metasploit | 702c8164a622618aa4662d7f5a96a5ac389b56a41278777d9f95d7c2bd96bd6f

Analysis

max time kernel
147s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/12/2024, 19:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f569ba1be3f32c2da5ec7066606a19c9_JaffaCakes118.exe
Size

174KB
MD5

f569ba1be3f32c2da5ec7066606a19c9
SHA1

6cc41dcf24511eb02ca2209f78bde165f3a123d8
SHA256

702c8164a622618aa4662d7f5a96a5ac389b56a41278777d9f95d7c2bd96bd6f
SHA512

8ed29c6bd41daafc21419ef14b31e1bba7d7adc230542fa34ecfce707c31fa35eed96cdb921d8776f92ee7ea77949fa43003defef96e53f094ad980735c8f51e
SSDEEP

3072:w6V2H12f5TjiK/yuqeaLt501/YuSej48kIjSHo0ctjWvSJlcXyRBBQs:WH1fed1wuj48Vj0fAjuSbcXM3Qs

Score

10^/10

metasploit backdoor discovery trojan upx

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Deletes itself 1 IoCs

pid	Process
2728	igfxwd32.exe

Executes dropped EXE 31 IoCs

pid	Process
3008	igfxwd32.exe
2728	igfxwd32.exe
2936	igfxwd32.exe
3032	igfxwd32.exe
2700	igfxwd32.exe
3028	igfxwd32.exe
1684	igfxwd32.exe
1636	igfxwd32.exe
2568	igfxwd32.exe
2840	igfxwd32.exe
2184	igfxwd32.exe
1048	igfxwd32.exe
1392	igfxwd32.exe
1892	igfxwd32.exe
1252	igfxwd32.exe
2452	igfxwd32.exe
2944	igfxwd32.exe
1656	igfxwd32.exe
2504	igfxwd32.exe
2132	igfxwd32.exe
2012	igfxwd32.exe
2848	igfxwd32.exe
2160	igfxwd32.exe
2696	igfxwd32.exe
2592	igfxwd32.exe
2700	igfxwd32.exe
2484	igfxwd32.exe
1692	igfxwd32.exe
828	igfxwd32.exe
2904	igfxwd32.exe
604	igfxwd32.exe

Loads dropped DLL 31 IoCs

pid	Process
2128	f569ba1be3f32c2da5ec7066606a19c9_JaffaCakes118.exe
3008	igfxwd32.exe
2728	igfxwd32.exe
2936	igfxwd32.exe
3032	igfxwd32.exe
2700	igfxwd32.exe
3028	igfxwd32.exe
1684	igfxwd32.exe
1636	igfxwd32.exe
2568	igfxwd32.exe
2840	igfxwd32.exe
2184	igfxwd32.exe
1048	igfxwd32.exe
1392	igfxwd32.exe
1892	igfxwd32.exe
1252	igfxwd32.exe
2452	igfxwd32.exe
2944	igfxwd32.exe
1656	igfxwd32.exe
2504	igfxwd32.exe
2132	igfxwd32.exe
2012	igfxwd32.exe
2848	igfxwd32.exe
2160	igfxwd32.exe
2696	igfxwd32.exe
2592	igfxwd32.exe
2700	igfxwd32.exe
2484	igfxwd32.exe
1692	igfxwd32.exe
828	igfxwd32.exe
2904	igfxwd32.exe

Maps connected drives based on registry 3 TTPs 32 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	f569ba1be3f32c2da5ec7066606a19c9_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxwd32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxwd32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxwd32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxwd32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxwd32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	f569ba1be3f32c2da5ec7066606a19c9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxwd32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxwd32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxwd32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxwd32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxwd32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxwd32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxwd32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxwd32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxwd32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxwd32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	igfxwd32.exe

Drops file in System32 directory 48 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File created	C:\Windows\SysWOW64\igfxwd32.exe	f569ba1be3f32c2da5ec7066606a19c9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxwd32.exe
File created	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\	f569ba1be3f32c2da5ec7066606a19c9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File created	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File created	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File created	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File created	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File created	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File created	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File created	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxwd32.exe
File created	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxwd32.exe
File created	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File created	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File created	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File created	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\	igfxwd32.exe
File created	C:\Windows\SysWOW64\igfxwd32.exe	igfxwd32.exe
File opened for modification	C:\Windows\SysWOW64\igfxwd32.exe	f569ba1be3f32c2da5ec7066606a19c9_JaffaCakes118.exe

Suspicious use of SetThreadContext 16 IoCs

description	pid	Process	procid_target
PID 2496 set thread context of 2128	2496	f569ba1be3f32c2da5ec7066606a19c9_JaffaCakes118.exe	31
PID 3008 set thread context of 2728	3008	igfxwd32.exe	33
PID 2936 set thread context of 3032	2936	igfxwd32.exe	35
PID 2700 set thread context of 3028	2700	igfxwd32.exe	37
PID 1684 set thread context of 1636	1684	igfxwd32.exe	39
PID 2568 set thread context of 2840	2568	igfxwd32.exe	41
PID 2184 set thread context of 1048	2184	igfxwd32.exe	43
PID 1392 set thread context of 1892	1392	igfxwd32.exe	45
PID 1252 set thread context of 2452	1252	igfxwd32.exe	47
PID 2944 set thread context of 1656	2944	igfxwd32.exe	49
PID 2504 set thread context of 2132	2504	igfxwd32.exe	51
PID 2012 set thread context of 2848	2012	igfxwd32.exe	53
PID 2160 set thread context of 2696	2160	igfxwd32.exe	55
PID 2592 set thread context of 2700	2592	igfxwd32.exe	57
PID 2484 set thread context of 1692	2484	igfxwd32.exe	59
PID 828 set thread context of 2904	828	igfxwd32.exe	61

UPX packed file 31 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2128-2-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2128-8-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2128-9-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2128-7-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2128-6-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2128-3-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2128-19-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2728-31-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2728-30-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2728-29-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2728-32-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2728-38-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/3032-49-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/3032-48-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/3032-54-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/3028-70-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/1636-86-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2840-101-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/1048-119-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/1892-135-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2452-152-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/1656-163-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/1656-168-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2132-186-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2848-202-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2696-219-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2700-229-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2700-236-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/1692-245-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/1692-250-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2904-262-0x0000000000400000-0x0000000000466000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f569ba1be3f32c2da5ec7066606a19c9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f569ba1be3f32c2da5ec7066606a19c9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igfxwd32.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2128	f569ba1be3f32c2da5ec7066606a19c9_JaffaCakes118.exe
2128	f569ba1be3f32c2da5ec7066606a19c9_JaffaCakes118.exe
2728	igfxwd32.exe
2728	igfxwd32.exe
3032	igfxwd32.exe
3032	igfxwd32.exe
3028	igfxwd32.exe
3028	igfxwd32.exe
1636	igfxwd32.exe
1636	igfxwd32.exe
2840	igfxwd32.exe
2840	igfxwd32.exe
1048	igfxwd32.exe
1048	igfxwd32.exe
1892	igfxwd32.exe
1892	igfxwd32.exe
2452	igfxwd32.exe
2452	igfxwd32.exe
1656	igfxwd32.exe
1656	igfxwd32.exe
2132	igfxwd32.exe
2132	igfxwd32.exe
2848	igfxwd32.exe
2848	igfxwd32.exe
2696	igfxwd32.exe
2696	igfxwd32.exe
2700	igfxwd32.exe
2700	igfxwd32.exe
1692	igfxwd32.exe
1692	igfxwd32.exe
2904	igfxwd32.exe
2904	igfxwd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2128	2496	f569ba1be3f32c2da5ec7066606a19c9_JaffaCakes118.exe	31
PID 2496 wrote to memory of 2128	2496	f569ba1be3f32c2da5ec7066606a19c9_JaffaCakes118.exe	31
PID 2496 wrote to memory of 2128	2496	f569ba1be3f32c2da5ec7066606a19c9_JaffaCakes118.exe	31
PID 2496 wrote to memory of 2128	2496	f569ba1be3f32c2da5ec7066606a19c9_JaffaCakes118.exe	31
PID 2496 wrote to memory of 2128	2496	f569ba1be3f32c2da5ec7066606a19c9_JaffaCakes118.exe	31
PID 2496 wrote to memory of 2128	2496	f569ba1be3f32c2da5ec7066606a19c9_JaffaCakes118.exe	31
PID 2496 wrote to memory of 2128	2496	f569ba1be3f32c2da5ec7066606a19c9_JaffaCakes118.exe	31
PID 2128 wrote to memory of 3008	2128	f569ba1be3f32c2da5ec7066606a19c9_JaffaCakes118.exe	32
PID 2128 wrote to memory of 3008	2128	f569ba1be3f32c2da5ec7066606a19c9_JaffaCakes118.exe	32
PID 2128 wrote to memory of 3008	2128	f569ba1be3f32c2da5ec7066606a19c9_JaffaCakes118.exe	32
PID 2128 wrote to memory of 3008	2128	f569ba1be3f32c2da5ec7066606a19c9_JaffaCakes118.exe	32
PID 3008 wrote to memory of 2728	3008	igfxwd32.exe	33
PID 3008 wrote to memory of 2728	3008	igfxwd32.exe	33
PID 3008 wrote to memory of 2728	3008	igfxwd32.exe	33
PID 3008 wrote to memory of 2728	3008	igfxwd32.exe	33
PID 3008 wrote to memory of 2728	3008	igfxwd32.exe	33
PID 3008 wrote to memory of 2728	3008	igfxwd32.exe	33
PID 3008 wrote to memory of 2728	3008	igfxwd32.exe	33
PID 2728 wrote to memory of 2936	2728	igfxwd32.exe	34
PID 2728 wrote to memory of 2936	2728	igfxwd32.exe	34
PID 2728 wrote to memory of 2936	2728	igfxwd32.exe	34
PID 2728 wrote to memory of 2936	2728	igfxwd32.exe	34
PID 2936 wrote to memory of 3032	2936	igfxwd32.exe	35
PID 2936 wrote to memory of 3032	2936	igfxwd32.exe	35
PID 2936 wrote to memory of 3032	2936	igfxwd32.exe	35
PID 2936 wrote to memory of 3032	2936	igfxwd32.exe	35
PID 2936 wrote to memory of 3032	2936	igfxwd32.exe	35
PID 2936 wrote to memory of 3032	2936	igfxwd32.exe	35
PID 2936 wrote to memory of 3032	2936	igfxwd32.exe	35
PID 3032 wrote to memory of 2700	3032	igfxwd32.exe	36
PID 3032 wrote to memory of 2700	3032	igfxwd32.exe	36
PID 3032 wrote to memory of 2700	3032	igfxwd32.exe	36
PID 3032 wrote to memory of 2700	3032	igfxwd32.exe	36
PID 2700 wrote to memory of 3028	2700	igfxwd32.exe	37
PID 2700 wrote to memory of 3028	2700	igfxwd32.exe	37
PID 2700 wrote to memory of 3028	2700	igfxwd32.exe	37
PID 2700 wrote to memory of 3028	2700	igfxwd32.exe	37
PID 2700 wrote to memory of 3028	2700	igfxwd32.exe	37
PID 2700 wrote to memory of 3028	2700	igfxwd32.exe	37
PID 2700 wrote to memory of 3028	2700	igfxwd32.exe	37
PID 3028 wrote to memory of 1684	3028	igfxwd32.exe	38
PID 3028 wrote to memory of 1684	3028	igfxwd32.exe	38
PID 3028 wrote to memory of 1684	3028	igfxwd32.exe	38
PID 3028 wrote to memory of 1684	3028	igfxwd32.exe	38
PID 1684 wrote to memory of 1636	1684	igfxwd32.exe	39
PID 1684 wrote to memory of 1636	1684	igfxwd32.exe	39
PID 1684 wrote to memory of 1636	1684	igfxwd32.exe	39
PID 1684 wrote to memory of 1636	1684	igfxwd32.exe	39
PID 1684 wrote to memory of 1636	1684	igfxwd32.exe	39
PID 1684 wrote to memory of 1636	1684	igfxwd32.exe	39
PID 1684 wrote to memory of 1636	1684	igfxwd32.exe	39
PID 1636 wrote to memory of 2568	1636	igfxwd32.exe	40
PID 1636 wrote to memory of 2568	1636	igfxwd32.exe	40
PID 1636 wrote to memory of 2568	1636	igfxwd32.exe	40
PID 1636 wrote to memory of 2568	1636	igfxwd32.exe	40
PID 2568 wrote to memory of 2840	2568	igfxwd32.exe	41
PID 2568 wrote to memory of 2840	2568	igfxwd32.exe	41
PID 2568 wrote to memory of 2840	2568	igfxwd32.exe	41
PID 2568 wrote to memory of 2840	2568	igfxwd32.exe	41
PID 2568 wrote to memory of 2840	2568	igfxwd32.exe	41
PID 2568 wrote to memory of 2840	2568	igfxwd32.exe	41
PID 2568 wrote to memory of 2840	2568	igfxwd32.exe	41
PID 2840 wrote to memory of 2184	2840	igfxwd32.exe	42
PID 2840 wrote to memory of 2184	2840	igfxwd32.exe	42

C:\Users\Admin\AppData\Local\Temp\f569ba1be3f32c2da5ec7066606a19c9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f569ba1be3f32c2da5ec7066606a19c9_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Users\Admin\AppData\Local\Temp\f569ba1be3f32c2da5ec7066606a19c9_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f569ba1be3f32c2da5ec7066606a19c9_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Maps connected drives based on registry
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\SysWOW64\igfxwd32.exe
    "C:\Windows\system32\igfxwd32.exe" C:\Users\Admin\AppData\Local\Temp\F569BA~1.EXE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Windows\SysWOW64\igfxwd32.exe
      "C:\Windows\system32\igfxwd32.exe" C:\Users\Admin\AppData\Local\Temp\F569BA~1.EXE
      4⤵
      Deletes itself
      Executes dropped EXE
      Loads dropped DLL
      Maps connected drives based on registry
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2728
    - - C:\Windows\SysWOW64\igfxwd32.exe
        
        "C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2936
      - C:\Windows\SysWOW64\igfxwd32.exe
        
        "C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3032
        
        C:\Windows\SysWOW64\igfxwd32.exe
        
        "C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2700
        
        C:\Windows\SysWOW64\igfxwd32.exe
        
        "C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3028
        
        C:\Windows\SysWOW64\igfxwd32.exe
        
        "C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1684
        
        C:\Windows\SysWOW64\igfxwd32.exe
        
        "C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1636
        
        C:\Windows\SysWOW64\igfxwd32.exe
        
        "C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2568
        
        C:\Windows\SysWOW64\igfxwd32.exe
        
        "C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2840
        
        C:\Windows\SysWOW64\igfxwd32.exe
        
        "C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2184
        
        C:\Windows\SysWOW64\igfxwd32.exe
        
        "C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1048
        
        C:\Windows\SysWOW64\igfxwd32.exe
        
        "C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1392
        
        C:\Windows\SysWOW64\igfxwd32.exe
        
        "C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1892
        
        C:\Windows\SysWOW64\igfxwd32.exe
        
        "C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1252
        
        C:\Windows\SysWOW64\igfxwd32.exe
        
        "C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2452
        
        C:\Windows\SysWOW64\igfxwd32.exe
        
        "C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
        19⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2944
        
        C:\Windows\SysWOW64\igfxwd32.exe
        
        "C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1656
        
        C:\Windows\SysWOW64\igfxwd32.exe
        
        "C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2504
        
        C:\Windows\SysWOW64\igfxwd32.exe
        
        "C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
        22⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2132
        
        C:\Windows\SysWOW64\igfxwd32.exe
        
        "C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
        23⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2012
        
        C:\Windows\SysWOW64\igfxwd32.exe
        
        "C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
        24⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2848
        
        C:\Windows\SysWOW64\igfxwd32.exe
        
        "C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
        25⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2160
        
        C:\Windows\SysWOW64\igfxwd32.exe
        
        "C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
        26⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2696
        
        C:\Windows\SysWOW64\igfxwd32.exe
        
        "C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
        27⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2592
        
        C:\Windows\SysWOW64\igfxwd32.exe
        
        "C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
        28⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2700
        
        C:\Windows\SysWOW64\igfxwd32.exe
        
        "C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
        29⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2484
        
        C:\Windows\SysWOW64\igfxwd32.exe
        
        "C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
        30⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1692
        
        C:\Windows\SysWOW64\igfxwd32.exe
        
        "C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
        31⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:828
        
        C:\Windows\SysWOW64\igfxwd32.exe
        
        "C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
        32⤵
        Executes dropped EXE
        Loads dropped DLL
        Maps connected drives based on registry
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2904
        
        C:\Windows\SysWOW64\igfxwd32.exe
        
        "C:\Windows\system32\igfxwd32.exe" C:\Windows\SysWOW64\igfxwd32.exe
        33⤵
        Executes dropped EXE
        
        PID:604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\igfxwd32.exe

Filesize
174KB

MD5
f569ba1be3f32c2da5ec7066606a19c9

SHA1
6cc41dcf24511eb02ca2209f78bde165f3a123d8

SHA256
702c8164a622618aa4662d7f5a96a5ac389b56a41278777d9f95d7c2bd96bd6f

SHA512
8ed29c6bd41daafc21419ef14b31e1bba7d7adc230542fa34ecfce707c31fa35eed96cdb921d8776f92ee7ea77949fa43003defef96e53f094ad980735c8f51e

Download Submit
memory/1048-119-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1636-86-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1656-168-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1656-163-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1692-250-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1692-245-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1892-135-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2128-19-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2128-2-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2128-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2128-8-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2128-9-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2128-7-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2128-6-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2128-3-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2132-186-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2452-152-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2696-219-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2700-229-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2700-236-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2728-31-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2728-38-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2728-30-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2728-32-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2728-29-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2840-101-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2848-202-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2904-262-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3028-70-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3032-48-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3032-49-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3032-54-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download