Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2024 03:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c08f8d4e6b83474a05e2de1e2ca11769_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
c08f8d4e6b83474a05e2de1e2ca11769_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
c08f8d4e6b83474a05e2de1e2ca11769_JaffaCakes118.exe
-
Size
222KB
-
MD5
c08f8d4e6b83474a05e2de1e2ca11769
-
SHA1
5e04db1bfee9af6d4dbf510cb0eb9ce302b93e32
-
SHA256
e7f1e5627aeaed7d0badf27e0c5c40f4d505e7620a4251ab40f9c6d9b3f58a5a
-
SHA512
aef5b9a1ec5441e741f5ef7b04cf6975845f028a5de69c0265c9eef2c1b836d1eb22b8094779a414e4e4a72bdf5a6369fb240cc066fe71122d2e78ba676936da
-
SSDEEP
3072:IA8oq1KxZ2pfOutpE1x0liTRhohMRWWnQZDAhAkvr/skjGdOpdaPLAYvru5D6Y7L:f4WZKvk6Woh0jAWTsesS5uT+MOq
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Checks computer location settings 2 TTPs 40 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation c08f8d4e6b83474a05e2de1e2ca11769_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation igfxdpr32.exe -
Deletes itself 1 IoCs
pid Process 2000 igfxdpr32.exe -
Executes dropped EXE 40 IoCs
pid Process 2000 igfxdpr32.exe 380 igfxdpr32.exe 2236 igfxdpr32.exe 2784 igfxdpr32.exe 4904 igfxdpr32.exe 5104 igfxdpr32.exe 4020 igfxdpr32.exe 1484 igfxdpr32.exe 2416 igfxdpr32.exe 2044 igfxdpr32.exe 2132 igfxdpr32.exe 1616 igfxdpr32.exe 404 igfxdpr32.exe 2568 igfxdpr32.exe 4412 igfxdpr32.exe 3384 igfxdpr32.exe 1708 igfxdpr32.exe 4008 igfxdpr32.exe 4164 igfxdpr32.exe 4048 igfxdpr32.exe 1972 igfxdpr32.exe 2432 igfxdpr32.exe 2668 igfxdpr32.exe 2740 igfxdpr32.exe 3392 igfxdpr32.exe 2628 igfxdpr32.exe 4072 igfxdpr32.exe 4596 igfxdpr32.exe 4828 igfxdpr32.exe 2364 igfxdpr32.exe 2188 igfxdpr32.exe 3388 igfxdpr32.exe 4668 igfxdpr32.exe 2896 igfxdpr32.exe 2000 igfxdpr32.exe 2308 igfxdpr32.exe 4972 igfxdpr32.exe 4968 igfxdpr32.exe 3648 igfxdpr32.exe 216 igfxdpr32.exe -
Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdpr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdpr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 c08f8d4e6b83474a05e2de1e2ca11769_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdpr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdpr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdpr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdpr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdpr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdpr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum c08f8d4e6b83474a05e2de1e2ca11769_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdpr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdpr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdpr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdpr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdpr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdpr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdpr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdpr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdpr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdpr32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File created C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File created C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdpr32.exe File created C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdpr32.exe File created C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdpr32.exe File created C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File created C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File created C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File created C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File created C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdpr32.exe File created C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File created C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\igfxdpr32.exe c08f8d4e6b83474a05e2de1e2ca11769_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ igfxdpr32.exe File created C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File created C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File created C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File created C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdpr32.exe File created C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File created C:\Windows\SysWOW64\igfxdpr32.exe c08f8d4e6b83474a05e2de1e2ca11769_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdpr32.exe File created C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdpr32.exe File created C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File created C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File created C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdpr32.exe File created C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File created C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File created C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File created C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdpr32.exe File opened for modification C:\Windows\SysWOW64\igfxdpr32.exe igfxdpr32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 40 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c08f8d4e6b83474a05e2de1e2ca11769_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdpr32.exe -
Modifies registry class 40 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ c08f8d4e6b83474a05e2de1e2ca11769_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdpr32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3876 c08f8d4e6b83474a05e2de1e2ca11769_JaffaCakes118.exe 3876 c08f8d4e6b83474a05e2de1e2ca11769_JaffaCakes118.exe 2000 igfxdpr32.exe 2000 igfxdpr32.exe 380 igfxdpr32.exe 380 igfxdpr32.exe 2236 igfxdpr32.exe 2236 igfxdpr32.exe 2784 igfxdpr32.exe 2784 igfxdpr32.exe 4904 igfxdpr32.exe 4904 igfxdpr32.exe 5104 igfxdpr32.exe 5104 igfxdpr32.exe 4020 igfxdpr32.exe 4020 igfxdpr32.exe 1484 igfxdpr32.exe 1484 igfxdpr32.exe 2416 igfxdpr32.exe 2416 igfxdpr32.exe 2044 igfxdpr32.exe 2044 igfxdpr32.exe 2132 igfxdpr32.exe 2132 igfxdpr32.exe 1616 igfxdpr32.exe 1616 igfxdpr32.exe 404 igfxdpr32.exe 404 igfxdpr32.exe 2568 igfxdpr32.exe 2568 igfxdpr32.exe 4412 igfxdpr32.exe 4412 igfxdpr32.exe 3384 igfxdpr32.exe 3384 igfxdpr32.exe 1708 igfxdpr32.exe 1708 igfxdpr32.exe 4008 igfxdpr32.exe 4008 igfxdpr32.exe 4164 igfxdpr32.exe 4164 igfxdpr32.exe 4048 igfxdpr32.exe 4048 igfxdpr32.exe 1972 igfxdpr32.exe 1972 igfxdpr32.exe 2432 igfxdpr32.exe 2432 igfxdpr32.exe 2668 igfxdpr32.exe 2668 igfxdpr32.exe 2740 igfxdpr32.exe 2740 igfxdpr32.exe 3392 igfxdpr32.exe 3392 igfxdpr32.exe 2628 igfxdpr32.exe 2628 igfxdpr32.exe 4072 igfxdpr32.exe 4072 igfxdpr32.exe 4596 igfxdpr32.exe 4596 igfxdpr32.exe 4828 igfxdpr32.exe 4828 igfxdpr32.exe 2364 igfxdpr32.exe 2364 igfxdpr32.exe 2188 igfxdpr32.exe 2188 igfxdpr32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3876 wrote to memory of 2000 3876 c08f8d4e6b83474a05e2de1e2ca11769_JaffaCakes118.exe 84 PID 3876 wrote to memory of 2000 3876 c08f8d4e6b83474a05e2de1e2ca11769_JaffaCakes118.exe 84 PID 3876 wrote to memory of 2000 3876 c08f8d4e6b83474a05e2de1e2ca11769_JaffaCakes118.exe 84 PID 2000 wrote to memory of 380 2000 igfxdpr32.exe 89 PID 2000 wrote to memory of 380 2000 igfxdpr32.exe 89 PID 2000 wrote to memory of 380 2000 igfxdpr32.exe 89 PID 380 wrote to memory of 2236 380 igfxdpr32.exe 94 PID 380 wrote to memory of 2236 380 igfxdpr32.exe 94 PID 380 wrote to memory of 2236 380 igfxdpr32.exe 94 PID 2236 wrote to memory of 2784 2236 igfxdpr32.exe 99 PID 2236 wrote to memory of 2784 2236 igfxdpr32.exe 99 PID 2236 wrote to memory of 2784 2236 igfxdpr32.exe 99 PID 2784 wrote to memory of 4904 2784 igfxdpr32.exe 100 PID 2784 wrote to memory of 4904 2784 igfxdpr32.exe 100 PID 2784 wrote to memory of 4904 2784 igfxdpr32.exe 100 PID 4904 wrote to memory of 5104 4904 igfxdpr32.exe 101 PID 4904 wrote to memory of 5104 4904 igfxdpr32.exe 101 PID 4904 wrote to memory of 5104 4904 igfxdpr32.exe 101 PID 5104 wrote to memory of 4020 5104 igfxdpr32.exe 102 PID 5104 wrote to memory of 4020 5104 igfxdpr32.exe 102 PID 5104 wrote to memory of 4020 5104 igfxdpr32.exe 102 PID 4020 wrote to memory of 1484 4020 igfxdpr32.exe 103 PID 4020 wrote to memory of 1484 4020 igfxdpr32.exe 103 PID 4020 wrote to memory of 1484 4020 igfxdpr32.exe 103 PID 1484 wrote to memory of 2416 1484 igfxdpr32.exe 106 PID 1484 wrote to memory of 2416 1484 igfxdpr32.exe 106 PID 1484 wrote to memory of 2416 1484 igfxdpr32.exe 106 PID 2416 wrote to memory of 2044 2416 igfxdpr32.exe 108 PID 2416 wrote to memory of 2044 2416 igfxdpr32.exe 108 PID 2416 wrote to memory of 2044 2416 igfxdpr32.exe 108 PID 2044 wrote to memory of 2132 2044 igfxdpr32.exe 109 PID 2044 wrote to memory of 2132 2044 igfxdpr32.exe 109 PID 2044 wrote to memory of 2132 2044 igfxdpr32.exe 109 PID 2132 wrote to memory of 1616 2132 igfxdpr32.exe 110 PID 2132 wrote to memory of 1616 2132 igfxdpr32.exe 110 PID 2132 wrote to memory of 1616 2132 igfxdpr32.exe 110 PID 1616 wrote to memory of 404 1616 igfxdpr32.exe 111 PID 1616 wrote to memory of 404 1616 igfxdpr32.exe 111 PID 1616 wrote to memory of 404 1616 igfxdpr32.exe 111 PID 404 wrote to memory of 2568 404 igfxdpr32.exe 112 PID 404 wrote to memory of 2568 404 igfxdpr32.exe 112 PID 404 wrote to memory of 2568 404 igfxdpr32.exe 112 PID 2568 wrote to memory of 4412 2568 igfxdpr32.exe 113 PID 2568 wrote to memory of 4412 2568 igfxdpr32.exe 113 PID 2568 wrote to memory of 4412 2568 igfxdpr32.exe 113 PID 4412 wrote to memory of 3384 4412 igfxdpr32.exe 114 PID 4412 wrote to memory of 3384 4412 igfxdpr32.exe 114 PID 4412 wrote to memory of 3384 4412 igfxdpr32.exe 114 PID 3384 wrote to memory of 1708 3384 igfxdpr32.exe 116 PID 3384 wrote to memory of 1708 3384 igfxdpr32.exe 116 PID 3384 wrote to memory of 1708 3384 igfxdpr32.exe 116 PID 1708 wrote to memory of 4008 1708 igfxdpr32.exe 117 PID 1708 wrote to memory of 4008 1708 igfxdpr32.exe 117 PID 1708 wrote to memory of 4008 1708 igfxdpr32.exe 117 PID 4008 wrote to memory of 4164 4008 igfxdpr32.exe 118 PID 4008 wrote to memory of 4164 4008 igfxdpr32.exe 118 PID 4008 wrote to memory of 4164 4008 igfxdpr32.exe 118 PID 4164 wrote to memory of 4048 4164 igfxdpr32.exe 119 PID 4164 wrote to memory of 4048 4164 igfxdpr32.exe 119 PID 4164 wrote to memory of 4048 4164 igfxdpr32.exe 119 PID 4048 wrote to memory of 1972 4048 igfxdpr32.exe 120 PID 4048 wrote to memory of 1972 4048 igfxdpr32.exe 120 PID 4048 wrote to memory of 1972 4048 igfxdpr32.exe 120 PID 1972 wrote to memory of 2432 1972 igfxdpr32.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\c08f8d4e6b83474a05e2de1e2ca11769_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c08f8d4e6b83474a05e2de1e2ca11769_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Users\Admin\AppData\Local\Temp\C08F8D~1.EXE2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE3⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE4⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE5⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE7⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE9⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE11⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE13⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE15⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE17⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE19⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE21⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE23⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2432 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2668 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE25⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2740 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3392 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE27⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2628 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4072 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE29⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4596 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE30⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4828 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE31⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2364 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE32⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2188 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE33⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3388 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE34⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4668 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE35⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2896 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE36⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2000 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE37⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2308 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE38⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4972 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE39⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4968 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE40⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3648 -
C:\Windows\SysWOW64\igfxdpr32.exe"C:\Windows\system32\igfxdpr32.exe" C:\Windows\SysWOW64\IGFXDP~1.EXE41⤵
- Executes dropped EXE
- Maps connected drives based on registry
PID:216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
222KB
MD5c08f8d4e6b83474a05e2de1e2ca11769
SHA15e04db1bfee9af6d4dbf510cb0eb9ce302b93e32
SHA256e7f1e5627aeaed7d0badf27e0c5c40f4d505e7620a4251ab40f9c6d9b3f58a5a
SHA512aef5b9a1ec5441e741f5ef7b04cf6975845f028a5de69c0265c9eef2c1b836d1eb22b8094779a414e4e4a72bdf5a6369fb240cc066fe71122d2e78ba676936da