpt32.exe 2168 igfxpt32.exe 2168 igfxpt32.exe 3012 igfxpt32.exe 3012 igfxpt32.exe 3028 igfxpt32.exe 3028 igfxpt32.exe 1052 igfxpt32.exe 1052 igfxpt32.exe 1768 igfxpt32.exe 1768 igfxpt32.exe 392 igfxpt32.exe 392 igfxpt32.exe 1108 igfxpt32.exe 1108 igfxpt32.exe 236 igfxpt32.exe 236 igfxpt32.exe 2212 igfxpt32.exe 2212 igfxpt32.exe 1696 igfxpt32.exe 1696 igfxpt32.exe 2160 igfxpt32.exe 2160 igfxpt32.exe 2688 igfxpt32.exe 2688 igfxpt32.exe 2972 igfxpt32.exe 2972 igfxpt32.exe 2596 igfxpt32.exe 2596 igfxpt32.exe 2648 igfxpt32.exe 2648 igfxpt32.exe 1576 igfxpt32.exe 1576 igfxpt32.exe 3048 igfxpt32.exe 3048 igfxpt32.exe 2952 igfxpt32.exe 2952 igfxpt32.exe 2920 igfxpt32.exe 2920 igfxpt32.exe 2284 igfxpt32.exe 2284 igfxpt32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2252 wrote to memory of 2852 2252 f0f79ce9732c138fd3c0a0b87a15c959_JaffaCakes118.exe 29 PID 2252 wrote to memory of 2852 2252 f0f79ce9732c138fd3c0a0b87a15c959_JaffaCakes118.exe 29 PID 2252 wrote to memory of 2852 2252 f0f79ce9732c138fd3c0a0b87a15c959_JaffaCakes118.exe 29 PID 2252 wrote to memory of 2852 2252 f0f79ce9732c138fd3c0a0b87a15c959_JaffaCakes118.exe 29 PID 2852 wrote to memory of 2768 2852 igfxpt32.exe 30 PID 2852 wrote to memory of 2768 2852 igfxpt32.exe 30 PID 2852 wrote to memory of 2768 2852 igfxpt32.exe 30 PID 2852 wrote to memory of 2768 2852 igfxpt32.exe 30 PID 2768 wrote to memory of 2716 2768 igfxpt32.exe 31 PID 2768 wrote to memory of 2716 2768 igfxpt32.exe 31 PID 2768 wrote to memory of 2716 2768 igfxpt32.exe 31 PID 2768 wrote to memory of 2716 2768 igfxpt32.exe 31 PID 2716 wrote to memory of 2604 2716 igfxpt32.exe 32 PID 2716 wrote to memory of 2604 2716 igfxpt32.exe 32 PID 2716 wrote to memory of 2604 2716 igfxpt32.exe 32 PID 2716 wrote to memory of 2604 2716 igfxpt32.exe 32 PID 2604 wrote to memory of 1656 2604 igfxpt32.exe 33 PID 2604 wrote to memory of 1656 2604 igfxpt32.exe 33 PID 2604 wrote to memory of 1656 2604 igfxpt32.exe 33 PID 2604 wrote to memory of 1656 2604 igfxpt32.exe 33 PID 1656 wrote to memory of 2196 1656 igfxpt32.exe 34 PID 1656 wrote to memory of 2196 1656 igfxpt32.exe 34 PID 1656 wrote to memory of 2196 1656 igfxpt32.exe 34 PID 1656 wrote to memory of 2196 1656 igfxpt32.exe 34 PID 2196 wrote to memory of 2896 2196 igfxpt32.exe 35 PID 2196 wrote to memory of 2896 2196 igfxpt32.exe 35 PID 2196 wrote to memory of 2896 2196 igfxpt32.exe 35 PID 2196 wrote to memory of 2896 2196 igfxpt32.exe 35 PID 2896 wrote to memory of 2040 2896 igfxpt32.exe 36 PID 2896 wrote to memory of 2040 2896 igfxpt32.exe 36 PID 2896 wrote to memory of 2040 2896 igfxpt32.exe 36 PID 2896 wrote to memory of 2040 2896 igfxpt32.exe 36 PID 2040 wrote to memory of 2908 2040 igfxpt32.exe 37 PID 2040 wrote to memory of 2908 2040 igfxpt32.exe 37 PID 2040 wrote to memory of 2908 2040 igfxpt32.exe 37 PID 2040 wrote to memory of 2908 2040 igfxpt32.exe 37 PID 2908 wrote to memory of 1692 2908 igfxpt32.exe 38 PID 2908 wrote to memory of 1692 2908 igfxpt32.exe 38 PID 2908 wrote to memory of 1692 2908 igfxpt32.exe 38 PID 2908 wrote to memory of 1692 2908 igfxpt32.exe 38 PID 1692 wrote to memory of 2132 1692 igfxpt32.exe 39 PID 1692 wrote to memory of 2132 1692 igfxpt32.exe 39 PID 1692 wrote to memory of 2132 1692 igfxpt32.exe 39 PID 1692 wrote to memory of 2132 1692 igfxpt32.exe 39 PID 2132 wrote to memory of 2168 2132 igfxpt32.exe 40 PID 2132 wrote to memory of 2168 2132 igfxpt32.exe 40 PID 2132 wrote to memory of 2168 2132 igfxpt32.exe 40 PID 2132 wrote to memory of 2168 2132 igfxpt32.exe 40 PID 2168 wrote to memory of 3012 2168 igfxpt32.exe 41 PID 2168 wrote to memory of 3012 2168 igfxpt32.exe 41 PID 2168 wrote to memory of 3012 2168 igfxpt32.exe 41 PID 2168 wrote to memory of 3012 2168 igfxpt32.exe 41 PID 3012 wrote to memory of 3028 3012 igfxpt32.exe 42 PID 3012 wrote to memory of 3028 3012 igfxpt32.exe 42 PID 3012 wrote to memory of 3028 3012 igfxpt32.exe 42 PID 3012 wrote to memory of 3028 3012 igfxpt32.exe 42 PID 3028 wrote to memory of 1052 3028 igfxpt32.exe 43 PID 3028 wrote to memory of 1052 3028 igfxpt32.exe 43 PID 3028 wrote to memory of 1052 3028 igfxpt32.exe 43 PID 3028 wrote to memory of 1052 3028 igfxpt32.exe 43 PID 1052 wrote to memory of 1768 1052 igfxpt32.exe 44 PID 1052 wrote to memory of 1768 1052 igfxpt32.exe 44 PID 1052 wrote to memory of 1768 1052 igfxpt32.exe 44 PID 1052 wrote to memory of 1768 1052 igfxpt32.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0f79ce9732c138fd3c0a0b87a15c959_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f0f79ce9732c138fd3c0a0b87a15c959_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Users\Admin\AppData\Local\Temp\F0F79C~1.EXE2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1768 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:392 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1108 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:236 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2212 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1696 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2160 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2688 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2972 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2596 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2648 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1576 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3048 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2952 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2920 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2284 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe33⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:1540 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe34⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1780 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe35⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1964 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1716 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe37⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2060 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe38⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1960 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe39⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:1096 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe40⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:696 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe41⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:776 -
C:\Windows\SysWOW64\igfxpt32.exe"C:\Windows\system32\igfxpt32.exe" C:\Windows\SysWOW64\igfxpt32.exe42⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:1264
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
269KB
MD5f0f79ce9732c138fd3c0a0b87a15c959
SHA1843da60e763e41adcf29b11015750a2ebe61d4d0
SHA2569b0b5463072d7e88c879bd7f07821a0ef5c2befff9ee06d81e2f4e33a6de63f8
SHA512f3eb88c146e3cfe55aa5be5bcd10aab8d656a0250f0ee47cf86a47b3d08b64fb5351c4fcffb589c79cb8cdeec57a92bc564af6b9c7240007e27b61f831b0ac92