Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-12-2024 21:31
Behavioral task
behavioral1
Sample
c479afa77b1de75b7648d016259082e8_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
c479afa77b1de75b7648d016259082e8_JaffaCakes118.exe
-
Size
212KB
-
MD5
c479afa77b1de75b7648d016259082e8
-
SHA1
1c9a3e23852e21ef93a689365be46dc3bef7e6d9
-
SHA256
c19fc11b89220dcc016678782dac60363a119a6a7f3502a17d42739724bf7ec9
-
SHA512
0177eedc9683f3764487f110b6f1a0e0c762e9569204043033b4c8fba35644085f7ce623eca33d60a8d25770aa5ac35a688d925ff772f9d113fb212c1b08dddc
-
SSDEEP
6144:uXFpUB2wq8pR3FyZ/Onhlqnnev8uxmOCUVdn6:uXF6B298pG/OhlAg8ugUVdn6
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Deletes itself 1 IoCs
pid Process 1768 igfxdm32.exe -
Executes dropped EXE 47 IoCs
pid Process 1768 igfxdm32.exe 2756 igfxdm32.exe 2928 igfxdm32.exe 2596 igfxdm32.exe 3068 igfxdm32.exe 892 igfxdm32.exe 1184 igfxdm32.exe 2100 igfxdm32.exe 1044 igfxdm32.exe 2944 igfxdm32.exe 2268 igfxdm32.exe 1856 igfxdm32.exe 2916 igfxdm32.exe 1200 igfxdm32.exe 1524 igfxdm32.exe 1040 igfxdm32.exe 2424 igfxdm32.exe 1284 igfxdm32.exe 1448 igfxdm32.exe 2876 igfxdm32.exe 2568 igfxdm32.exe 2836 igfxdm32.exe 2560 igfxdm32.exe 2800 igfxdm32.exe 2980 igfxdm32.exe 2768 igfxdm32.exe 2388 igfxdm32.exe 2700 igfxdm32.exe 2496 igfxdm32.exe 1864 igfxdm32.exe 2040 igfxdm32.exe 1992 igfxdm32.exe 2280 igfxdm32.exe 2188 igfxdm32.exe 1036 igfxdm32.exe 752 igfxdm32.exe 2636 igfxdm32.exe 1200 igfxdm32.exe 1840 igfxdm32.exe 2200 igfxdm32.exe 868 igfxdm32.exe 1560 igfxdm32.exe 2524 igfxdm32.exe 2536 igfxdm32.exe 2356 igfxdm32.exe 2808 igfxdm32.exe 924 igfxdm32.exe -
Loads dropped DLL 64 IoCs
pid Process 2124 c479afa77b1de75b7648d016259082e8_JaffaCakes118.exe 2124 c479afa77b1de75b7648d016259082e8_JaffaCakes118.exe 1768 igfxdm32.exe 1768 igfxdm32.exe 2756 igfxdm32.exe 2756 igfxdm32.exe 2928 igfxdm32.exe 2928 igfxdm32.exe 2596 igfxdm32.exe 2596 igfxdm32.exe 3068 igfxdm32.exe 3068 igfxdm32.exe 892 igfxdm32.exe 892 igfxdm32.exe 1184 igfxdm32.exe 1184 igfxdm32.exe 2100 igfxdm32.exe 2100 igfxdm32.exe 1044 igfxdm32.exe 1044 igfxdm32.exe 2944 igfxdm32.exe 2944 igfxdm32.exe 2268 igfxdm32.exe 2268 igfxdm32.exe 1856 igfxdm32.exe 1856 igfxdm32.exe 2916 igfxdm32.exe 2916 igfxdm32.exe 1200 igfxdm32.exe 1200 igfxdm32.exe 1524 igfxdm32.exe 1524 igfxdm32.exe 1040 igfxdm32.exe 1040 igfxdm32.exe 2424 igfxdm32.exe 2424 igfxdm32.exe 1284 igfxdm32.exe 1284 igfxdm32.exe 1448 igfxdm32.exe 1448 igfxdm32.exe 2876 igfxdm32.exe 2876 igfxdm32.exe 2568 igfxdm32.exe 2568 igfxdm32.exe 2836 igfxdm32.exe 2836 igfxdm32.exe 2560 igfxdm32.exe 2560 igfxdm32.exe 2800 igfxdm32.exe 2800 igfxdm32.exe 2980 igfxdm32.exe 2980 igfxdm32.exe 2768 igfxdm32.exe 2768 igfxdm32.exe 2388 igfxdm32.exe 2388 igfxdm32.exe 2700 igfxdm32.exe 2700 igfxdm32.exe 2496 igfxdm32.exe 2496 igfxdm32.exe 1864 igfxdm32.exe 1864 igfxdm32.exe 2040 igfxdm32.exe 2040 igfxdm32.exe -
Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum c479afa77b1de75b7648d016259082e8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 c479afa77b1de75b7648d016259082e8_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdm32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdm32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File created C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File created C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File created C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File created C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\ igfxdm32.exe File opened for modification C:\Windows\SysWOW64\ igfxdm32.exe File opened for modification C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File created C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File created C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File created C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\ igfxdm32.exe File opened for modification C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\ igfxdm32.exe File created C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\ igfxdm32.exe File created C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\ igfxdm32.exe File created C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\ igfxdm32.exe File created C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\ igfxdm32.exe File opened for modification C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\ igfxdm32.exe File created C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\ igfxdm32.exe File created C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\ igfxdm32.exe File created C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\ igfxdm32.exe File opened for modification C:\Windows\SysWOW64\ igfxdm32.exe File opened for modification C:\Windows\SysWOW64\ igfxdm32.exe File opened for modification C:\Windows\SysWOW64\ igfxdm32.exe File opened for modification C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File created C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File created C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File created C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\ igfxdm32.exe File opened for modification C:\Windows\SysWOW64\ igfxdm32.exe File created C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\ igfxdm32.exe File created C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File created C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\ igfxdm32.exe File created C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File created C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File created C:\Windows\SysWOW64\igfxdm32.exe igfxdm32.exe File opened for modification C:\Windows\SysWOW64\ igfxdm32.exe File opened for modification C:\Windows\SysWOW64\ igfxdm32.exe -
resource yara_rule behavioral1/memory/2124-0-0x0000000013110000-0x000000001318B000-memory.dmp upx behavioral1/files/0x0007000000012117-6.dat upx behavioral1/memory/1768-17-0x0000000013110000-0x000000001318B000-memory.dmp upx behavioral1/memory/1768-21-0x0000000004A90000-0x0000000004B0B000-memory.dmp upx behavioral1/memory/2928-31-0x0000000013110000-0x000000001318B000-memory.dmp upx behavioral1/memory/2876-125-0x0000000013110000-0x000000001318B000-memory.dmp upx behavioral1/memory/2568-128-0x0000000003460000-0x00000000034DB000-memory.dmp upx behavioral1/memory/2800-137-0x0000000003370000-0x00000000033EB000-memory.dmp upx behavioral1/memory/2768-141-0x0000000013110000-0x000000001318B000-memory.dmp upx behavioral1/memory/1864-150-0x0000000013110000-0x000000001318B000-memory.dmp upx behavioral1/memory/752-163-0x0000000013110000-0x000000001318B000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 48 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c479afa77b1de75b7648d016259082e8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdm32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2124 c479afa77b1de75b7648d016259082e8_JaffaCakes118.exe 2124 c479afa77b1de75b7648d016259082e8_JaffaCakes118.exe 1768 igfxdm32.exe 1768 igfxdm32.exe 2756 igfxdm32.exe 2756 igfxdm32.exe 2928 igfxdm32.exe 2928 igfxdm32.exe 2596 igfxdm32.exe 2596 igfxdm32.exe 3068 igfxdm32.exe 3068 igfxdm32.exe 892 igfxdm32.exe 892 igfxdm32.exe 1184 igfxdm32.exe 1184 igfxdm32.exe 2100 igfxdm32.exe 2100 igfxdm32.exe 1044 igfxdm32.exe 1044 igfxdm32.exe 2944 igfxdm32.exe 2944 igfxdm32.exe 2268 igfxdm32.exe 2268 igfxdm32.exe 1856 igfxdm32.exe 1856 igfxdm32.exe 2916 igfxdm32.exe 2916 igfxdm32.exe 1200 igfxdm32.exe 1200 igfxdm32.exe 1524 igfxdm32.exe 1524 igfxdm32.exe 1040 igfxdm32.exe 1040 igfxdm32.exe 2424 igfxdm32.exe 2424 igfxdm32.exe 1284 igfxdm32.exe 1284 igfxdm32.exe 1448 igfxdm32.exe 1448 igfxdm32.exe 2876 igfxdm32.exe 2876 igfxdm32.exe 2568 igfxdm32.exe 2568 igfxdm32.exe 2836 igfxdm32.exe 2836 igfxdm32.exe 2560 igfxdm32.exe 2560 igfxdm32.exe 2800 igfxdm32.exe 2800 igfxdm32.exe 2980 igfxdm32.exe 2980 igfxdm32.exe 2768 igfxdm32.exe 2768 igfxdm32.exe 2388 igfxdm32.exe 2388 igfxdm32.exe 2700 igfxdm32.exe 2700 igfxdm32.exe 2496 igfxdm32.exe 2496 igfxdm32.exe 1864 igfxdm32.exe 1864 igfxdm32.exe 2040 igfxdm32.exe 2040 igfxdm32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2124 wrote to memory of 1768 2124 c479afa77b1de75b7648d016259082e8_JaffaCakes118.exe 30 PID 2124 wrote to memory of 1768 2124 c479afa77b1de75b7648d016259082e8_JaffaCakes118.exe 30 PID 2124 wrote to memory of 1768 2124 c479afa77b1de75b7648d016259082e8_JaffaCakes118.exe 30 PID 2124 wrote to memory of 1768 2124 c479afa77b1de75b7648d016259082e8_JaffaCakes118.exe 30 PID 1768 wrote to memory of 2756 1768 igfxdm32.exe 32 PID 1768 wrote to memory of 2756 1768 igfxdm32.exe 32 PID 1768 wrote to memory of 2756 1768 igfxdm32.exe 32 PID 1768 wrote to memory of 2756 1768 igfxdm32.exe 32 PID 2756 wrote to memory of 2928 2756 igfxdm32.exe 33 PID 2756 wrote to memory of 2928 2756 igfxdm32.exe 33 PID 2756 wrote to memory of 2928 2756 igfxdm32.exe 33 PID 2756 wrote to memory of 2928 2756 igfxdm32.exe 33 PID 2928 wrote to memory of 2596 2928 igfxdm32.exe 34 PID 2928 wrote to memory of 2596 2928 igfxdm32.exe 34 PID 2928 wrote to memory of 2596 2928 igfxdm32.exe 34 PID 2928 wrote to memory of 2596 2928 igfxdm32.exe 34 PID 2596 wrote to memory of 3068 2596 igfxdm32.exe 35 PID 2596 wrote to memory of 3068 2596 igfxdm32.exe 35 PID 2596 wrote to memory of 3068 2596 igfxdm32.exe 35 PID 2596 wrote to memory of 3068 2596 igfxdm32.exe 35 PID 3068 wrote to memory of 892 3068 igfxdm32.exe 36 PID 3068 wrote to memory of 892 3068 igfxdm32.exe 36 PID 3068 wrote to memory of 892 3068 igfxdm32.exe 36 PID 3068 wrote to memory of 892 3068 igfxdm32.exe 36 PID 892 wrote to memory of 1184 892 igfxdm32.exe 37 PID 892 wrote to memory of 1184 892 igfxdm32.exe 37 PID 892 wrote to memory of 1184 892 igfxdm32.exe 37 PID 892 wrote to memory of 1184 892 igfxdm32.exe 37 PID 1184 wrote to memory of 2100 1184 igfxdm32.exe 38 PID 1184 wrote to memory of 2100 1184 igfxdm32.exe 38 PID 1184 wrote to memory of 2100 1184 igfxdm32.exe 38 PID 1184 wrote to memory of 2100 1184 igfxdm32.exe 38 PID 2100 wrote to memory of 1044 2100 igfxdm32.exe 39 PID 2100 wrote to memory of 1044 2100 igfxdm32.exe 39 PID 2100 wrote to memory of 1044 2100 igfxdm32.exe 39 PID 2100 wrote to memory of 1044 2100 igfxdm32.exe 39 PID 1044 wrote to memory of 2944 1044 igfxdm32.exe 40 PID 1044 wrote to memory of 2944 1044 igfxdm32.exe 40 PID 1044 wrote to memory of 2944 1044 igfxdm32.exe 40 PID 1044 wrote to memory of 2944 1044 igfxdm32.exe 40 PID 2944 wrote to memory of 2268 2944 igfxdm32.exe 41 PID 2944 wrote to memory of 2268 2944 igfxdm32.exe 41 PID 2944 wrote to memory of 2268 2944 igfxdm32.exe 41 PID 2944 wrote to memory of 2268 2944 igfxdm32.exe 41 PID 2268 wrote to memory of 1856 2268 igfxdm32.exe 42 PID 2268 wrote to memory of 1856 2268 igfxdm32.exe 42 PID 2268 wrote to memory of 1856 2268 igfxdm32.exe 42 PID 2268 wrote to memory of 1856 2268 igfxdm32.exe 42 PID 1856 wrote to memory of 2916 1856 igfxdm32.exe 43 PID 1856 wrote to memory of 2916 1856 igfxdm32.exe 43 PID 1856 wrote to memory of 2916 1856 igfxdm32.exe 43 PID 1856 wrote to memory of 2916 1856 igfxdm32.exe 43 PID 2916 wrote to memory of 1200 2916 igfxdm32.exe 44 PID 2916 wrote to memory of 1200 2916 igfxdm32.exe 44 PID 2916 wrote to memory of 1200 2916 igfxdm32.exe 44 PID 2916 wrote to memory of 1200 2916 igfxdm32.exe 44 PID 1200 wrote to memory of 1524 1200 igfxdm32.exe 45 PID 1200 wrote to memory of 1524 1200 igfxdm32.exe 45 PID 1200 wrote to memory of 1524 1200 igfxdm32.exe 45 PID 1200 wrote to memory of 1524 1200 igfxdm32.exe 45 PID 1524 wrote to memory of 1040 1524 igfxdm32.exe 46 PID 1524 wrote to memory of 1040 1524 igfxdm32.exe 46 PID 1524 wrote to memory of 1040 1524 igfxdm32.exe 46 PID 1524 wrote to memory of 1040 1524 igfxdm32.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\c479afa77b1de75b7648d016259082e8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c479afa77b1de75b7648d016259082e8_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Users\Admin\AppData\Local\Temp\C479AF~1.EXE2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1040 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2424 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1284 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1448 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2876 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2568 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2836 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2560 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2800 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2980 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2768 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2388 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2700 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2496 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1864 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2040 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe33⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1992 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe34⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2280 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe35⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2188 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe36⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1036 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe37⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:752 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe38⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2636 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe39⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1200 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe40⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1840 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe41⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2200 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe42⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:868 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe43⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1560 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe44⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2524 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe45⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2536 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe46⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2356 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe47⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2808 -
C:\Windows\SysWOW64\igfxdm32.exe"C:\Windows\system32\igfxdm32.exe" C:\Windows\SysWOW64\igfxdm32.exe48⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:924
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212KB
MD5c479afa77b1de75b7648d016259082e8
SHA11c9a3e23852e21ef93a689365be46dc3bef7e6d9
SHA256c19fc11b89220dcc016678782dac60363a119a6a7f3502a17d42739724bf7ec9
SHA5120177eedc9683f3764487f110b6f1a0e0c762e9569204043033b4c8fba35644085f7ce623eca33d60a8d25770aa5ac35a688d925ff772f9d113fb212c1b08dddc