Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2024 16:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
120 seconds
General
-
Target
2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe
-
Size
169KB
-
MD5
92428e3a757b25e7fbf0787d83fa5050
-
SHA1
b2d3b10938d1d84d491d09219efe1875b315cc80
-
SHA256
2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684
-
SHA512
eac3766c1046b5f92d32ca6d44bbabd320fd74062cc62e8c01399cebd78e9fc2473f55ca96cf9e2bea2b7e7cc8cb183bcfb89e4dab9c48645d1ba1fda43e3351
-
SSDEEP
3072:B6OqYQ2555kfoTKw3ADWDzj/t5HV/5vY364CFQinHPAk7jI3pQSUKV:WYQKMoTKFuz1/Pe1V
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Checks computer location settings 2 TTPs 11 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation igfxwt32.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation igfxwt32.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation igfxwt32.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation igfxwt32.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation igfxwt32.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation igfxwt32.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation igfxwt32.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation igfxwt32.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation igfxwt32.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation 2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation igfxwt32.exe -
Deletes itself 1 IoCs
pid Process 644 igfxwt32.exe -
Executes dropped EXE 22 IoCs
pid Process 5096 igfxwt32.exe 644 igfxwt32.exe 768 igfxwt32.exe 3496 igfxwt32.exe 2712 igfxwt32.exe 4144 igfxwt32.exe 3580 igfxwt32.exe 4168 igfxwt32.exe 4548 igfxwt32.exe 4520 igfxwt32.exe 4696 igfxwt32.exe 928 igfxwt32.exe 3128 igfxwt32.exe 1444 igfxwt32.exe 4616 igfxwt32.exe 4060 igfxwt32.exe 1080 igfxwt32.exe 2244 igfxwt32.exe 4296 igfxwt32.exe 672 igfxwt32.exe 3536 igfxwt32.exe 1968 igfxwt32.exe -
Maps connected drives based on registry 3 TTPs 24 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwt32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxwt32.exe -
Drops file in System32 directory 33 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ igfxwt32.exe File opened for modification C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\ igfxwt32.exe File created C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\ igfxwt32.exe File created C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\ igfxwt32.exe File opened for modification C:\Windows\SysWOW64\ igfxwt32.exe File created C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File created C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File created C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File created C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File created C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\igfxwt32.exe 2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe File created C:\Windows\SysWOW64\igfxwt32.exe 2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe File created C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\ igfxwt32.exe File opened for modification C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\ 2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe File opened for modification C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\ igfxwt32.exe File opened for modification C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\ igfxwt32.exe File created C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File created C:\Windows\SysWOW64\igfxwt32.exe igfxwt32.exe File opened for modification C:\Windows\SysWOW64\ igfxwt32.exe File opened for modification C:\Windows\SysWOW64\ igfxwt32.exe -
Suspicious use of SetThreadContext 12 IoCs
description pid Process procid_target PID 2228 set thread context of 3740 2228 2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe 86 PID 5096 set thread context of 644 5096 igfxwt32.exe 91 PID 768 set thread context of 3496 768 igfxwt32.exe 93 PID 2712 set thread context of 4144 2712 igfxwt32.exe 97 PID 3580 set thread context of 4168 3580 igfxwt32.exe 99 PID 4548 set thread context of 4520 4548 igfxwt32.exe 101 PID 4696 set thread context of 928 4696 igfxwt32.exe 103 PID 3128 set thread context of 1444 3128 igfxwt32.exe 105 PID 4616 set thread context of 4060 4616 igfxwt32.exe 107 PID 1080 set thread context of 2244 1080 igfxwt32.exe 109 PID 4296 set thread context of 672 4296 igfxwt32.exe 111 PID 3536 set thread context of 1968 3536 igfxwt32.exe 113 -
resource yara_rule behavioral2/memory/3740-0-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/3740-2-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/3740-3-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/3740-4-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/3740-38-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/644-43-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/644-44-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/644-45-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/644-46-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/3496-54-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/4144-61-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/4144-63-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/4168-70-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/4520-77-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/928-83-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/1444-94-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/4060-100-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/2244-110-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/672-115-0x0000000000400000-0x0000000000467000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwt32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxwt32.exe -
Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwt32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwt32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwt32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwt32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwt32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwt32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwt32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwt32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwt32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxwt32.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 3740 2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe 3740 2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe 3740 2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe 3740 2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe 644 igfxwt32.exe 644 igfxwt32.exe 644 igfxwt32.exe 644 igfxwt32.exe 3496 igfxwt32.exe 3496 igfxwt32.exe 3496 igfxwt32.exe 3496 igfxwt32.exe 4144 igfxwt32.exe 4144 igfxwt32.exe 4144 igfxwt32.exe 4144 igfxwt32.exe 4168 igfxwt32.exe 4168 igfxwt32.exe 4168 igfxwt32.exe 4168 igfxwt32.exe 4520 igfxwt32.exe 4520 igfxwt32.exe 4520 igfxwt32.exe 4520 igfxwt32.exe 928 igfxwt32.exe 928 igfxwt32.exe 928 igfxwt32.exe 928 igfxwt32.exe 1444 igfxwt32.exe 1444 igfxwt32.exe 1444 igfxwt32.exe 1444 igfxwt32.exe 4060 igfxwt32.exe 4060 igfxwt32.exe 4060 igfxwt32.exe 4060 igfxwt32.exe 2244 igfxwt32.exe 2244 igfxwt32.exe 2244 igfxwt32.exe 2244 igfxwt32.exe 672 igfxwt32.exe 672 igfxwt32.exe 672 igfxwt32.exe 672 igfxwt32.exe 1968 igfxwt32.exe 1968 igfxwt32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2228 wrote to memory of 3740 2228 2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe 86 PID 2228 wrote to memory of 3740 2228 2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe 86 PID 2228 wrote to memory of 3740 2228 2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe 86 PID 2228 wrote to memory of 3740 2228 2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe 86 PID 2228 wrote to memory of 3740 2228 2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe 86 PID 2228 wrote to memory of 3740 2228 2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe 86 PID 2228 wrote to memory of 3740 2228 2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe 86 PID 3740 wrote to memory of 5096 3740 2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe 88 PID 3740 wrote to memory of 5096 3740 2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe 88 PID 3740 wrote to memory of 5096 3740 2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe 88 PID 5096 wrote to memory of 644 5096 igfxwt32.exe 91 PID 5096 wrote to memory of 644 5096 igfxwt32.exe 91 PID 5096 wrote to memory of 644 5096 igfxwt32.exe 91 PID 5096 wrote to memory of 644 5096 igfxwt32.exe 91 PID 5096 wrote to memory of 644 5096 igfxwt32.exe 91 PID 5096 wrote to memory of 644 5096 igfxwt32.exe 91 PID 5096 wrote to memory of 644 5096 igfxwt32.exe 91 PID 644 wrote to memory of 768 644 igfxwt32.exe 92 PID 644 wrote to memory of 768 644 igfxwt32.exe 92 PID 644 wrote to memory of 768 644 igfxwt32.exe 92 PID 768 wrote to memory of 3496 768 igfxwt32.exe 93 PID 768 wrote to memory of 3496 768 igfxwt32.exe 93 PID 768 wrote to memory of 3496 768 igfxwt32.exe 93 PID 768 wrote to memory of 3496 768 igfxwt32.exe 93 PID 768 wrote to memory of 3496 768 igfxwt32.exe 93 PID 768 wrote to memory of 3496 768 igfxwt32.exe 93 PID 768 wrote to memory of 3496 768 igfxwt32.exe 93 PID 3496 wrote to memory of 2712 3496 igfxwt32.exe 95 PID 3496 wrote to memory of 2712 3496 igfxwt32.exe 95 PID 3496 wrote to memory of 2712 3496 igfxwt32.exe 95 PID 2712 wrote to memory of 4144 2712 igfxwt32.exe 97 PID 2712 wrote to memory of 4144 2712 igfxwt32.exe 97 PID 2712 wrote to memory of 4144 2712 igfxwt32.exe 97 PID 2712 wrote to memory of 4144 2712 igfxwt32.exe 97 PID 2712 wrote to memory of 4144 2712 igfxwt32.exe 97 PID 2712 wrote to memory of 4144 2712 igfxwt32.exe 97 PID 2712 wrote to memory of 4144 2712 igfxwt32.exe 97 PID 4144 wrote to memory of 3580 4144 igfxwt32.exe 98 PID 4144 wrote to memory of 3580 4144 igfxwt32.exe 98 PID 4144 wrote to memory of 3580 4144 igfxwt32.exe 98 PID 3580 wrote to memory of 4168 3580 igfxwt32.exe 99 PID 3580 wrote to memory of 4168 3580 igfxwt32.exe 99 PID 3580 wrote to memory of 4168 3580 igfxwt32.exe 99 PID 3580 wrote to memory of 4168 3580 igfxwt32.exe 99 PID 3580 wrote to memory of 4168 3580 igfxwt32.exe 99 PID 3580 wrote to memory of 4168 3580 igfxwt32.exe 99 PID 3580 wrote to memory of 4168 3580 igfxwt32.exe 99 PID 4168 wrote to memory of 4548 4168 igfxwt32.exe 100 PID 4168 wrote to memory of 4548 4168 igfxwt32.exe 100 PID 4168 wrote to memory of 4548 4168 igfxwt32.exe 100 PID 4548 wrote to memory of 4520 4548 igfxwt32.exe 101 PID 4548 wrote to memory of 4520 4548 igfxwt32.exe 101 PID 4548 wrote to memory of 4520 4548 igfxwt32.exe 101 PID 4548 wrote to memory of 4520 4548 igfxwt32.exe 101 PID 4548 wrote to memory of 4520 4548 igfxwt32.exe 101 PID 4548 wrote to memory of 4520 4548 igfxwt32.exe 101 PID 4548 wrote to memory of 4520 4548 igfxwt32.exe 101 PID 4520 wrote to memory of 4696 4520 igfxwt32.exe 102 PID 4520 wrote to memory of 4696 4520 igfxwt32.exe 102 PID 4520 wrote to memory of 4696 4520 igfxwt32.exe 102 PID 4696 wrote to memory of 928 4696 igfxwt32.exe 103 PID 4696 wrote to memory of 928 4696 igfxwt32.exe 103 PID 4696 wrote to memory of 928 4696 igfxwt32.exe 103 PID 4696 wrote to memory of 928 4696 igfxwt32.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe"C:\Users\Admin\AppData\Local\Temp\2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe"C:\Users\Admin\AppData\Local\Temp\2b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684N.exe"2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Users\Admin\AppData\Local\Temp\2B69AA~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Users\Admin\AppData\Local\Temp\2B69AA~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:928 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3128 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1444 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4616 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4060 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1080 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2244 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4296 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:672 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3536 -
C:\Windows\SysWOW64\igfxwt32.exe"C:\Windows\system32\igfxwt32.exe" C:\Windows\SysWOW64\igfxwt32.exe24⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:1968
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
169KB
MD592428e3a757b25e7fbf0787d83fa5050
SHA1b2d3b10938d1d84d491d09219efe1875b315cc80
SHA2562b69aa3ac5c213f530258e6c74882d50009c82f3b86c01cecf5ab8a9ceb2b684
SHA512eac3766c1046b5f92d32ca6d44bbabd320fd74062cc62e8c01399cebd78e9fc2473f55ca96cf9e2bea2b7e7cc8cb183bcfb89e4dab9c48645d1ba1fda43e3351