Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 08:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe
-
Size
220KB
-
MD5
9379e4dd4395e4d2ffb830f67b7ce372
-
SHA1
6ece4a645b5ef91b090650a9c266c219c15dc8c0
-
SHA256
fadc8946fcdbaddfe31ab48968e84da81d9ed0f403ad49e533dafb2907b97373
-
SHA512
e2f484d69e7189d5817706f5bc8377e081fee8a77a8c04c894131d95eb1b6c0c60c4eca84561221d06cc248a9e8c2a93dedcf750f1ea617fa2f1563d0d8be1c7
-
SSDEEP
3072:SEweV9Lijj7mO9tOrvgKplY6hR0Q3RIRlF13jFA4mrtPp:SEweRgMlY67dh6P1zW4mb
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Checks computer location settings 2 TTPs 13 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxvsd32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxvsd32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxvsd32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation 9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxvsd32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxvsd32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxvsd32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxvsd32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxvsd32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxvsd32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxvsd32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxvsd32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxvsd32.exe -
Deletes itself 1 IoCs
pid Process 3812 igfxvsd32.exe -
Executes dropped EXE 26 IoCs
pid Process 4752 igfxvsd32.exe 3812 igfxvsd32.exe 4512 igfxvsd32.exe 4364 igfxvsd32.exe 2008 igfxvsd32.exe 4012 igfxvsd32.exe 1864 igfxvsd32.exe 3700 igfxvsd32.exe 5096 igfxvsd32.exe 2980 igfxvsd32.exe 4992 igfxvsd32.exe 2688 igfxvsd32.exe 5024 igfxvsd32.exe 3500 igfxvsd32.exe 4420 igfxvsd32.exe 5092 igfxvsd32.exe 4268 igfxvsd32.exe 3620 igfxvsd32.exe 2248 igfxvsd32.exe 5084 igfxvsd32.exe 4876 igfxvsd32.exe 4272 igfxvsd32.exe 1328 igfxvsd32.exe 3344 igfxvsd32.exe 4896 igfxvsd32.exe 1672 igfxvsd32.exe -
Maps connected drives based on registry 3 TTPs 28 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxvsd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxvsd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxvsd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxvsd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxvsd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxvsd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxvsd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxvsd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxvsd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxvsd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxvsd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxvsd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxvsd32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxvsd32.exe -
Drops file in System32 directory 40 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\igfxvsd32.exe igfxvsd32.exe File created C:\Windows\SysWOW64\igfxvsd32.exe igfxvsd32.exe File opened for modification C:\Windows\SysWOW64\ igfxvsd32.exe File opened for modification C:\Windows\SysWOW64\ igfxvsd32.exe File opened for modification C:\Windows\SysWOW64\ igfxvsd32.exe File opened for modification C:\Windows\SysWOW64\igfxvsd32.exe igfxvsd32.exe File opened for modification C:\Windows\SysWOW64\ igfxvsd32.exe File created C:\Windows\SysWOW64\igfxvsd32.exe igfxvsd32.exe File opened for modification C:\Windows\SysWOW64\igfxvsd32.exe igfxvsd32.exe File opened for modification C:\Windows\SysWOW64\igfxvsd32.exe igfxvsd32.exe File opened for modification C:\Windows\SysWOW64\igfxvsd32.exe igfxvsd32.exe File opened for modification C:\Windows\SysWOW64\igfxvsd32.exe igfxvsd32.exe File opened for modification C:\Windows\SysWOW64\ igfxvsd32.exe File opened for modification C:\Windows\SysWOW64\igfxvsd32.exe igfxvsd32.exe File created C:\Windows\SysWOW64\igfxvsd32.exe igfxvsd32.exe File opened for modification C:\Windows\SysWOW64\ igfxvsd32.exe File opened for modification C:\Windows\SysWOW64\igfxvsd32.exe igfxvsd32.exe File opened for modification C:\Windows\SysWOW64\igfxvsd32.exe igfxvsd32.exe File created C:\Windows\SysWOW64\igfxvsd32.exe igfxvsd32.exe File created C:\Windows\SysWOW64\igfxvsd32.exe 9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe File created C:\Windows\SysWOW64\igfxvsd32.exe igfxvsd32.exe File created C:\Windows\SysWOW64\igfxvsd32.exe igfxvsd32.exe File opened for modification C:\Windows\SysWOW64\ igfxvsd32.exe File created C:\Windows\SysWOW64\igfxvsd32.exe igfxvsd32.exe File opened for modification C:\Windows\SysWOW64\ igfxvsd32.exe File created C:\Windows\SysWOW64\igfxvsd32.exe igfxvsd32.exe File opened for modification C:\Windows\SysWOW64\ igfxvsd32.exe File opened for modification C:\Windows\SysWOW64\igfxvsd32.exe igfxvsd32.exe File opened for modification C:\Windows\SysWOW64\ 9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\igfxvsd32.exe 9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe File created C:\Windows\SysWOW64\igfxvsd32.exe igfxvsd32.exe File created C:\Windows\SysWOW64\igfxvsd32.exe igfxvsd32.exe File opened for modification C:\Windows\SysWOW64\ igfxvsd32.exe File opened for modification C:\Windows\SysWOW64\ igfxvsd32.exe File opened for modification C:\Windows\SysWOW64\igfxvsd32.exe igfxvsd32.exe File created C:\Windows\SysWOW64\igfxvsd32.exe igfxvsd32.exe File opened for modification C:\Windows\SysWOW64\ igfxvsd32.exe File opened for modification C:\Windows\SysWOW64\igfxvsd32.exe igfxvsd32.exe File created C:\Windows\SysWOW64\igfxvsd32.exe igfxvsd32.exe File opened for modification C:\Windows\SysWOW64\ igfxvsd32.exe -
Suspicious use of SetThreadContext 14 IoCs
description pid Process procid_target PID 2968 set thread context of 3628 2968 9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe 83 PID 4752 set thread context of 3812 4752 igfxvsd32.exe 97 PID 4512 set thread context of 4364 4512 igfxvsd32.exe 99 PID 2008 set thread context of 4012 2008 igfxvsd32.exe 103 PID 1864 set thread context of 3700 1864 igfxvsd32.exe 106 PID 5096 set thread context of 2980 5096 igfxvsd32.exe 108 PID 4992 set thread context of 2688 4992 igfxvsd32.exe 111 PID 5024 set thread context of 3500 5024 igfxvsd32.exe 113 PID 4420 set thread context of 5092 4420 igfxvsd32.exe 115 PID 4268 set thread context of 3620 4268 igfxvsd32.exe 117 PID 2248 set thread context of 5084 2248 igfxvsd32.exe 119 PID 4876 set thread context of 4272 4876 igfxvsd32.exe 121 PID 1328 set thread context of 3344 1328 igfxvsd32.exe 123 PID 4896 set thread context of 1672 4896 igfxvsd32.exe 125 -
resource yara_rule behavioral2/memory/3628-0-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3628-2-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3628-3-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3628-4-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3628-31-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3812-43-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3628-46-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3812-48-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4364-56-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3812-59-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4364-60-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4364-69-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4012-71-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4012-77-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3700-79-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3700-85-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/2980-88-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/2980-94-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/2688-97-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/2688-103-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3500-106-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3500-112-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/5092-115-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/5092-121-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3620-124-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3620-130-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/5084-133-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/5084-140-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4272-143-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4272-151-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3344-153-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3344-161-0x0000000000400000-0x0000000000451000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 27 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxvsd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxvsd32.exe -
Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxvsd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxvsd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxvsd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxvsd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxvsd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxvsd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxvsd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxvsd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxvsd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxvsd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxvsd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxvsd32.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 3628 9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe 3628 9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe 3628 9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe 3628 9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe 3812 igfxvsd32.exe 3812 igfxvsd32.exe 3812 igfxvsd32.exe 3812 igfxvsd32.exe 4364 igfxvsd32.exe 4364 igfxvsd32.exe 4364 igfxvsd32.exe 4364 igfxvsd32.exe 4012 igfxvsd32.exe 4012 igfxvsd32.exe 4012 igfxvsd32.exe 4012 igfxvsd32.exe 3700 igfxvsd32.exe 3700 igfxvsd32.exe 3700 igfxvsd32.exe 3700 igfxvsd32.exe 2980 igfxvsd32.exe 2980 igfxvsd32.exe 2980 igfxvsd32.exe 2980 igfxvsd32.exe 2688 igfxvsd32.exe 2688 igfxvsd32.exe 2688 igfxvsd32.exe 2688 igfxvsd32.exe 3500 igfxvsd32.exe 3500 igfxvsd32.exe 3500 igfxvsd32.exe 3500 igfxvsd32.exe 5092 igfxvsd32.exe 5092 igfxvsd32.exe 5092 igfxvsd32.exe 5092 igfxvsd32.exe 3620 igfxvsd32.exe 3620 igfxvsd32.exe 3620 igfxvsd32.exe 3620 igfxvsd32.exe 5084 igfxvsd32.exe 5084 igfxvsd32.exe 5084 igfxvsd32.exe 5084 igfxvsd32.exe 4272 igfxvsd32.exe 4272 igfxvsd32.exe 4272 igfxvsd32.exe 4272 igfxvsd32.exe 3344 igfxvsd32.exe 3344 igfxvsd32.exe 3344 igfxvsd32.exe 3344 igfxvsd32.exe 1672 igfxvsd32.exe 1672 igfxvsd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2968 wrote to memory of 3628 2968 9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe 83 PID 2968 wrote to memory of 3628 2968 9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe 83 PID 2968 wrote to memory of 3628 2968 9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe 83 PID 2968 wrote to memory of 3628 2968 9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe 83 PID 2968 wrote to memory of 3628 2968 9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe 83 PID 2968 wrote to memory of 3628 2968 9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe 83 PID 2968 wrote to memory of 3628 2968 9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe 83 PID 3628 wrote to memory of 4752 3628 9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe 96 PID 3628 wrote to memory of 4752 3628 9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe 96 PID 3628 wrote to memory of 4752 3628 9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe 96 PID 4752 wrote to memory of 3812 4752 igfxvsd32.exe 97 PID 4752 wrote to memory of 3812 4752 igfxvsd32.exe 97 PID 4752 wrote to memory of 3812 4752 igfxvsd32.exe 97 PID 4752 wrote to memory of 3812 4752 igfxvsd32.exe 97 PID 4752 wrote to memory of 3812 4752 igfxvsd32.exe 97 PID 4752 wrote to memory of 3812 4752 igfxvsd32.exe 97 PID 4752 wrote to memory of 3812 4752 igfxvsd32.exe 97 PID 3812 wrote to memory of 4512 3812 igfxvsd32.exe 98 PID 3812 wrote to memory of 4512 3812 igfxvsd32.exe 98 PID 3812 wrote to memory of 4512 3812 igfxvsd32.exe 98 PID 4512 wrote to memory of 4364 4512 igfxvsd32.exe 99 PID 4512 wrote to memory of 4364 4512 igfxvsd32.exe 99 PID 4512 wrote to memory of 4364 4512 igfxvsd32.exe 99 PID 4512 wrote to memory of 4364 4512 igfxvsd32.exe 99 PID 4512 wrote to memory of 4364 4512 igfxvsd32.exe 99 PID 4512 wrote to memory of 4364 4512 igfxvsd32.exe 99 PID 4512 wrote to memory of 4364 4512 igfxvsd32.exe 99 PID 4364 wrote to memory of 2008 4364 igfxvsd32.exe 102 PID 4364 wrote to memory of 2008 4364 igfxvsd32.exe 102 PID 4364 wrote to memory of 2008 4364 igfxvsd32.exe 102 PID 2008 wrote to memory of 4012 2008 igfxvsd32.exe 103 PID 2008 wrote to memory of 4012 2008 igfxvsd32.exe 103 PID 2008 wrote to memory of 4012 2008 igfxvsd32.exe 103 PID 2008 wrote to memory of 4012 2008 igfxvsd32.exe 103 PID 2008 wrote to memory of 4012 2008 igfxvsd32.exe 103 PID 2008 wrote to memory of 4012 2008 igfxvsd32.exe 103 PID 2008 wrote to memory of 4012 2008 igfxvsd32.exe 103 PID 4012 wrote to memory of 1864 4012 igfxvsd32.exe 105 PID 4012 wrote to memory of 1864 4012 igfxvsd32.exe 105 PID 4012 wrote to memory of 1864 4012 igfxvsd32.exe 105 PID 1864 wrote to memory of 3700 1864 igfxvsd32.exe 106 PID 1864 wrote to memory of 3700 1864 igfxvsd32.exe 106 PID 1864 wrote to memory of 3700 1864 igfxvsd32.exe 106 PID 1864 wrote to memory of 3700 1864 igfxvsd32.exe 106 PID 1864 wrote to memory of 3700 1864 igfxvsd32.exe 106 PID 1864 wrote to memory of 3700 1864 igfxvsd32.exe 106 PID 1864 wrote to memory of 3700 1864 igfxvsd32.exe 106 PID 3700 wrote to memory of 5096 3700 igfxvsd32.exe 107 PID 3700 wrote to memory of 5096 3700 igfxvsd32.exe 107 PID 3700 wrote to memory of 5096 3700 igfxvsd32.exe 107 PID 5096 wrote to memory of 2980 5096 igfxvsd32.exe 108 PID 5096 wrote to memory of 2980 5096 igfxvsd32.exe 108 PID 5096 wrote to memory of 2980 5096 igfxvsd32.exe 108 PID 5096 wrote to memory of 2980 5096 igfxvsd32.exe 108 PID 5096 wrote to memory of 2980 5096 igfxvsd32.exe 108 PID 5096 wrote to memory of 2980 5096 igfxvsd32.exe 108 PID 5096 wrote to memory of 2980 5096 igfxvsd32.exe 108 PID 2980 wrote to memory of 4992 2980 igfxvsd32.exe 110 PID 2980 wrote to memory of 4992 2980 igfxvsd32.exe 110 PID 2980 wrote to memory of 4992 2980 igfxvsd32.exe 110 PID 4992 wrote to memory of 2688 4992 igfxvsd32.exe 111 PID 4992 wrote to memory of 2688 4992 igfxvsd32.exe 111 PID 4992 wrote to memory of 2688 4992 igfxvsd32.exe 111 PID 4992 wrote to memory of 2688 4992 igfxvsd32.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9379e4dd4395e4d2ffb830f67b7ce372_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\SysWOW64\igfxvsd32.exe"C:\Windows\system32\igfxvsd32.exe" C:\Users\Admin\AppData\Local\Temp\9379E4~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\igfxvsd32.exe"C:\Windows\system32\igfxvsd32.exe" C:\Users\Admin\AppData\Local\Temp\9379E4~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\SysWOW64\igfxvsd32.exe"C:\Windows\system32\igfxvsd32.exe" C:\Windows\SysWOW64\IGFXVS~1.EXE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\igfxvsd32.exe"C:\Windows\system32\igfxvsd32.exe" C:\Windows\SysWOW64\IGFXVS~1.EXE6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\igfxvsd32.exe"C:\Windows\system32\igfxvsd32.exe" C:\Windows\SysWOW64\IGFXVS~1.EXE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\igfxvsd32.exe"C:\Windows\system32\igfxvsd32.exe" C:\Windows\SysWOW64\IGFXVS~1.EXE8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Windows\SysWOW64\igfxvsd32.exe"C:\Windows\system32\igfxvsd32.exe" C:\Windows\SysWOW64\IGFXVS~1.EXE9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\igfxvsd32.exe"C:\Windows\system32\igfxvsd32.exe" C:\Windows\SysWOW64\IGFXVS~1.EXE10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\SysWOW64\igfxvsd32.exe"C:\Windows\system32\igfxvsd32.exe" C:\Windows\SysWOW64\IGFXVS~1.EXE11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\SysWOW64\igfxvsd32.exe"C:\Windows\system32\igfxvsd32.exe" C:\Windows\SysWOW64\IGFXVS~1.EXE12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\igfxvsd32.exe"C:\Windows\system32\igfxvsd32.exe" C:\Windows\SysWOW64\IGFXVS~1.EXE13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\igfxvsd32.exe"C:\Windows\system32\igfxvsd32.exe" C:\Windows\SysWOW64\IGFXVS~1.EXE14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2688 -
C:\Windows\SysWOW64\igfxvsd32.exe"C:\Windows\system32\igfxvsd32.exe" C:\Windows\SysWOW64\IGFXVS~1.EXE15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5024 -
C:\Windows\SysWOW64\igfxvsd32.exe"C:\Windows\system32\igfxvsd32.exe" C:\Windows\SysWOW64\IGFXVS~1.EXE16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3500 -
C:\Windows\SysWOW64\igfxvsd32.exe"C:\Windows\system32\igfxvsd32.exe" C:\Windows\SysWOW64\IGFXVS~1.EXE17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4420 -
C:\Windows\SysWOW64\igfxvsd32.exe"C:\Windows\system32\igfxvsd32.exe" C:\Windows\SysWOW64\IGFXVS~1.EXE18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5092 -
C:\Windows\SysWOW64\igfxvsd32.exe"C:\Windows\system32\igfxvsd32.exe" C:\Windows\SysWOW64\IGFXVS~1.EXE19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4268 -
C:\Windows\SysWOW64\igfxvsd32.exe"C:\Windows\system32\igfxvsd32.exe" C:\Windows\SysWOW64\IGFXVS~1.EXE20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3620 -
C:\Windows\SysWOW64\igfxvsd32.exe"C:\Windows\system32\igfxvsd32.exe" C:\Windows\SysWOW64\IGFXVS~1.EXE21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2248 -
C:\Windows\SysWOW64\igfxvsd32.exe"C:\Windows\system32\igfxvsd32.exe" C:\Windows\SysWOW64\IGFXVS~1.EXE22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5084 -
C:\Windows\SysWOW64\igfxvsd32.exe"C:\Windows\system32\igfxvsd32.exe" C:\Windows\SysWOW64\IGFXVS~1.EXE23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4876 -
C:\Windows\SysWOW64\igfxvsd32.exe"C:\Windows\system32\igfxvsd32.exe" C:\Windows\SysWOW64\IGFXVS~1.EXE24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4272 -
C:\Windows\SysWOW64\igfxvsd32.exe"C:\Windows\system32\igfxvsd32.exe" C:\Windows\SysWOW64\IGFXVS~1.EXE25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1328 -
C:\Windows\SysWOW64\igfxvsd32.exe"C:\Windows\system32\igfxvsd32.exe" C:\Windows\SysWOW64\IGFXVS~1.EXE26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3344 -
C:\Windows\SysWOW64\igfxvsd32.exe"C:\Windows\system32\igfxvsd32.exe" C:\Windows\SysWOW64\IGFXVS~1.EXE27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4896 -
C:\Windows\SysWOW64\igfxvsd32.exe"C:\Windows\system32\igfxvsd32.exe" C:\Windows\SysWOW64\IGFXVS~1.EXE28⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1672
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
220KB
MD59379e4dd4395e4d2ffb830f67b7ce372
SHA16ece4a645b5ef91b090650a9c266c219c15dc8c0
SHA256fadc8946fcdbaddfe31ab48968e84da81d9ed0f403ad49e533dafb2907b97373
SHA512e2f484d69e7189d5817706f5bc8377e081fee8a77a8c04c894131d95eb1b6c0c60c4eca84561221d06cc248a9e8c2a93dedcf750f1ea617fa2f1563d0d8be1c7