Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-12-2024 09:27
Static task
static1
Behavioral task
behavioral1
Sample
f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe
-
Size
220KB
-
MD5
f85dfc3c6d0cb691d7341f063a3266c3
-
SHA1
eb353f245d504107b9007d43bb4dfc96c1b300a8
-
SHA256
4b95ec1f9aeb58dbe173f08afd61004ddf7d1b28a3f96ed25f19792092328a43
-
SHA512
310a8d9be8f0cf17acc8e1f66e61ac99a5fdd5c3effd283bc61f91886a7863dd553130f433865e77a7d5530b45b5a3395fcf9d20acc91e54f921cff40180fc62
-
SSDEEP
3072:W0QEWBtDGLizq1M49YrltEr53LZnwh2e8EjuAbe/1fGyWxvBO61xf5VorCYnFTe:W0afq1MKltnwh58d/ZGyI5d1p5VorCWs
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Checks computer location settings 2 TTPs 15 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation igfxrk32.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation igfxrk32.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation igfxrk32.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation igfxrk32.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation igfxrk32.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation igfxrk32.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation igfxrk32.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation igfxrk32.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation igfxrk32.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation igfxrk32.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation igfxrk32.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation igfxrk32.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation igfxrk32.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation igfxrk32.exe -
Deletes itself 1 IoCs
pid Process 428 igfxrk32.exe -
Executes dropped EXE 30 IoCs
pid Process 3244 igfxrk32.exe 428 igfxrk32.exe 2780 igfxrk32.exe 3188 igfxrk32.exe 224 igfxrk32.exe 1604 igfxrk32.exe 2112 igfxrk32.exe 2224 igfxrk32.exe 2752 igfxrk32.exe 3988 igfxrk32.exe 4516 igfxrk32.exe 4432 igfxrk32.exe 1268 igfxrk32.exe 988 igfxrk32.exe 4612 igfxrk32.exe 4480 igfxrk32.exe 2500 igfxrk32.exe 1728 igfxrk32.exe 4256 igfxrk32.exe 2520 igfxrk32.exe 3384 igfxrk32.exe 4316 igfxrk32.exe 4820 igfxrk32.exe 5084 igfxrk32.exe 3968 igfxrk32.exe 2792 igfxrk32.exe 2948 igfxrk32.exe 3476 igfxrk32.exe 1712 igfxrk32.exe 1400 igfxrk32.exe -
Maps connected drives based on registry 3 TTPs 32 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxrk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxrk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxrk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxrk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxrk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxrk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxrk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxrk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxrk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxrk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxrk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxrk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxrk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxrk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxrk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxrk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxrk32.exe -
Drops file in System32 directory 46 IoCs
description ioc Process File created C:\Windows\SysWOW64\igfxrk32.exe igfxrk32.exe File created C:\Windows\SysWOW64\igfxrk32.exe igfxrk32.exe File created C:\Windows\SysWOW64\igfxrk32.exe igfxrk32.exe File opened for modification C:\Windows\SysWOW64\ igfxrk32.exe File opened for modification C:\Windows\SysWOW64\ igfxrk32.exe File opened for modification C:\Windows\SysWOW64\ igfxrk32.exe File opened for modification C:\Windows\SysWOW64\ igfxrk32.exe File opened for modification C:\Windows\SysWOW64\igfxrk32.exe igfxrk32.exe File opened for modification C:\Windows\SysWOW64\ igfxrk32.exe File opened for modification C:\Windows\SysWOW64\igfxrk32.exe igfxrk32.exe File opened for modification C:\Windows\SysWOW64\igfxrk32.exe igfxrk32.exe File created C:\Windows\SysWOW64\igfxrk32.exe igfxrk32.exe File opened for modification C:\Windows\SysWOW64\ igfxrk32.exe File created C:\Windows\SysWOW64\igfxrk32.exe igfxrk32.exe File opened for modification C:\Windows\SysWOW64\ igfxrk32.exe File created C:\Windows\SysWOW64\igfxrk32.exe igfxrk32.exe File created C:\Windows\SysWOW64\igfxrk32.exe igfxrk32.exe File opened for modification C:\Windows\SysWOW64\igfxrk32.exe igfxrk32.exe File created C:\Windows\SysWOW64\igfxrk32.exe f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe File created C:\Windows\SysWOW64\igfxrk32.exe igfxrk32.exe File opened for modification C:\Windows\SysWOW64\igfxrk32.exe igfxrk32.exe File opened for modification C:\Windows\SysWOW64\ igfxrk32.exe File created C:\Windows\SysWOW64\igfxrk32.exe igfxrk32.exe File opened for modification C:\Windows\SysWOW64\ igfxrk32.exe File created C:\Windows\SysWOW64\igfxrk32.exe igfxrk32.exe File opened for modification C:\Windows\SysWOW64\igfxrk32.exe igfxrk32.exe File opened for modification C:\Windows\SysWOW64\igfxrk32.exe igfxrk32.exe File opened for modification C:\Windows\SysWOW64\ igfxrk32.exe File opened for modification C:\Windows\SysWOW64\ igfxrk32.exe File created C:\Windows\SysWOW64\igfxrk32.exe igfxrk32.exe File opened for modification C:\Windows\SysWOW64\ igfxrk32.exe File opened for modification C:\Windows\SysWOW64\igfxrk32.exe igfxrk32.exe File opened for modification C:\Windows\SysWOW64\ igfxrk32.exe File opened for modification C:\Windows\SysWOW64\ igfxrk32.exe File opened for modification C:\Windows\SysWOW64\ igfxrk32.exe File opened for modification C:\Windows\SysWOW64\igfxrk32.exe igfxrk32.exe File opened for modification C:\Windows\SysWOW64\igfxrk32.exe igfxrk32.exe File created C:\Windows\SysWOW64\igfxrk32.exe igfxrk32.exe File opened for modification C:\Windows\SysWOW64\ f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe File created C:\Windows\SysWOW64\igfxrk32.exe igfxrk32.exe File opened for modification C:\Windows\SysWOW64\igfxrk32.exe igfxrk32.exe File opened for modification C:\Windows\SysWOW64\igfxrk32.exe igfxrk32.exe File created C:\Windows\SysWOW64\igfxrk32.exe igfxrk32.exe File opened for modification C:\Windows\SysWOW64\igfxrk32.exe igfxrk32.exe File opened for modification C:\Windows\SysWOW64\igfxrk32.exe igfxrk32.exe File opened for modification C:\Windows\SysWOW64\igfxrk32.exe f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe -
Suspicious use of SetThreadContext 15 IoCs
description pid Process procid_target PID 1668 set thread context of 464 1668 f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe 83 PID 3244 set thread context of 428 3244 igfxrk32.exe 88 PID 2780 set thread context of 3188 2780 igfxrk32.exe 100 PID 224 set thread context of 1604 224 igfxrk32.exe 103 PID 2112 set thread context of 2224 2112 igfxrk32.exe 107 PID 2752 set thread context of 3988 2752 igfxrk32.exe 109 PID 1268 set thread context of 988 1268 igfxrk32.exe 113 PID 4612 set thread context of 4480 4612 igfxrk32.exe 115 PID 2500 set thread context of 1728 2500 igfxrk32.exe 117 PID 4256 set thread context of 2520 4256 igfxrk32.exe 119 PID 3384 set thread context of 4316 3384 igfxrk32.exe 121 PID 4820 set thread context of 5084 4820 igfxrk32.exe 123 PID 3968 set thread context of 2792 3968 igfxrk32.exe 125 PID 2948 set thread context of 3476 2948 igfxrk32.exe 127 PID 1712 set thread context of 1400 1712 igfxrk32.exe 129 -
resource yara_rule behavioral2/memory/464-0-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/464-2-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/464-3-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/464-4-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/464-31-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/428-44-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/464-47-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/428-48-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/428-57-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3188-64-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1604-69-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1604-74-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/2224-78-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3988-83-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3988-82-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3988-81-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3988-85-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4432-93-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4432-97-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/988-103-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/988-107-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4480-112-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1728-120-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/2520-128-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/2520-133-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4316-137-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4316-140-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/5084-145-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/2792-153-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/2792-157-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3476-162-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/3476-167-0x0000000000400000-0x0000000000451000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 31 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxrk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxrk32.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxrk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxrk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxrk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxrk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxrk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxrk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxrk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxrk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxrk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxrk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxrk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxrk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxrk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxrk32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 464 f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe 464 f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe 464 f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe 464 f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe 428 igfxrk32.exe 428 igfxrk32.exe 428 igfxrk32.exe 428 igfxrk32.exe 3188 igfxrk32.exe 3188 igfxrk32.exe 3188 igfxrk32.exe 3188 igfxrk32.exe 1604 igfxrk32.exe 1604 igfxrk32.exe 1604 igfxrk32.exe 1604 igfxrk32.exe 2224 igfxrk32.exe 2224 igfxrk32.exe 2224 igfxrk32.exe 2224 igfxrk32.exe 3988 igfxrk32.exe 3988 igfxrk32.exe 3988 igfxrk32.exe 3988 igfxrk32.exe 4432 igfxrk32.exe 4432 igfxrk32.exe 4432 igfxrk32.exe 4432 igfxrk32.exe 988 igfxrk32.exe 988 igfxrk32.exe 988 igfxrk32.exe 988 igfxrk32.exe 4480 igfxrk32.exe 4480 igfxrk32.exe 4480 igfxrk32.exe 4480 igfxrk32.exe 1728 igfxrk32.exe 1728 igfxrk32.exe 1728 igfxrk32.exe 1728 igfxrk32.exe 2520 igfxrk32.exe 2520 igfxrk32.exe 2520 igfxrk32.exe 2520 igfxrk32.exe 4316 igfxrk32.exe 4316 igfxrk32.exe 4316 igfxrk32.exe 4316 igfxrk32.exe 5084 igfxrk32.exe 5084 igfxrk32.exe 5084 igfxrk32.exe 5084 igfxrk32.exe 2792 igfxrk32.exe 2792 igfxrk32.exe 2792 igfxrk32.exe 2792 igfxrk32.exe 3476 igfxrk32.exe 3476 igfxrk32.exe 3476 igfxrk32.exe 3476 igfxrk32.exe 1400 igfxrk32.exe 1400 igfxrk32.exe 1400 igfxrk32.exe 1400 igfxrk32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1668 wrote to memory of 464 1668 f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe 83 PID 1668 wrote to memory of 464 1668 f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe 83 PID 1668 wrote to memory of 464 1668 f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe 83 PID 1668 wrote to memory of 464 1668 f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe 83 PID 1668 wrote to memory of 464 1668 f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe 83 PID 1668 wrote to memory of 464 1668 f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe 83 PID 1668 wrote to memory of 464 1668 f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe 83 PID 464 wrote to memory of 3244 464 f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe 87 PID 464 wrote to memory of 3244 464 f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe 87 PID 464 wrote to memory of 3244 464 f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe 87 PID 3244 wrote to memory of 428 3244 igfxrk32.exe 88 PID 3244 wrote to memory of 428 3244 igfxrk32.exe 88 PID 3244 wrote to memory of 428 3244 igfxrk32.exe 88 PID 3244 wrote to memory of 428 3244 igfxrk32.exe 88 PID 3244 wrote to memory of 428 3244 igfxrk32.exe 88 PID 3244 wrote to memory of 428 3244 igfxrk32.exe 88 PID 3244 wrote to memory of 428 3244 igfxrk32.exe 88 PID 428 wrote to memory of 2780 428 igfxrk32.exe 99 PID 428 wrote to memory of 2780 428 igfxrk32.exe 99 PID 428 wrote to memory of 2780 428 igfxrk32.exe 99 PID 2780 wrote to memory of 3188 2780 igfxrk32.exe 100 PID 2780 wrote to memory of 3188 2780 igfxrk32.exe 100 PID 2780 wrote to memory of 3188 2780 igfxrk32.exe 100 PID 2780 wrote to memory of 3188 2780 igfxrk32.exe 100 PID 2780 wrote to memory of 3188 2780 igfxrk32.exe 100 PID 2780 wrote to memory of 3188 2780 igfxrk32.exe 100 PID 2780 wrote to memory of 3188 2780 igfxrk32.exe 100 PID 3188 wrote to memory of 224 3188 igfxrk32.exe 101 PID 3188 wrote to memory of 224 3188 igfxrk32.exe 101 PID 3188 wrote to memory of 224 3188 igfxrk32.exe 101 PID 224 wrote to memory of 1604 224 igfxrk32.exe 103 PID 224 wrote to memory of 1604 224 igfxrk32.exe 103 PID 224 wrote to memory of 1604 224 igfxrk32.exe 103 PID 224 wrote to memory of 1604 224 igfxrk32.exe 103 PID 224 wrote to memory of 1604 224 igfxrk32.exe 103 PID 224 wrote to memory of 1604 224 igfxrk32.exe 103 PID 224 wrote to memory of 1604 224 igfxrk32.exe 103 PID 1604 wrote to memory of 2112 1604 igfxrk32.exe 106 PID 1604 wrote to memory of 2112 1604 igfxrk32.exe 106 PID 1604 wrote to memory of 2112 1604 igfxrk32.exe 106 PID 2112 wrote to memory of 2224 2112 igfxrk32.exe 107 PID 2112 wrote to memory of 2224 2112 igfxrk32.exe 107 PID 2112 wrote to memory of 2224 2112 igfxrk32.exe 107 PID 2112 wrote to memory of 2224 2112 igfxrk32.exe 107 PID 2112 wrote to memory of 2224 2112 igfxrk32.exe 107 PID 2112 wrote to memory of 2224 2112 igfxrk32.exe 107 PID 2112 wrote to memory of 2224 2112 igfxrk32.exe 107 PID 2224 wrote to memory of 2752 2224 igfxrk32.exe 108 PID 2224 wrote to memory of 2752 2224 igfxrk32.exe 108 PID 2224 wrote to memory of 2752 2224 igfxrk32.exe 108 PID 2752 wrote to memory of 3988 2752 igfxrk32.exe 109 PID 2752 wrote to memory of 3988 2752 igfxrk32.exe 109 PID 2752 wrote to memory of 3988 2752 igfxrk32.exe 109 PID 2752 wrote to memory of 3988 2752 igfxrk32.exe 109 PID 2752 wrote to memory of 3988 2752 igfxrk32.exe 109 PID 2752 wrote to memory of 3988 2752 igfxrk32.exe 109 PID 2752 wrote to memory of 3988 2752 igfxrk32.exe 109 PID 3988 wrote to memory of 4516 3988 igfxrk32.exe 110 PID 3988 wrote to memory of 4516 3988 igfxrk32.exe 110 PID 3988 wrote to memory of 4516 3988 igfxrk32.exe 110 PID 4432 wrote to memory of 1268 4432 igfxrk32.exe 112 PID 4432 wrote to memory of 1268 4432 igfxrk32.exe 112 PID 4432 wrote to memory of 1268 4432 igfxrk32.exe 112 PID 1268 wrote to memory of 988 1268 igfxrk32.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f85dfc3c6d0cb691d7341f063a3266c3_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Users\Admin\AppData\Local\Temp\F85DFC~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Users\Admin\AppData\Local\Temp\F85DFC~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Windows\SysWOW64\igfxrk32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Windows\SysWOW64\igfxrk32.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Windows\SysWOW64\igfxrk32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Windows\SysWOW64\igfxrk32.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Windows\SysWOW64\igfxrk32.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Windows\SysWOW64\igfxrk32.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Windows\SysWOW64\igfxrk32.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Windows\SysWOW64\igfxrk32.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Windows\SysWOW64\igfxrk32.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4516 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Windows\SysWOW64\igfxrk32.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Windows\SysWOW64\igfxrk32.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Windows\SysWOW64\igfxrk32.exe16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:988 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Windows\SysWOW64\igfxrk32.exe17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4612 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Windows\SysWOW64\igfxrk32.exe18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4480 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Windows\SysWOW64\igfxrk32.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2500 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Windows\SysWOW64\igfxrk32.exe20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1728 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Windows\SysWOW64\igfxrk32.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4256 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Windows\SysWOW64\igfxrk32.exe22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2520 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Windows\SysWOW64\igfxrk32.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3384 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Windows\SysWOW64\igfxrk32.exe24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4316 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Windows\SysWOW64\igfxrk32.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4820 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Windows\SysWOW64\igfxrk32.exe26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5084 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Windows\SysWOW64\igfxrk32.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3968 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Windows\SysWOW64\igfxrk32.exe28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2792 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Windows\SysWOW64\igfxrk32.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2948 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Windows\SysWOW64\igfxrk32.exe30⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3476 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Windows\SysWOW64\igfxrk32.exe31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1712 -
C:\Windows\SysWOW64\igfxrk32.exe"C:\Windows\system32\igfxrk32.exe" C:\Windows\SysWOW64\igfxrk32.exe32⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1400
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
220KB
MD5f85dfc3c6d0cb691d7341f063a3266c3
SHA1eb353f245d504107b9007d43bb4dfc96c1b300a8
SHA2564b95ec1f9aeb58dbe173f08afd61004ddf7d1b28a3f96ed25f19792092328a43
SHA512310a8d9be8f0cf17acc8e1f66e61ac99a5fdd5c3effd283bc61f91886a7863dd553130f433865e77a7d5530b45b5a3395fcf9d20acc91e54f921cff40180fc62