Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/12/2024, 19:59
Static task
static1
Behavioral task
behavioral1
Sample
e2fdff574a795d5663d615e921b81f7c_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e2fdff574a795d5663d615e921b81f7c_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
e2fdff574a795d5663d615e921b81f7c_JaffaCakes118.exe
-
Size
199KB
-
MD5
e2fdff574a795d5663d615e921b81f7c
-
SHA1
e6c35947635a77ffe3b5140c2a4c4eb72de6919d
-
SHA256
562effd04841e97a20f227a90cbe032e31ebc5752395c6fc68539c92c0140622
-
SHA512
98d6b5bc88dde3f849a9705e19f1045b4ac3912608dd2793f3e114dc7cc62e605e74c21865913d18cb53431ad3d81103e226be23339abaa8da55462b2a149c2f
-
SSDEEP
6144:Ozii12HtAmr+ERwrA2AOymENlsiONXQi:O/+xSAnvNlsiON
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Checks computer location settings 2 TTPs 24 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxmgv32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxmgv32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxmgv32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxmgv32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxmgv32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxmgv32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxmgv32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxmgv32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxmgv32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxmgv32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxmgv32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxmgv32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxmgv32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxmgv32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxmgv32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxmgv32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxmgv32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation e2fdff574a795d5663d615e921b81f7c_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxmgv32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxmgv32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxmgv32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxmgv32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxmgv32.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation igfxmgv32.exe -
Deletes itself 1 IoCs
pid Process 1100 igfxmgv32.exe -
Executes dropped EXE 24 IoCs
pid Process 1100 igfxmgv32.exe 2936 igfxmgv32.exe 4620 igfxmgv32.exe 1656 igfxmgv32.exe 3548 igfxmgv32.exe 4316 igfxmgv32.exe 1284 igfxmgv32.exe 1760 igfxmgv32.exe 3096 igfxmgv32.exe 4040 igfxmgv32.exe 4832 igfxmgv32.exe 4792 igfxmgv32.exe 5092 igfxmgv32.exe 1816 igfxmgv32.exe 752 igfxmgv32.exe 1968 igfxmgv32.exe 3944 igfxmgv32.exe 3912 igfxmgv32.exe 1144 igfxmgv32.exe 2116 igfxmgv32.exe 2320 igfxmgv32.exe 3744 igfxmgv32.exe 4084 igfxmgv32.exe 4808 igfxmgv32.exe -
Maps connected drives based on registry 3 TTPs 48 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxmgv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxmgv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxmgv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxmgv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxmgv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxmgv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxmgv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxmgv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 e2fdff574a795d5663d615e921b81f7c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxmgv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxmgv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxmgv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxmgv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxmgv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum e2fdff574a795d5663d615e921b81f7c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxmgv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxmgv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxmgv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxmgv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxmgv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxmgv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxmgv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxmgv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxmgv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxmgv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxmgv32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxmgv32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\ igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\ igfxmgv32.exe File created C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File created C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File created C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\ igfxmgv32.exe File created C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File created C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File created C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\ igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\ igfxmgv32.exe File created C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\ e2fdff574a795d5663d615e921b81f7c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File created C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\ igfxmgv32.exe File created C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File created C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File created C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\ igfxmgv32.exe File created C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File created C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\ igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\ igfxmgv32.exe File created C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\ igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File created C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\ igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\igfxmgv32.exe e2fdff574a795d5663d615e921b81f7c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\ igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File created C:\Windows\SysWOW64\igfxmgv32.exe e2fdff574a795d5663d615e921b81f7c_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\ igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\ igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\ igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\ igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\ igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\ igfxmgv32.exe File created C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File created C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File created C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File created C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\ igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\ igfxmgv32.exe File created C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe File opened for modification C:\Windows\SysWOW64\igfxmgv32.exe igfxmgv32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4080 4808 WerFault.exe 120 -
System Location Discovery: System Language Discovery 1 TTPs 24 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e2fdff574a795d5663d615e921b81f7c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxmgv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxmgv32.exe -
Modifies registry class 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ e2fdff574a795d5663d615e921b81f7c_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxmgv32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxmgv32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxmgv32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxmgv32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxmgv32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxmgv32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxmgv32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxmgv32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxmgv32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxmgv32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxmgv32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxmgv32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxmgv32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxmgv32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxmgv32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxmgv32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxmgv32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxmgv32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxmgv32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxmgv32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxmgv32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxmgv32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxmgv32.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 3420 e2fdff574a795d5663d615e921b81f7c_JaffaCakes118.exe 3420 e2fdff574a795d5663d615e921b81f7c_JaffaCakes118.exe 1100 igfxmgv32.exe 1100 igfxmgv32.exe 2936 igfxmgv32.exe 2936 igfxmgv32.exe 4620 igfxmgv32.exe 4620 igfxmgv32.exe 1656 igfxmgv32.exe 1656 igfxmgv32.exe 3548 igfxmgv32.exe 3548 igfxmgv32.exe 4316 igfxmgv32.exe 4316 igfxmgv32.exe 1284 igfxmgv32.exe 1284 igfxmgv32.exe 1760 igfxmgv32.exe 1760 igfxmgv32.exe 3096 igfxmgv32.exe 3096 igfxmgv32.exe 4040 igfxmgv32.exe 4040 igfxmgv32.exe 4832 igfxmgv32.exe 4832 igfxmgv32.exe 4792 igfxmgv32.exe 4792 igfxmgv32.exe 5092 igfxmgv32.exe 5092 igfxmgv32.exe 1816 igfxmgv32.exe 1816 igfxmgv32.exe 752 igfxmgv32.exe 752 igfxmgv32.exe 1968 igfxmgv32.exe 1968 igfxmgv32.exe 3944 igfxmgv32.exe 3944 igfxmgv32.exe 3912 igfxmgv32.exe 3912 igfxmgv32.exe 1144 igfxmgv32.exe 1144 igfxmgv32.exe 2116 igfxmgv32.exe 2116 igfxmgv32.exe 2320 igfxmgv32.exe 2320 igfxmgv32.exe 3744 igfxmgv32.exe 3744 igfxmgv32.exe 4084 igfxmgv32.exe 4084 igfxmgv32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3420 wrote to memory of 1100 3420 e2fdff574a795d5663d615e921b81f7c_JaffaCakes118.exe 83 PID 3420 wrote to memory of 1100 3420 e2fdff574a795d5663d615e921b81f7c_JaffaCakes118.exe 83 PID 3420 wrote to memory of 1100 3420 e2fdff574a795d5663d615e921b81f7c_JaffaCakes118.exe 83 PID 1100 wrote to memory of 2936 1100 igfxmgv32.exe 86 PID 1100 wrote to memory of 2936 1100 igfxmgv32.exe 86 PID 1100 wrote to memory of 2936 1100 igfxmgv32.exe 86 PID 2936 wrote to memory of 4620 2936 igfxmgv32.exe 93 PID 2936 wrote to memory of 4620 2936 igfxmgv32.exe 93 PID 2936 wrote to memory of 4620 2936 igfxmgv32.exe 93 PID 4620 wrote to memory of 1656 4620 igfxmgv32.exe 97 PID 4620 wrote to memory of 1656 4620 igfxmgv32.exe 97 PID 4620 wrote to memory of 1656 4620 igfxmgv32.exe 97 PID 1656 wrote to memory of 3548 1656 igfxmgv32.exe 98 PID 1656 wrote to memory of 3548 1656 igfxmgv32.exe 98 PID 1656 wrote to memory of 3548 1656 igfxmgv32.exe 98 PID 3548 wrote to memory of 4316 3548 igfxmgv32.exe 99 PID 3548 wrote to memory of 4316 3548 igfxmgv32.exe 99 PID 3548 wrote to memory of 4316 3548 igfxmgv32.exe 99 PID 4316 wrote to memory of 1284 4316 igfxmgv32.exe 100 PID 4316 wrote to memory of 1284 4316 igfxmgv32.exe 100 PID 4316 wrote to memory of 1284 4316 igfxmgv32.exe 100 PID 1284 wrote to memory of 1760 1284 igfxmgv32.exe 101 PID 1284 wrote to memory of 1760 1284 igfxmgv32.exe 101 PID 1284 wrote to memory of 1760 1284 igfxmgv32.exe 101 PID 1760 wrote to memory of 3096 1760 igfxmgv32.exe 104 PID 1760 wrote to memory of 3096 1760 igfxmgv32.exe 104 PID 1760 wrote to memory of 3096 1760 igfxmgv32.exe 104 PID 3096 wrote to memory of 4040 3096 igfxmgv32.exe 105 PID 3096 wrote to memory of 4040 3096 igfxmgv32.exe 105 PID 3096 wrote to memory of 4040 3096 igfxmgv32.exe 105 PID 4040 wrote to memory of 4832 4040 igfxmgv32.exe 107 PID 4040 wrote to memory of 4832 4040 igfxmgv32.exe 107 PID 4040 wrote to memory of 4832 4040 igfxmgv32.exe 107 PID 4832 wrote to memory of 4792 4832 igfxmgv32.exe 108 PID 4832 wrote to memory of 4792 4832 igfxmgv32.exe 108 PID 4832 wrote to memory of 4792 4832 igfxmgv32.exe 108 PID 4792 wrote to memory of 5092 4792 igfxmgv32.exe 109 PID 4792 wrote to memory of 5092 4792 igfxmgv32.exe 109 PID 4792 wrote to memory of 5092 4792 igfxmgv32.exe 109 PID 5092 wrote to memory of 1816 5092 igfxmgv32.exe 110 PID 5092 wrote to memory of 1816 5092 igfxmgv32.exe 110 PID 5092 wrote to memory of 1816 5092 igfxmgv32.exe 110 PID 1816 wrote to memory of 752 1816 igfxmgv32.exe 111 PID 1816 wrote to memory of 752 1816 igfxmgv32.exe 111 PID 1816 wrote to memory of 752 1816 igfxmgv32.exe 111 PID 752 wrote to memory of 1968 752 igfxmgv32.exe 112 PID 752 wrote to memory of 1968 752 igfxmgv32.exe 112 PID 752 wrote to memory of 1968 752 igfxmgv32.exe 112 PID 1968 wrote to memory of 3944 1968 igfxmgv32.exe 113 PID 1968 wrote to memory of 3944 1968 igfxmgv32.exe 113 PID 1968 wrote to memory of 3944 1968 igfxmgv32.exe 113 PID 3944 wrote to memory of 3912 3944 igfxmgv32.exe 114 PID 3944 wrote to memory of 3912 3944 igfxmgv32.exe 114 PID 3944 wrote to memory of 3912 3944 igfxmgv32.exe 114 PID 3912 wrote to memory of 1144 3912 igfxmgv32.exe 115 PID 3912 wrote to memory of 1144 3912 igfxmgv32.exe 115 PID 3912 wrote to memory of 1144 3912 igfxmgv32.exe 115 PID 1144 wrote to memory of 2116 1144 igfxmgv32.exe 116 PID 1144 wrote to memory of 2116 1144 igfxmgv32.exe 116 PID 1144 wrote to memory of 2116 1144 igfxmgv32.exe 116 PID 2116 wrote to memory of 2320 2116 igfxmgv32.exe 117 PID 2116 wrote to memory of 2320 2116 igfxmgv32.exe 117 PID 2116 wrote to memory of 2320 2116 igfxmgv32.exe 117 PID 2320 wrote to memory of 3744 2320 igfxmgv32.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2fdff574a795d5663d615e921b81f7c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e2fdff574a795d5663d615e921b81f7c_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\igfxmgv32.exe"C:\Windows\system32\igfxmgv32.exe" C:\Users\Admin\AppData\Local\Temp\E2FDFF~1.EXE2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\igfxmgv32.exe"C:\Windows\system32\igfxmgv32.exe" C:\Windows\SysWOW64\IGFXMG~1.EXE3⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\igfxmgv32.exe"C:\Windows\system32\igfxmgv32.exe" C:\Windows\SysWOW64\IGFXMG~1.EXE4⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\igfxmgv32.exe"C:\Windows\system32\igfxmgv32.exe" C:\Windows\SysWOW64\IGFXMG~1.EXE5⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\igfxmgv32.exe"C:\Windows\system32\igfxmgv32.exe" C:\Windows\SysWOW64\IGFXMG~1.EXE6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\igfxmgv32.exe"C:\Windows\system32\igfxmgv32.exe" C:\Windows\SysWOW64\IGFXMG~1.EXE7⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\igfxmgv32.exe"C:\Windows\system32\igfxmgv32.exe" C:\Windows\SysWOW64\IGFXMG~1.EXE8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\igfxmgv32.exe"C:\Windows\system32\igfxmgv32.exe" C:\Windows\SysWOW64\IGFXMG~1.EXE9⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\igfxmgv32.exe"C:\Windows\system32\igfxmgv32.exe" C:\Windows\SysWOW64\IGFXMG~1.EXE10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\SysWOW64\igfxmgv32.exe"C:\Windows\system32\igfxmgv32.exe" C:\Windows\SysWOW64\IGFXMG~1.EXE11⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\SysWOW64\igfxmgv32.exe"C:\Windows\system32\igfxmgv32.exe" C:\Windows\SysWOW64\IGFXMG~1.EXE12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\igfxmgv32.exe"C:\Windows\system32\igfxmgv32.exe" C:\Windows\SysWOW64\IGFXMG~1.EXE13⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\igfxmgv32.exe"C:\Windows\system32\igfxmgv32.exe" C:\Windows\SysWOW64\IGFXMG~1.EXE14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\SysWOW64\igfxmgv32.exe"C:\Windows\system32\igfxmgv32.exe" C:\Windows\SysWOW64\IGFXMG~1.EXE15⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\igfxmgv32.exe"C:\Windows\system32\igfxmgv32.exe" C:\Windows\SysWOW64\IGFXMG~1.EXE16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\SysWOW64\igfxmgv32.exe"C:\Windows\system32\igfxmgv32.exe" C:\Windows\SysWOW64\IGFXMG~1.EXE17⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\igfxmgv32.exe"C:\Windows\system32\igfxmgv32.exe" C:\Windows\SysWOW64\IGFXMG~1.EXE18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\igfxmgv32.exe"C:\Windows\system32\igfxmgv32.exe" C:\Windows\SysWOW64\IGFXMG~1.EXE19⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\SysWOW64\igfxmgv32.exe"C:\Windows\system32\igfxmgv32.exe" C:\Windows\SysWOW64\IGFXMG~1.EXE20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\igfxmgv32.exe"C:\Windows\system32\igfxmgv32.exe" C:\Windows\SysWOW64\IGFXMG~1.EXE21⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\igfxmgv32.exe"C:\Windows\system32\igfxmgv32.exe" C:\Windows\SysWOW64\IGFXMG~1.EXE22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\igfxmgv32.exe"C:\Windows\system32\igfxmgv32.exe" C:\Windows\SysWOW64\IGFXMG~1.EXE23⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3744 -
C:\Windows\SysWOW64\igfxmgv32.exe"C:\Windows\system32\igfxmgv32.exe" C:\Windows\SysWOW64\IGFXMG~1.EXE24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4084 -
C:\Windows\SysWOW64\igfxmgv32.exe"C:\Windows\system32\igfxmgv32.exe" C:\Windows\SysWOW64\IGFXMG~1.EXE25⤵
- Executes dropped EXE
PID:4808 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 57226⤵
- Program crash
PID:4080
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4808 -ip 48081⤵PID:1712
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
199KB
MD5e2fdff574a795d5663d615e921b81f7c
SHA1e6c35947635a77ffe3b5140c2a4c4eb72de6919d
SHA256562effd04841e97a20f227a90cbe032e31ebc5752395c6fc68539c92c0140622
SHA51298d6b5bc88dde3f849a9705e19f1045b4ac3912608dd2793f3e114dc7cc62e605e74c21865913d18cb53431ad3d81103e226be23339abaa8da55462b2a149c2f