Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/12/2024, 22:26 UTC
Static task
static1
Behavioral task
behavioral1
Sample
f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe
-
Size
361KB
-
MD5
f6050e141fd57f5bd30f6a6a59200002
-
SHA1
d94b5a399974d5c1b3c61fea2d8f96c32f4dbd95
-
SHA256
dbb9c508474f2afac3b0f9addb0d617773bfd4ea47b2e0d55d8833d11b420f67
-
SHA512
b521eec5d49d2ade2b3e279ca3b1552ac05a0bf4b330d0129c14ada621675d1d49acc1c5b7327a55c0eb9aa44fd34cc2f49580af7918d198d37627148b0e6df2
-
SSDEEP
3072:7D0Gvk2CF0CYG/ci9Hye10KNvfbRPcFO5/9oyvmMXGfI5XFz4lnDIA4FArOyTDcG:knLYIPeKZF0FO5/9oyOMXGCA4dQwg
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Deletes itself 1 IoCs
pid Process 1112 igfxscr32.exe -
Executes dropped EXE 49 IoCs
pid Process 1112 igfxscr32.exe 2696 igfxscr32.exe 1472 igfxscr32.exe 556 igfxscr32.exe 2284 igfxscr32.exe 1908 igfxscr32.exe 676 igfxscr32.exe 868 igfxscr32.exe 2264 igfxscr32.exe 2236 igfxscr32.exe 1948 igfxscr32.exe 2488 igfxscr32.exe 1468 igfxscr32.exe 536 igfxscr32.exe 1884 igfxscr32.exe 3040 igfxscr32.exe 1548 igfxscr32.exe 2540 igfxscr32.exe 2188 igfxscr32.exe 896 igfxscr32.exe 3044 igfxscr32.exe 2432 igfxscr32.exe 2704 igfxscr32.exe 1916 igfxscr32.exe 680 igfxscr32.exe 1508 igfxscr32.exe 3020 igfxscr32.exe 448 igfxscr32.exe 1996 igfxscr32.exe 1980 igfxscr32.exe 1268 igfxscr32.exe 1000 igfxscr32.exe 2120 igfxscr32.exe 2164 igfxscr32.exe 2636 igfxscr32.exe 2928 igfxscr32.exe 2504 igfxscr32.exe 2920 igfxscr32.exe 992 igfxscr32.exe 2564 igfxscr32.exe 1232 igfxscr32.exe 1284 igfxscr32.exe 2456 igfxscr32.exe 2476 igfxscr32.exe 2368 igfxscr32.exe 2412 igfxscr32.exe 2900 igfxscr32.exe 2748 igfxscr32.exe 2944 igfxscr32.exe -
Loads dropped DLL 64 IoCs
pid Process 2120 f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe 2120 f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe 1112 igfxscr32.exe 1112 igfxscr32.exe 2696 igfxscr32.exe 2696 igfxscr32.exe 1472 igfxscr32.exe 1472 igfxscr32.exe 556 igfxscr32.exe 556 igfxscr32.exe 2284 igfxscr32.exe 2284 igfxscr32.exe 1908 igfxscr32.exe 1908 igfxscr32.exe 676 igfxscr32.exe 676 igfxscr32.exe 868 igfxscr32.exe 868 igfxscr32.exe 2264 igfxscr32.exe 2264 igfxscr32.exe 2236 igfxscr32.exe 2236 igfxscr32.exe 1948 igfxscr32.exe 1948 igfxscr32.exe 2488 igfxscr32.exe 2488 igfxscr32.exe 1468 igfxscr32.exe 1468 igfxscr32.exe 536 igfxscr32.exe 536 igfxscr32.exe 1884 igfxscr32.exe 1884 igfxscr32.exe 3040 igfxscr32.exe 3040 igfxscr32.exe 1548 igfxscr32.exe 1548 igfxscr32.exe 2540 igfxscr32.exe 2540 igfxscr32.exe 2188 igfxscr32.exe 2188 igfxscr32.exe 896 igfxscr32.exe 896 igfxscr32.exe 3044 igfxscr32.exe 3044 igfxscr32.exe 2432 igfxscr32.exe 2432 igfxscr32.exe 2704 igfxscr32.exe 2704 igfxscr32.exe 1916 igfxscr32.exe 1916 igfxscr32.exe 680 igfxscr32.exe 680 igfxscr32.exe 1508 igfxscr32.exe 1508 igfxscr32.exe 3020 igfxscr32.exe 3020 igfxscr32.exe 448 igfxscr32.exe 448 igfxscr32.exe 1996 igfxscr32.exe 1996 igfxscr32.exe 1980 igfxscr32.exe 1980 igfxscr32.exe 1268 igfxscr32.exe 1268 igfxscr32.exe -
Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxscr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxscr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxscr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxscr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxscr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxscr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxscr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxscr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxscr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxscr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxscr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxscr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxscr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxscr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxscr32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\ igfxscr32.exe File opened for modification C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\ igfxscr32.exe File opened for modification C:\Windows\SysWOW64\ igfxscr32.exe File opened for modification C:\Windows\SysWOW64\ igfxscr32.exe File created C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File created C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File created C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File created C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File created C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\ igfxscr32.exe File opened for modification C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\ igfxscr32.exe File opened for modification C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\ igfxscr32.exe File created C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File created C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\ igfxscr32.exe File created C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\ igfxscr32.exe File opened for modification C:\Windows\SysWOW64\ igfxscr32.exe File opened for modification C:\Windows\SysWOW64\ igfxscr32.exe File created C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\ igfxscr32.exe File opened for modification C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\ igfxscr32.exe File created C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\ igfxscr32.exe File created C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\ igfxscr32.exe File opened for modification C:\Windows\SysWOW64\ igfxscr32.exe File opened for modification C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File created C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\ igfxscr32.exe File opened for modification C:\Windows\SysWOW64\ igfxscr32.exe File opened for modification C:\Windows\SysWOW64\ igfxscr32.exe File created C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File created C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\ igfxscr32.exe File opened for modification C:\Windows\SysWOW64\ igfxscr32.exe File opened for modification C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\igfxscr32.exe f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe File created C:\Windows\SysWOW64\igfxscr32.exe f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File opened for modification C:\Windows\SysWOW64\ igfxscr32.exe File opened for modification C:\Windows\SysWOW64\ igfxscr32.exe File created C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe File created C:\Windows\SysWOW64\igfxscr32.exe igfxscr32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 49 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxscr32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2120 f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe 2120 f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe 2120 f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe 2120 f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe 2120 f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe 2120 f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe 2120 f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe 2120 f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe 2120 f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe 2120 f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe 2120 f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe 2120 f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe 2120 f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe 2120 f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe 2120 f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe 1112 igfxscr32.exe 1112 igfxscr32.exe 1112 igfxscr32.exe 1112 igfxscr32.exe 1112 igfxscr32.exe 1112 igfxscr32.exe 1112 igfxscr32.exe 1112 igfxscr32.exe 1112 igfxscr32.exe 1112 igfxscr32.exe 1112 igfxscr32.exe 1112 igfxscr32.exe 1112 igfxscr32.exe 1112 igfxscr32.exe 1112 igfxscr32.exe 2696 igfxscr32.exe 2696 igfxscr32.exe 2696 igfxscr32.exe 2696 igfxscr32.exe 2696 igfxscr32.exe 2696 igfxscr32.exe 2696 igfxscr32.exe 2696 igfxscr32.exe 2696 igfxscr32.exe 2696 igfxscr32.exe 2696 igfxscr32.exe 2696 igfxscr32.exe 2696 igfxscr32.exe 2696 igfxscr32.exe 2696 igfxscr32.exe 1472 igfxscr32.exe 1472 igfxscr32.exe 1472 igfxscr32.exe 1472 igfxscr32.exe 1472 igfxscr32.exe 1472 igfxscr32.exe 1472 igfxscr32.exe 1472 igfxscr32.exe 1472 igfxscr32.exe 1472 igfxscr32.exe 1472 igfxscr32.exe 1472 igfxscr32.exe 1472 igfxscr32.exe 1472 igfxscr32.exe 1472 igfxscr32.exe 556 igfxscr32.exe 556 igfxscr32.exe 556 igfxscr32.exe 556 igfxscr32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2120 wrote to memory of 1112 2120 f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe 30 PID 2120 wrote to memory of 1112 2120 f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe 30 PID 2120 wrote to memory of 1112 2120 f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe 30 PID 2120 wrote to memory of 1112 2120 f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe 30 PID 1112 wrote to memory of 2696 1112 igfxscr32.exe 31 PID 1112 wrote to memory of 2696 1112 igfxscr32.exe 31 PID 1112 wrote to memory of 2696 1112 igfxscr32.exe 31 PID 1112 wrote to memory of 2696 1112 igfxscr32.exe 31 PID 2696 wrote to memory of 1472 2696 igfxscr32.exe 32 PID 2696 wrote to memory of 1472 2696 igfxscr32.exe 32 PID 2696 wrote to memory of 1472 2696 igfxscr32.exe 32 PID 2696 wrote to memory of 1472 2696 igfxscr32.exe 32 PID 1472 wrote to memory of 556 1472 igfxscr32.exe 34 PID 1472 wrote to memory of 556 1472 igfxscr32.exe 34 PID 1472 wrote to memory of 556 1472 igfxscr32.exe 34 PID 1472 wrote to memory of 556 1472 igfxscr32.exe 34 PID 556 wrote to memory of 2284 556 igfxscr32.exe 35 PID 556 wrote to memory of 2284 556 igfxscr32.exe 35 PID 556 wrote to memory of 2284 556 igfxscr32.exe 35 PID 556 wrote to memory of 2284 556 igfxscr32.exe 35 PID 2284 wrote to memory of 1908 2284 igfxscr32.exe 36 PID 2284 wrote to memory of 1908 2284 igfxscr32.exe 36 PID 2284 wrote to memory of 1908 2284 igfxscr32.exe 36 PID 2284 wrote to memory of 1908 2284 igfxscr32.exe 36 PID 1908 wrote to memory of 676 1908 igfxscr32.exe 37 PID 1908 wrote to memory of 676 1908 igfxscr32.exe 37 PID 1908 wrote to memory of 676 1908 igfxscr32.exe 37 PID 1908 wrote to memory of 676 1908 igfxscr32.exe 37 PID 676 wrote to memory of 868 676 igfxscr32.exe 38 PID 676 wrote to memory of 868 676 igfxscr32.exe 38 PID 676 wrote to memory of 868 676 igfxscr32.exe 38 PID 676 wrote to memory of 868 676 igfxscr32.exe 38 PID 868 wrote to memory of 2264 868 igfxscr32.exe 39 PID 868 wrote to memory of 2264 868 igfxscr32.exe 39 PID 868 wrote to memory of 2264 868 igfxscr32.exe 39 PID 868 wrote to memory of 2264 868 igfxscr32.exe 39 PID 2264 wrote to memory of 2236 2264 igfxscr32.exe 40 PID 2264 wrote to memory of 2236 2264 igfxscr32.exe 40 PID 2264 wrote to memory of 2236 2264 igfxscr32.exe 40 PID 2264 wrote to memory of 2236 2264 igfxscr32.exe 40 PID 1948 wrote to memory of 2488 1948 igfxscr32.exe 42 PID 1948 wrote to memory of 2488 1948 igfxscr32.exe 42 PID 1948 wrote to memory of 2488 1948 igfxscr32.exe 42 PID 1948 wrote to memory of 2488 1948 igfxscr32.exe 42 PID 2488 wrote to memory of 1468 2488 igfxscr32.exe 43 PID 2488 wrote to memory of 1468 2488 igfxscr32.exe 43 PID 2488 wrote to memory of 1468 2488 igfxscr32.exe 43 PID 2488 wrote to memory of 1468 2488 igfxscr32.exe 43 PID 1468 wrote to memory of 536 1468 igfxscr32.exe 44 PID 1468 wrote to memory of 536 1468 igfxscr32.exe 44 PID 1468 wrote to memory of 536 1468 igfxscr32.exe 44 PID 1468 wrote to memory of 536 1468 igfxscr32.exe 44 PID 536 wrote to memory of 1884 536 igfxscr32.exe 45 PID 536 wrote to memory of 1884 536 igfxscr32.exe 45 PID 536 wrote to memory of 1884 536 igfxscr32.exe 45 PID 536 wrote to memory of 1884 536 igfxscr32.exe 45 PID 1884 wrote to memory of 3040 1884 igfxscr32.exe 46 PID 1884 wrote to memory of 3040 1884 igfxscr32.exe 46 PID 1884 wrote to memory of 3040 1884 igfxscr32.exe 46 PID 1884 wrote to memory of 3040 1884 igfxscr32.exe 46 PID 3040 wrote to memory of 1548 3040 igfxscr32.exe 47 PID 3040 wrote to memory of 1548 3040 igfxscr32.exe 47 PID 3040 wrote to memory of 1548 3040 igfxscr32.exe 47 PID 3040 wrote to memory of 1548 3040 igfxscr32.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f6050e141fd57f5bd30f6a6a59200002_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Users\Admin\AppData\Local\Temp\F6050E~1.EXE2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE4⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE5⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE11⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:2236 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE13⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE14⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE15⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE17⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1548 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE19⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2540 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2188 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE21⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:896 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3044 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE23⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2432 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE24⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:2704 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE25⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1916 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE26⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:680 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE27⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1508 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3020 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE29⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:448 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE30⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1996 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE31⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:1980 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE32⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:1268 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE33⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1000 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE34⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2120 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2164 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE36⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:2636 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE37⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2928 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE38⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2504 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE39⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2920 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE40⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:992 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2564 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE42⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:1232 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE43⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1284 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE44⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2456 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE45⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2476 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2368 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE47⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:2412 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE48⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2900 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2748 -
C:\Windows\SysWOW64\igfxscr32.exe"C:\Windows\system32\igfxscr32.exe" C:\Windows\SysWOW64\IGFXSC~1.EXE50⤵
- Executes dropped EXE
- Maps connected drives based on registry
PID:2944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
361KB
MD5f6050e141fd57f5bd30f6a6a59200002
SHA1d94b5a399974d5c1b3c61fea2d8f96c32f4dbd95
SHA256dbb9c508474f2afac3b0f9addb0d617773bfd4ea47b2e0d55d8833d11b420f67
SHA512b521eec5d49d2ade2b3e279ca3b1552ac05a0bf4b330d0129c14ada621675d1d49acc1c5b7327a55c0eb9aa44fd34cc2f49580af7918d198d37627148b0e6df2