Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/12/2024, 13:52
Static task
static1
Behavioral task
behavioral1
Sample
fbcbe4a20ac9cd0567ba96dafa08129d_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fbcbe4a20ac9cd0567ba96dafa08129d_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
fbcbe4a20ac9cd0567ba96dafa08129d_JaffaCakes118.exe
-
Size
163KB
-
MD5
fbcbe4a20ac9cd0567ba96dafa08129d
-
SHA1
191ff2231fc3070de345251e89d1f13ea035be4d
-
SHA256
4b3990375d2eec9f676836a2f46b9dcb1c55854c5ece97ec22218f246f1642b2
-
SHA512
ce393ed6a4a9218e7cc029a7bc1d0b965f29c5f3e643046092fa9f9a37fd8685db4c2ee0c1424b6828d925fe6f73d89a997762bfcdd2b996582ac97e3ef27392
-
SSDEEP
3072:k194BB9ZN91eRHm02Voe//OEG8OdmjUtk+Zg43:8ubj4RH2VotmQa9k
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Deletes itself 1 IoCs
pid Process 2188 igfxtc32.exe -
Executes dropped EXE 46 IoCs
pid Process 2188 igfxtc32.exe 2668 igfxtc32.exe 1976 igfxtc32.exe 1660 igfxtc32.exe 1032 igfxtc32.exe 2120 igfxtc32.exe 2620 igfxtc32.exe 560 igfxtc32.exe 540 igfxtc32.exe 2352 igfxtc32.exe 1584 igfxtc32.exe 2616 igfxtc32.exe 2868 igfxtc32.exe 1244 igfxtc32.exe 812 igfxtc32.exe 2792 igfxtc32.exe 1556 igfxtc32.exe 640 igfxtc32.exe 1308 igfxtc32.exe 1536 igfxtc32.exe 2420 igfxtc32.exe 2900 igfxtc32.exe 3068 igfxtc32.exe 2168 igfxtc32.exe 2528 igfxtc32.exe 1656 igfxtc32.exe 1688 igfxtc32.exe 1768 igfxtc32.exe 1036 igfxtc32.exe 2892 igfxtc32.exe 2120 igfxtc32.exe 1336 igfxtc32.exe 2080 igfxtc32.exe 892 igfxtc32.exe 2256 igfxtc32.exe 2900 igfxtc32.exe 1600 igfxtc32.exe 2168 igfxtc32.exe 3000 igfxtc32.exe 1912 igfxtc32.exe 2860 igfxtc32.exe 1568 igfxtc32.exe 788 igfxtc32.exe 2348 igfxtc32.exe 968 igfxtc32.exe 1804 igfxtc32.exe -
Loads dropped DLL 64 IoCs
pid Process 1128 fbcbe4a20ac9cd0567ba96dafa08129d_JaffaCakes118.exe 1128 fbcbe4a20ac9cd0567ba96dafa08129d_JaffaCakes118.exe 2188 igfxtc32.exe 2188 igfxtc32.exe 2668 igfxtc32.exe 2668 igfxtc32.exe 1976 igfxtc32.exe 1976 igfxtc32.exe 1660 igfxtc32.exe 1660 igfxtc32.exe 1032 igfxtc32.exe 1032 igfxtc32.exe 2120 igfxtc32.exe 2120 igfxtc32.exe 2620 igfxtc32.exe 2620 igfxtc32.exe 560 igfxtc32.exe 560 igfxtc32.exe 540 igfxtc32.exe 540 igfxtc32.exe 2352 igfxtc32.exe 2352 igfxtc32.exe 1584 igfxtc32.exe 1584 igfxtc32.exe 2616 igfxtc32.exe 2616 igfxtc32.exe 2868 igfxtc32.exe 2868 igfxtc32.exe 1244 igfxtc32.exe 1244 igfxtc32.exe 812 igfxtc32.exe 812 igfxtc32.exe 2792 igfxtc32.exe 2792 igfxtc32.exe 1556 igfxtc32.exe 1556 igfxtc32.exe 640 igfxtc32.exe 640 igfxtc32.exe 1308 igfxtc32.exe 1308 igfxtc32.exe 1536 igfxtc32.exe 1536 igfxtc32.exe 2420 igfxtc32.exe 2420 igfxtc32.exe 2900 igfxtc32.exe 2900 igfxtc32.exe 3068 igfxtc32.exe 3068 igfxtc32.exe 2168 igfxtc32.exe 2168 igfxtc32.exe 2528 igfxtc32.exe 2528 igfxtc32.exe 1656 igfxtc32.exe 1656 igfxtc32.exe 1688 igfxtc32.exe 1688 igfxtc32.exe 1768 igfxtc32.exe 1768 igfxtc32.exe 1036 igfxtc32.exe 1036 igfxtc32.exe 2892 igfxtc32.exe 2892 igfxtc32.exe 2120 igfxtc32.exe 2120 igfxtc32.exe -
Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum fbcbe4a20ac9cd0567ba96dafa08129d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 fbcbe4a20ac9cd0567ba96dafa08129d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxtc32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ fbcbe4a20ac9cd0567ba96dafa08129d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe fbcbe4a20ac9cd0567ba96dafa08129d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File created C:\Windows\SysWOW64\igfxtc32.exe igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe File opened for modification C:\Windows\SysWOW64\ igfxtc32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 47 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbcbe4a20ac9cd0567ba96dafa08129d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxtc32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1128 fbcbe4a20ac9cd0567ba96dafa08129d_JaffaCakes118.exe 1128 fbcbe4a20ac9cd0567ba96dafa08129d_JaffaCakes118.exe 2188 igfxtc32.exe 2188 igfxtc32.exe 2668 igfxtc32.exe 2668 igfxtc32.exe 1976 igfxtc32.exe 1976 igfxtc32.exe 1660 igfxtc32.exe 1660 igfxtc32.exe 1032 igfxtc32.exe 1032 igfxtc32.exe 2120 igfxtc32.exe 2120 igfxtc32.exe 2620 igfxtc32.exe 2620 igfxtc32.exe 560 igfxtc32.exe 560 igfxtc32.exe 540 igfxtc32.exe 540 igfxtc32.exe 2352 igfxtc32.exe 2352 igfxtc32.exe 1584 igfxtc32.exe 1584 igfxtc32.exe 2616 igfxtc32.exe 2616 igfxtc32.exe 2868 igfxtc32.exe 2868 igfxtc32.exe 1244 igfxtc32.exe 1244 igfxtc32.exe 812 igfxtc32.exe 812 igfxtc32.exe 2792 igfxtc32.exe 2792 igfxtc32.exe 1556 igfxtc32.exe 1556 igfxtc32.exe 640 igfxtc32.exe 640 igfxtc32.exe 1308 igfxtc32.exe 1308 igfxtc32.exe 1536 igfxtc32.exe 1536 igfxtc32.exe 2420 igfxtc32.exe 2420 igfxtc32.exe 2900 igfxtc32.exe 2900 igfxtc32.exe 3068 igfxtc32.exe 3068 igfxtc32.exe 2168 igfxtc32.exe 2168 igfxtc32.exe 2528 igfxtc32.exe 2528 igfxtc32.exe 1656 igfxtc32.exe 1656 igfxtc32.exe 1688 igfxtc32.exe 1688 igfxtc32.exe 1768 igfxtc32.exe 1768 igfxtc32.exe 1036 igfxtc32.exe 1036 igfxtc32.exe 2892 igfxtc32.exe 2892 igfxtc32.exe 2120 igfxtc32.exe 2120 igfxtc32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1128 wrote to memory of 2188 1128 fbcbe4a20ac9cd0567ba96dafa08129d_JaffaCakes118.exe 31 PID 1128 wrote to memory of 2188 1128 fbcbe4a20ac9cd0567ba96dafa08129d_JaffaCakes118.exe 31 PID 1128 wrote to memory of 2188 1128 fbcbe4a20ac9cd0567ba96dafa08129d_JaffaCakes118.exe 31 PID 1128 wrote to memory of 2188 1128 fbcbe4a20ac9cd0567ba96dafa08129d_JaffaCakes118.exe 31 PID 2188 wrote to memory of 2668 2188 igfxtc32.exe 32 PID 2188 wrote to memory of 2668 2188 igfxtc32.exe 32 PID 2188 wrote to memory of 2668 2188 igfxtc32.exe 32 PID 2188 wrote to memory of 2668 2188 igfxtc32.exe 32 PID 2668 wrote to memory of 1976 2668 igfxtc32.exe 33 PID 2668 wrote to memory of 1976 2668 igfxtc32.exe 33 PID 2668 wrote to memory of 1976 2668 igfxtc32.exe 33 PID 2668 wrote to memory of 1976 2668 igfxtc32.exe 33 PID 1976 wrote to memory of 1660 1976 igfxtc32.exe 34 PID 1976 wrote to memory of 1660 1976 igfxtc32.exe 34 PID 1976 wrote to memory of 1660 1976 igfxtc32.exe 34 PID 1976 wrote to memory of 1660 1976 igfxtc32.exe 34 PID 1660 wrote to memory of 1032 1660 igfxtc32.exe 35 PID 1660 wrote to memory of 1032 1660 igfxtc32.exe 35 PID 1660 wrote to memory of 1032 1660 igfxtc32.exe 35 PID 1660 wrote to memory of 1032 1660 igfxtc32.exe 35 PID 1032 wrote to memory of 2120 1032 igfxtc32.exe 36 PID 1032 wrote to memory of 2120 1032 igfxtc32.exe 36 PID 1032 wrote to memory of 2120 1032 igfxtc32.exe 36 PID 1032 wrote to memory of 2120 1032 igfxtc32.exe 36 PID 2120 wrote to memory of 2620 2120 igfxtc32.exe 37 PID 2120 wrote to memory of 2620 2120 igfxtc32.exe 37 PID 2120 wrote to memory of 2620 2120 igfxtc32.exe 37 PID 2120 wrote to memory of 2620 2120 igfxtc32.exe 37 PID 2620 wrote to memory of 560 2620 igfxtc32.exe 38 PID 2620 wrote to memory of 560 2620 igfxtc32.exe 38 PID 2620 wrote to memory of 560 2620 igfxtc32.exe 38 PID 2620 wrote to memory of 560 2620 igfxtc32.exe 38 PID 560 wrote to memory of 540 560 igfxtc32.exe 39 PID 560 wrote to memory of 540 560 igfxtc32.exe 39 PID 560 wrote to memory of 540 560 igfxtc32.exe 39 PID 560 wrote to memory of 540 560 igfxtc32.exe 39 PID 540 wrote to memory of 2352 540 igfxtc32.exe 40 PID 540 wrote to memory of 2352 540 igfxtc32.exe 40 PID 540 wrote to memory of 2352 540 igfxtc32.exe 40 PID 540 wrote to memory of 2352 540 igfxtc32.exe 40 PID 2352 wrote to memory of 1584 2352 igfxtc32.exe 41 PID 2352 wrote to memory of 1584 2352 igfxtc32.exe 41 PID 2352 wrote to memory of 1584 2352 igfxtc32.exe 41 PID 2352 wrote to memory of 1584 2352 igfxtc32.exe 41 PID 1584 wrote to memory of 2616 1584 igfxtc32.exe 42 PID 1584 wrote to memory of 2616 1584 igfxtc32.exe 42 PID 1584 wrote to memory of 2616 1584 igfxtc32.exe 42 PID 1584 wrote to memory of 2616 1584 igfxtc32.exe 42 PID 2616 wrote to memory of 2868 2616 igfxtc32.exe 43 PID 2616 wrote to memory of 2868 2616 igfxtc32.exe 43 PID 2616 wrote to memory of 2868 2616 igfxtc32.exe 43 PID 2616 wrote to memory of 2868 2616 igfxtc32.exe 43 PID 2868 wrote to memory of 1244 2868 igfxtc32.exe 44 PID 2868 wrote to memory of 1244 2868 igfxtc32.exe 44 PID 2868 wrote to memory of 1244 2868 igfxtc32.exe 44 PID 2868 wrote to memory of 1244 2868 igfxtc32.exe 44 PID 1244 wrote to memory of 812 1244 igfxtc32.exe 45 PID 1244 wrote to memory of 812 1244 igfxtc32.exe 45 PID 1244 wrote to memory of 812 1244 igfxtc32.exe 45 PID 1244 wrote to memory of 812 1244 igfxtc32.exe 45 PID 812 wrote to memory of 2792 812 igfxtc32.exe 46 PID 812 wrote to memory of 2792 812 igfxtc32.exe 46 PID 812 wrote to memory of 2792 812 igfxtc32.exe 46 PID 812 wrote to memory of 2792 812 igfxtc32.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbcbe4a20ac9cd0567ba96dafa08129d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fbcbe4a20ac9cd0567ba96dafa08129d_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Users\Admin\AppData\Local\Temp\FBCBE4~1.EXE2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2792 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1556 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:640 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1308 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1536 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2420 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2900 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3068 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2168 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2528 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1656 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1688 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1768 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1036 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2892 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2120 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe33⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1336 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe34⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2080 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:892 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe36⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:2256 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe37⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2900 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe38⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1600 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe39⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2168 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe40⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3000 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1912 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe42⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2860 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe43⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:1568 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe44⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:788 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe45⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2348 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe46⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:968 -
C:\Windows\SysWOW64\igfxtc32.exe"C:\Windows\system32\igfxtc32.exe" C:\Windows\SysWOW64\igfxtc32.exe47⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1804
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
163KB
MD5fbcbe4a20ac9cd0567ba96dafa08129d
SHA1191ff2231fc3070de345251e89d1f13ea035be4d
SHA2564b3990375d2eec9f676836a2f46b9dcb1c55854c5ece97ec22218f246f1642b2
SHA512ce393ed6a4a9218e7cc029a7bc1d0b965f29c5f3e643046092fa9f9a37fd8685db4c2ee0c1424b6828d925fe6f73d89a997762bfcdd2b996582ac97e3ef27392