metasploit | 15340ef62f68faa89580da965333eade30a56dd50ec961089801e3e56ab7c333

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-11-2024 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe
Size

246KB
MD5

9f442fbd0d524ace9f540c38751d7c2e
SHA1

fc0a7dc9421d8817c47d0c279d2b11801f95733a
SHA256

15340ef62f68faa89580da965333eade30a56dd50ec961089801e3e56ab7c333
SHA512

0ca1c52eb1fb0532456354c7fd2a8b6e2cb90276c5e61d211be1d37cb21a1ee1613f6e0bfeac8562b9ef2d1ed27cf01b2c761d3d779e259a562a13b2c23ad9b5
SSDEEP

6144:LqRWEzuXcpYMtVLq47Sduit/QX9gvw0IgXn:+R3zuX0VORtYNgIOXn

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Deletes itself 1 IoCs

pid	Process
3052	igfxdct32.exe

Executes dropped EXE 47 IoCs

pid	Process
3052	igfxdct32.exe
2888	igfxdct32.exe
2904	igfxdct32.exe
2688	igfxdct32.exe
1492	igfxdct32.exe
2812	igfxdct32.exe
1656	igfxdct32.exe
2972	igfxdct32.exe
2468	igfxdct32.exe
2376	igfxdct32.exe
904	igfxdct32.exe
628	igfxdct32.exe
1340	igfxdct32.exe
888	igfxdct32.exe
2560	igfxdct32.exe
2276	igfxdct32.exe
1308	igfxdct32.exe
2944	igfxdct32.exe
2348	igfxdct32.exe
2740	igfxdct32.exe
2892	igfxdct32.exe
2612	igfxdct32.exe
2396	igfxdct32.exe
2680	igfxdct32.exe
1104	igfxdct32.exe
2852	igfxdct32.exe
2940	igfxdct32.exe
1368	igfxdct32.exe
2980	igfxdct32.exe
2228	igfxdct32.exe
2400	igfxdct32.exe
1624	igfxdct32.exe
2344	igfxdct32.exe
2056	igfxdct32.exe
344	igfxdct32.exe
2104	igfxdct32.exe
2296	igfxdct32.exe
1916	igfxdct32.exe
1136	igfxdct32.exe
1732	igfxdct32.exe
2736	igfxdct32.exe
2880	igfxdct32.exe
3060	igfxdct32.exe
2308	igfxdct32.exe
2480	igfxdct32.exe
2908	igfxdct32.exe
1084	igfxdct32.exe

Loads dropped DLL 64 IoCs

pid	Process
1908	9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe
1908	9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe
3052	igfxdct32.exe
3052	igfxdct32.exe
2888	igfxdct32.exe
2888	igfxdct32.exe
2904	igfxdct32.exe
2904	igfxdct32.exe
2688	igfxdct32.exe
2688	igfxdct32.exe
1492	igfxdct32.exe
1492	igfxdct32.exe
2812	igfxdct32.exe
2812	igfxdct32.exe
1656	igfxdct32.exe
1656	igfxdct32.exe
2972	igfxdct32.exe
2972	igfxdct32.exe
2468	igfxdct32.exe
2468	igfxdct32.exe
2376	igfxdct32.exe
2376	igfxdct32.exe
904	igfxdct32.exe
904	igfxdct32.exe
628	igfxdct32.exe
628	igfxdct32.exe
1340	igfxdct32.exe
1340	igfxdct32.exe
888	igfxdct32.exe
888	igfxdct32.exe
2560	igfxdct32.exe
2560	igfxdct32.exe
2276	igfxdct32.exe
2276	igfxdct32.exe
1308	igfxdct32.exe
1308	igfxdct32.exe
2944	igfxdct32.exe
2944	igfxdct32.exe
2348	igfxdct32.exe
2348	igfxdct32.exe
2740	igfxdct32.exe
2740	igfxdct32.exe
2892	igfxdct32.exe
2892	igfxdct32.exe
2612	igfxdct32.exe
2612	igfxdct32.exe
2396	igfxdct32.exe
2396	igfxdct32.exe
2680	igfxdct32.exe
2680	igfxdct32.exe
1104	igfxdct32.exe
1104	igfxdct32.exe
2852	igfxdct32.exe
2852	igfxdct32.exe
2940	igfxdct32.exe
2940	igfxdct32.exe
1368	igfxdct32.exe
1368	igfxdct32.exe
2980	igfxdct32.exe
2980	igfxdct32.exe
2228	igfxdct32.exe
2228	igfxdct32.exe
2400	igfxdct32.exe
2400	igfxdct32.exe

Maps connected drives based on registry 3 TTPs 64 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxdct32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File created	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File created	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File created	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File created	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\	9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxdct32.exe
File created	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxdct32.exe
File created	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File created	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File created	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File created	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxdct32.exe
File created	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File created	C:\Windows\SysWOW64\igfxdct32.exe	9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\	igfxdct32.exe
File created	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File created	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File created	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File created	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File created	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxdct32.exe
File created	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxdct32.exe
File created	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File created	C:\Windows\SysWOW64\igfxdct32.exe	igfxdct32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxdct32.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 48 IoCs

pid	Process
1908	9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe
3052	igfxdct32.exe
2888	igfxdct32.exe
2904	igfxdct32.exe
2688	igfxdct32.exe
1492	igfxdct32.exe
2812	igfxdct32.exe
1656	igfxdct32.exe
2972	igfxdct32.exe
2468	igfxdct32.exe
2376	igfxdct32.exe
904	igfxdct32.exe
628	igfxdct32.exe
1340	igfxdct32.exe
888	igfxdct32.exe
2560	igfxdct32.exe
2276	igfxdct32.exe
1308	igfxdct32.exe
2944	igfxdct32.exe
2348	igfxdct32.exe
2740	igfxdct32.exe
2892	igfxdct32.exe
2612	igfxdct32.exe
2396	igfxdct32.exe
2680	igfxdct32.exe
1104	igfxdct32.exe
2852	igfxdct32.exe
2940	igfxdct32.exe
1368	igfxdct32.exe
2980	igfxdct32.exe
2228	igfxdct32.exe
2400	igfxdct32.exe
1624	igfxdct32.exe
2344	igfxdct32.exe
2056	igfxdct32.exe
344	igfxdct32.exe
2104	igfxdct32.exe
2296	igfxdct32.exe
1916	igfxdct32.exe
1136	igfxdct32.exe
1732	igfxdct32.exe
2736	igfxdct32.exe
2880	igfxdct32.exe
3060	igfxdct32.exe
2308	igfxdct32.exe
2480	igfxdct32.exe
2908	igfxdct32.exe
1084	igfxdct32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 47 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxdct32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1908	9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe
1908	9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe
1908	9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe
1908	9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe
1908	9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe
1908	9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe
1908	9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe
1908	9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe
1908	9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe
1908	9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe
1908	9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe
1908	9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe
1908	9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe
1908	9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe
1908	9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe
1908	9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe
3052	igfxdct32.exe
3052	igfxdct32.exe
3052	igfxdct32.exe
3052	igfxdct32.exe
3052	igfxdct32.exe
3052	igfxdct32.exe
3052	igfxdct32.exe
3052	igfxdct32.exe
3052	igfxdct32.exe
3052	igfxdct32.exe
3052	igfxdct32.exe
3052	igfxdct32.exe
3052	igfxdct32.exe
3052	igfxdct32.exe
3052	igfxdct32.exe
3052	igfxdct32.exe
2888	igfxdct32.exe
2888	igfxdct32.exe
2888	igfxdct32.exe
2888	igfxdct32.exe
2888	igfxdct32.exe
2888	igfxdct32.exe
2888	igfxdct32.exe
2888	igfxdct32.exe
2888	igfxdct32.exe
2888	igfxdct32.exe
2888	igfxdct32.exe
2888	igfxdct32.exe
2888	igfxdct32.exe
2888	igfxdct32.exe
2888	igfxdct32.exe
2888	igfxdct32.exe
2904	igfxdct32.exe
2904	igfxdct32.exe
2904	igfxdct32.exe
2904	igfxdct32.exe
2904	igfxdct32.exe
2904	igfxdct32.exe
2904	igfxdct32.exe
2904	igfxdct32.exe
2904	igfxdct32.exe
2904	igfxdct32.exe
2904	igfxdct32.exe
2904	igfxdct32.exe
2904	igfxdct32.exe
2904	igfxdct32.exe
2904	igfxdct32.exe
2904	igfxdct32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 3052	1908	9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe	30
PID 1908 wrote to memory of 3052	1908	9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe	30
PID 1908 wrote to memory of 3052	1908	9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe	30
PID 1908 wrote to memory of 3052	1908	9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe	30
PID 3052 wrote to memory of 2888	3052	igfxdct32.exe	31
PID 3052 wrote to memory of 2888	3052	igfxdct32.exe	31
PID 3052 wrote to memory of 2888	3052	igfxdct32.exe	31
PID 3052 wrote to memory of 2888	3052	igfxdct32.exe	31
PID 2888 wrote to memory of 2904	2888	igfxdct32.exe	32
PID 2888 wrote to memory of 2904	2888	igfxdct32.exe	32
PID 2888 wrote to memory of 2904	2888	igfxdct32.exe	32
PID 2888 wrote to memory of 2904	2888	igfxdct32.exe	32
PID 2904 wrote to memory of 2688	2904	igfxdct32.exe	34
PID 2904 wrote to memory of 2688	2904	igfxdct32.exe	34
PID 2904 wrote to memory of 2688	2904	igfxdct32.exe	34
PID 2904 wrote to memory of 2688	2904	igfxdct32.exe	34
PID 2688 wrote to memory of 1492	2688	igfxdct32.exe	35
PID 2688 wrote to memory of 1492	2688	igfxdct32.exe	35
PID 2688 wrote to memory of 1492	2688	igfxdct32.exe	35
PID 2688 wrote to memory of 1492	2688	igfxdct32.exe	35
PID 1492 wrote to memory of 2812	1492	igfxdct32.exe	36
PID 1492 wrote to memory of 2812	1492	igfxdct32.exe	36
PID 1492 wrote to memory of 2812	1492	igfxdct32.exe	36
PID 1492 wrote to memory of 2812	1492	igfxdct32.exe	36
PID 2812 wrote to memory of 1656	2812	igfxdct32.exe	37
PID 2812 wrote to memory of 1656	2812	igfxdct32.exe	37
PID 2812 wrote to memory of 1656	2812	igfxdct32.exe	37
PID 2812 wrote to memory of 1656	2812	igfxdct32.exe	37
PID 1656 wrote to memory of 2972	1656	igfxdct32.exe	38
PID 1656 wrote to memory of 2972	1656	igfxdct32.exe	38
PID 1656 wrote to memory of 2972	1656	igfxdct32.exe	38
PID 1656 wrote to memory of 2972	1656	igfxdct32.exe	38
PID 2972 wrote to memory of 2468	2972	igfxdct32.exe	39
PID 2972 wrote to memory of 2468	2972	igfxdct32.exe	39
PID 2972 wrote to memory of 2468	2972	igfxdct32.exe	39
PID 2972 wrote to memory of 2468	2972	igfxdct32.exe	39
PID 2468 wrote to memory of 2376	2468	igfxdct32.exe	40
PID 2468 wrote to memory of 2376	2468	igfxdct32.exe	40
PID 2468 wrote to memory of 2376	2468	igfxdct32.exe	40
PID 2468 wrote to memory of 2376	2468	igfxdct32.exe	40
PID 2376 wrote to memory of 904	2376	igfxdct32.exe	41
PID 2376 wrote to memory of 904	2376	igfxdct32.exe	41
PID 2376 wrote to memory of 904	2376	igfxdct32.exe	41
PID 2376 wrote to memory of 904	2376	igfxdct32.exe	41
PID 904 wrote to memory of 628	904	igfxdct32.exe	42
PID 904 wrote to memory of 628	904	igfxdct32.exe	42
PID 904 wrote to memory of 628	904	igfxdct32.exe	42
PID 904 wrote to memory of 628	904	igfxdct32.exe	42
PID 628 wrote to memory of 1340	628	igfxdct32.exe	43
PID 628 wrote to memory of 1340	628	igfxdct32.exe	43
PID 628 wrote to memory of 1340	628	igfxdct32.exe	43
PID 628 wrote to memory of 1340	628	igfxdct32.exe	43
PID 1340 wrote to memory of 888	1340	igfxdct32.exe	44
PID 1340 wrote to memory of 888	1340	igfxdct32.exe	44
PID 1340 wrote to memory of 888	1340	igfxdct32.exe	44
PID 1340 wrote to memory of 888	1340	igfxdct32.exe	44
PID 888 wrote to memory of 2560	888	igfxdct32.exe	45
PID 888 wrote to memory of 2560	888	igfxdct32.exe	45
PID 888 wrote to memory of 2560	888	igfxdct32.exe	45
PID 888 wrote to memory of 2560	888	igfxdct32.exe	45
PID 2560 wrote to memory of 2276	2560	igfxdct32.exe	46
PID 2560 wrote to memory of 2276	2560	igfxdct32.exe	46
PID 2560 wrote to memory of 2276	2560	igfxdct32.exe	46
PID 2560 wrote to memory of 2276	2560	igfxdct32.exe	46

C:\Users\Admin\AppData\Local\Temp\9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9f442fbd0d524ace9f540c38751d7c2e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\igfxdct32.exe
  "C:\Windows\system32\igfxdct32.exe" C:\Users\Admin\AppData\Local\Temp\9F442F~1.EXE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\SysWOW64\igfxdct32.exe
    "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Maps connected drives based on registry
    - Drops file in System32 directory
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2888
  - - C:\Windows\SysWOW64\igfxdct32.exe
      "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2904
    - - C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2688
      - C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1492
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2812
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1656
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2972
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2468
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2376
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:904
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:628
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1340
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:888
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2560
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2276
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:1308
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        19⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2944
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2348
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2740
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        22⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2892
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        23⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2612
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        24⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2396
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        25⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2680
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        26⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:1104
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        27⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2852
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        28⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2940
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        29⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:1368
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        30⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2980
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        31⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2228
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        32⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2400
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        33⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:1624
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        34⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2344
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        35⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2056
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        36⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:344
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        37⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2104
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        38⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2296
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        39⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:1916
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        40⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:1136
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        41⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:1732
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        42⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2736
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        43⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2880
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        44⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:3060
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        45⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2308
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        46⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2480
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        47⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:2908
        
        C:\Windows\SysWOW64\igfxdct32.exe
        
        "C:\Windows\system32\igfxdct32.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE
        48⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\igfxdct32.exe

Filesize
246KB

MD5
9f442fbd0d524ace9f540c38751d7c2e

SHA1
fc0a7dc9421d8817c47d0c279d2b11801f95733a

SHA256
15340ef62f68faa89580da965333eade30a56dd50ec961089801e3e56ab7c333

SHA512
0ca1c52eb1fb0532456354c7fd2a8b6e2cb90276c5e61d211be1d37cb21a1ee1613f6e0bfeac8562b9ef2d1ed27cf01b2c761d3d779e259a562a13b2c23ad9b5

Download Submit
memory/344-215-0x0000000003230000-0x00000000032C4000-memory.dmp

Filesize
592KB

Download
memory/344-213-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/344-218-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/628-117-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/628-108-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/888-131-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/904-110-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/904-106-0x00000000034D0000-0x0000000003564000-memory.dmp

Filesize
592KB

Download
memory/904-102-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1104-180-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1136-233-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1308-150-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1308-153-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1340-125-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1340-121-0x0000000003630000-0x00000000036C4000-memory.dmp

Filesize
592KB

Download
memory/1340-118-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1368-190-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1492-61-0x0000000003270000-0x0000000003304000-memory.dmp

Filesize
592KB

Download
memory/1492-62-0x0000000003270000-0x0000000003304000-memory.dmp

Filesize
592KB

Download
memory/1492-64-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1492-55-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1624-202-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1624-205-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1656-69-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1656-76-0x0000000004900000-0x0000000004994000-memory.dmp

Filesize
592KB

Download
memory/1656-75-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1732-236-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1908-10-0x0000000003470000-0x0000000003504000-memory.dmp

Filesize
592KB

Download
memory/1908-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1908-2-0x00000000001B0000-0x00000000001B4000-memory.dmp

Filesize
16KB

Download
memory/1908-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1908-4-0x0000000000478000-0x0000000000493000-memory.dmp

Filesize
108KB

Download
memory/1908-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1908-18-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1916-227-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1916-230-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2056-212-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2104-221-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2104-216-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2228-197-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2276-141-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2276-149-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2276-145-0x00000000031A0000-0x0000000003234000-memory.dmp

Filesize
592KB

Download
memory/2296-222-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2296-225-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2296-226-0x0000000003600000-0x0000000003694000-memory.dmp

Filesize
592KB

Download
memory/2308-248-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2308-251-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2344-208-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2344-206-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2348-160-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2376-95-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2376-100-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2396-175-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2396-172-0x0000000003440000-0x00000000034D4000-memory.dmp

Filesize
592KB

Download
memory/2400-198-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2400-201-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2468-86-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2468-90-0x0000000004A30000-0x0000000004AC4000-memory.dmp

Filesize
592KB

Download
memory/2468-93-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2468-89-0x0000000004A30000-0x0000000004AC4000-memory.dmp

Filesize
592KB

Download
memory/2560-133-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2560-135-0x0000000003280000-0x0000000003314000-memory.dmp

Filesize
592KB

Download
memory/2560-140-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2612-171-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2680-178-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2688-48-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2688-54-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2736-238-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2736-241-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2740-162-0x00000000032A0000-0x0000000003334000-memory.dmp

Filesize
592KB

Download
memory/2740-164-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2812-71-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2852-237-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2852-183-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2888-36-0x00000000031D0000-0x0000000003264000-memory.dmp

Filesize
592KB

Download
memory/2888-37-0x00000000031D0000-0x0000000003264000-memory.dmp

Filesize
592KB

Download
memory/2888-40-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2888-29-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2892-166-0x0000000003550000-0x00000000035E4000-memory.dmp

Filesize
592KB

Download
memory/2892-168-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2904-47-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2904-38-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2940-187-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2940-184-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2944-157-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2972-79-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2972-85-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2980-194-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/2980-191-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3052-31-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3052-28-0x0000000003270000-0x0000000003304000-memory.dmp

Filesize
592KB

Download
memory/3052-21-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3052-20-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3052-19-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3052-26-0x0000000003270000-0x0000000003304000-memory.dmp

Filesize
592KB

Download
memory/3060-244-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3060-247-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download