Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
26-09-2024 13:39
Static task
static1
Behavioral task
behavioral1
Sample
f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe
-
Size
184KB
-
MD5
f87d227c239f2153debe2ed82b791af4
-
SHA1
86b7ca4b65925fe8c34346824e7514dec9bc4dc9
-
SHA256
0e3bd9a2273d23017ac49410da451bd01b9972f14a6fbac0551dc45a77e86da5
-
SHA512
cf5fd3e38a2bb4115949cc609c63f436c18538a32986c0b1b314b8c73c86454b2a3a76f9d9b440d31f4176ceb9d924e590a696c06b1030825656140649aeeb51
-
SSDEEP
3072:42cek9K+k7JeRFr/mt+YrxLbaQrhnUn0NwSsSaD6wtADYzaiFw9Rykw9sQ4SKRfk:42cekCqJzQLbd9p28i2dEsVSI8
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation igfxpk32.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation igfxpk32.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation igfxpk32.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation igfxpk32.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation igfxpk32.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation igfxpk32.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation igfxpk32.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation igfxpk32.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation igfxpk32.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation igfxpk32.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation igfxpk32.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation igfxpk32.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation igfxpk32.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation igfxpk32.exe Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation igfxpk32.exe -
Deletes itself 1 IoCs
pid Process 3116 igfxpk32.exe -
Executes dropped EXE 32 IoCs
pid Process 220 igfxpk32.exe 3116 igfxpk32.exe 3880 igfxpk32.exe 3372 igfxpk32.exe 5088 igfxpk32.exe 3428 igfxpk32.exe 2548 igfxpk32.exe 4756 igfxpk32.exe 1516 igfxpk32.exe 4744 igfxpk32.exe 3336 igfxpk32.exe 2812 igfxpk32.exe 2256 igfxpk32.exe 2432 igfxpk32.exe 4468 igfxpk32.exe 4968 igfxpk32.exe 4324 igfxpk32.exe 3244 igfxpk32.exe 1428 igfxpk32.exe 3580 igfxpk32.exe 3968 igfxpk32.exe 232 igfxpk32.exe 1860 igfxpk32.exe 5000 igfxpk32.exe 4528 igfxpk32.exe 1220 igfxpk32.exe 432 igfxpk32.exe 2740 igfxpk32.exe 1936 igfxpk32.exe 2012 igfxpk32.exe 1700 igfxpk32.exe 4348 igfxpk32.exe -
Maps connected drives based on registry 3 TTPs 34 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpk32.exe -
Drops file in System32 directory 48 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File created C:\Windows\SysWOW64\igfxpk32.exe igfxpk32.exe File opened for modification C:\Windows\SysWOW64\ igfxpk32.exe -
Suspicious use of SetThreadContext 17 IoCs
description pid Process procid_target PID 2892 set thread context of 4828 2892 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 82 PID 220 set thread context of 3116 220 igfxpk32.exe 91 PID 3880 set thread context of 3372 3880 igfxpk32.exe 93 PID 5088 set thread context of 3428 5088 igfxpk32.exe 97 PID 2548 set thread context of 4756 2548 igfxpk32.exe 99 PID 1516 set thread context of 4744 1516 igfxpk32.exe 101 PID 3336 set thread context of 2812 3336 igfxpk32.exe 103 PID 2256 set thread context of 2432 2256 igfxpk32.exe 105 PID 4468 set thread context of 4968 4468 igfxpk32.exe 107 PID 4324 set thread context of 3244 4324 igfxpk32.exe 109 PID 1428 set thread context of 3580 1428 igfxpk32.exe 111 PID 3968 set thread context of 232 3968 igfxpk32.exe 113 PID 1860 set thread context of 5000 1860 igfxpk32.exe 115 PID 4528 set thread context of 1220 4528 igfxpk32.exe 117 PID 432 set thread context of 2740 432 igfxpk32.exe 119 PID 1936 set thread context of 2012 1936 igfxpk32.exe 121 PID 1700 set thread context of 4348 1700 igfxpk32.exe 123 -
resource yara_rule behavioral2/memory/4828-0-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/4828-2-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/4828-4-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/4828-3-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/4828-37-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/3116-45-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/3116-47-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/3372-54-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/3428-62-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/4756-69-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/4744-76-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/2812-84-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/2432-91-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/4968-98-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/3244-104-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/3580-113-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/232-120-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/5000-129-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/1220-138-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/2740-146-0x0000000037170000-0x00000000371D5000-memory.dmp upx behavioral2/memory/2012-155-0x0000000037170000-0x00000000371D5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 33 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpk32.exe -
Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4828 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 4828 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 4828 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 4828 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 3116 igfxpk32.exe 3116 igfxpk32.exe 3116 igfxpk32.exe 3116 igfxpk32.exe 3372 igfxpk32.exe 3372 igfxpk32.exe 3372 igfxpk32.exe 3372 igfxpk32.exe 3428 igfxpk32.exe 3428 igfxpk32.exe 3428 igfxpk32.exe 3428 igfxpk32.exe 4756 igfxpk32.exe 4756 igfxpk32.exe 4756 igfxpk32.exe 4756 igfxpk32.exe 4744 igfxpk32.exe 4744 igfxpk32.exe 4744 igfxpk32.exe 4744 igfxpk32.exe 2812 igfxpk32.exe 2812 igfxpk32.exe 2812 igfxpk32.exe 2812 igfxpk32.exe 2432 igfxpk32.exe 2432 igfxpk32.exe 2432 igfxpk32.exe 2432 igfxpk32.exe 4968 igfxpk32.exe 4968 igfxpk32.exe 4968 igfxpk32.exe 4968 igfxpk32.exe 3244 igfxpk32.exe 3244 igfxpk32.exe 3244 igfxpk32.exe 3244 igfxpk32.exe 3580 igfxpk32.exe 3580 igfxpk32.exe 3580 igfxpk32.exe 3580 igfxpk32.exe 232 igfxpk32.exe 232 igfxpk32.exe 232 igfxpk32.exe 232 igfxpk32.exe 5000 igfxpk32.exe 5000 igfxpk32.exe 5000 igfxpk32.exe 5000 igfxpk32.exe 1220 igfxpk32.exe 1220 igfxpk32.exe 1220 igfxpk32.exe 1220 igfxpk32.exe 2740 igfxpk32.exe 2740 igfxpk32.exe 2740 igfxpk32.exe 2740 igfxpk32.exe 2012 igfxpk32.exe 2012 igfxpk32.exe 2012 igfxpk32.exe 2012 igfxpk32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2892 wrote to memory of 4828 2892 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 82 PID 2892 wrote to memory of 4828 2892 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 82 PID 2892 wrote to memory of 4828 2892 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 82 PID 2892 wrote to memory of 4828 2892 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 82 PID 2892 wrote to memory of 4828 2892 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 82 PID 2892 wrote to memory of 4828 2892 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 82 PID 2892 wrote to memory of 4828 2892 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 82 PID 4828 wrote to memory of 220 4828 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 87 PID 4828 wrote to memory of 220 4828 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 87 PID 4828 wrote to memory of 220 4828 f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe 87 PID 220 wrote to memory of 3116 220 igfxpk32.exe 91 PID 220 wrote to memory of 3116 220 igfxpk32.exe 91 PID 220 wrote to memory of 3116 220 igfxpk32.exe 91 PID 220 wrote to memory of 3116 220 igfxpk32.exe 91 PID 220 wrote to memory of 3116 220 igfxpk32.exe 91 PID 220 wrote to memory of 3116 220 igfxpk32.exe 91 PID 220 wrote to memory of 3116 220 igfxpk32.exe 91 PID 3116 wrote to memory of 3880 3116 igfxpk32.exe 92 PID 3116 wrote to memory of 3880 3116 igfxpk32.exe 92 PID 3116 wrote to memory of 3880 3116 igfxpk32.exe 92 PID 3880 wrote to memory of 3372 3880 igfxpk32.exe 93 PID 3880 wrote to memory of 3372 3880 igfxpk32.exe 93 PID 3880 wrote to memory of 3372 3880 igfxpk32.exe 93 PID 3880 wrote to memory of 3372 3880 igfxpk32.exe 93 PID 3880 wrote to memory of 3372 3880 igfxpk32.exe 93 PID 3880 wrote to memory of 3372 3880 igfxpk32.exe 93 PID 3880 wrote to memory of 3372 3880 igfxpk32.exe 93 PID 3372 wrote to memory of 5088 3372 igfxpk32.exe 94 PID 3372 wrote to memory of 5088 3372 igfxpk32.exe 94 PID 3372 wrote to memory of 5088 3372 igfxpk32.exe 94 PID 5088 wrote to memory of 3428 5088 igfxpk32.exe 97 PID 5088 wrote to memory of 3428 5088 igfxpk32.exe 97 PID 5088 wrote to memory of 3428 5088 igfxpk32.exe 97 PID 5088 wrote to memory of 3428 5088 igfxpk32.exe 97 PID 5088 wrote to memory of 3428 5088 igfxpk32.exe 97 PID 5088 wrote to memory of 3428 5088 igfxpk32.exe 97 PID 5088 wrote to memory of 3428 5088 igfxpk32.exe 97 PID 3428 wrote to memory of 2548 3428 igfxpk32.exe 98 PID 3428 wrote to memory of 2548 3428 igfxpk32.exe 98 PID 3428 wrote to memory of 2548 3428 igfxpk32.exe 98 PID 2548 wrote to memory of 4756 2548 igfxpk32.exe 99 PID 2548 wrote to memory of 4756 2548 igfxpk32.exe 99 PID 2548 wrote to memory of 4756 2548 igfxpk32.exe 99 PID 2548 wrote to memory of 4756 2548 igfxpk32.exe 99 PID 2548 wrote to memory of 4756 2548 igfxpk32.exe 99 PID 2548 wrote to memory of 4756 2548 igfxpk32.exe 99 PID 2548 wrote to memory of 4756 2548 igfxpk32.exe 99 PID 4756 wrote to memory of 1516 4756 igfxpk32.exe 100 PID 4756 wrote to memory of 1516 4756 igfxpk32.exe 100 PID 4756 wrote to memory of 1516 4756 igfxpk32.exe 100 PID 1516 wrote to memory of 4744 1516 igfxpk32.exe 101 PID 1516 wrote to memory of 4744 1516 igfxpk32.exe 101 PID 1516 wrote to memory of 4744 1516 igfxpk32.exe 101 PID 1516 wrote to memory of 4744 1516 igfxpk32.exe 101 PID 1516 wrote to memory of 4744 1516 igfxpk32.exe 101 PID 1516 wrote to memory of 4744 1516 igfxpk32.exe 101 PID 1516 wrote to memory of 4744 1516 igfxpk32.exe 101 PID 4744 wrote to memory of 3336 4744 igfxpk32.exe 102 PID 4744 wrote to memory of 3336 4744 igfxpk32.exe 102 PID 4744 wrote to memory of 3336 4744 igfxpk32.exe 102 PID 3336 wrote to memory of 2812 3336 igfxpk32.exe 103 PID 3336 wrote to memory of 2812 3336 igfxpk32.exe 103 PID 3336 wrote to memory of 2812 3336 igfxpk32.exe 103 PID 3336 wrote to memory of 2812 3336 igfxpk32.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f87d227c239f2153debe2ed82b791af4_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Users\Admin\AppData\Local\Temp\F87D22~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Users\Admin\AppData\Local\Temp\F87D22~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2812 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2256 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2432 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4468 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4968 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4324 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3244 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1428 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3580 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3968 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:232 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1860 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5000 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4528 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1220 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:432 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe30⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2740 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1936 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe32⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2012 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\system32\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1700 -
C:\Windows\SysWOW64\igfxpk32.exe"C:\Windows\SysWOW64\igfxpk32.exe" C:\Windows\SysWOW64\igfxpk32.exe34⤵
- Executes dropped EXE
- Maps connected drives based on registry
PID:4348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
MD5f87d227c239f2153debe2ed82b791af4
SHA186b7ca4b65925fe8c34346824e7514dec9bc4dc9
SHA2560e3bd9a2273d23017ac49410da451bd01b9972f14a6fbac0551dc45a77e86da5
SHA512cf5fd3e38a2bb4115949cc609c63f436c18538a32986c0b1b314b8c73c86454b2a3a76f9d9b440d31f4176ceb9d924e590a696c06b1030825656140649aeeb51