Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/01/2025, 06:44
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe
-
Size
224KB
-
MD5
02bcd02ac649b47c88df945125551f16
-
SHA1
431a617ff4ff5a5ba599262eec35073fca7f79bd
-
SHA256
f53ec0d23818613b780d630e985a96cc27f8c15206bca27480fce13f24b134ea
-
SHA512
046daf4b9732bbf237b541c4fdc88ed0461e20466712cd5ae5359180c78c497c1c7e980cf2f767d92cc98da8db39a0bed9f049ed216f8b6c86344114708faf40
-
SSDEEP
6144:uqvXfDrFUBEUOK6ielBslV35zErFUBEUOK6+:VrV1B0dErVi
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Deletes itself 1 IoCs
pid Process 2644 igfxsvr64.exe -
Executes dropped EXE 64 IoCs
pid Process 2948 igfxsvr64.exe 2644 igfxsvr64.exe 2308 igfxsvr64.exe 2840 igfxsvr64.exe 2504 igfxsvr64.exe 264 igfxsvr64.exe 2296 igfxsvr64.exe 2956 igfxsvr64.exe 1848 igfxsvr64.exe 1152 igfxsvr64.exe 1140 igfxsvr64.exe 2420 igfxsvr64.exe 2180 igfxsvr64.exe 1108 igfxsvr64.exe 956 igfxsvr64.exe 2292 igfxsvr64.exe 924 igfxsvr64.exe 1996 igfxsvr64.exe 536 igfxsvr64.exe 1012 igfxsvr64.exe 2348 igfxsvr64.exe 2812 igfxsvr64.exe 2732 igfxsvr64.exe 2584 igfxsvr64.exe 2712 igfxsvr64.exe 1792 igfxsvr64.exe 1976 igfxsvr64.exe 2936 igfxsvr64.exe 2324 igfxsvr64.exe 2864 igfxsvr64.exe 620 igfxsvr64.exe 1904 igfxsvr64.exe 2240 igfxsvr64.exe 2052 igfxsvr64.exe 2780 igfxsvr64.exe 1040 igfxsvr64.exe 1448 igfxsvr64.exe 296 igfxsvr64.exe 1344 igfxsvr64.exe 600 igfxsvr64.exe 564 igfxsvr64.exe 1676 igfxsvr64.exe 1740 igfxsvr64.exe 1692 igfxsvr64.exe 2748 igfxsvr64.exe 2892 igfxsvr64.exe 2980 igfxsvr64.exe 2616 igfxsvr64.exe 1920 igfxsvr64.exe 2996 igfxsvr64.exe 2416 igfxsvr64.exe 352 igfxsvr64.exe 2988 igfxsvr64.exe 2700 igfxsvr64.exe 2280 igfxsvr64.exe 2868 igfxsvr64.exe 2104 igfxsvr64.exe 1848 igfxsvr64.exe 808 igfxsvr64.exe 3048 igfxsvr64.exe 2252 igfxsvr64.exe 1956 igfxsvr64.exe 1396 igfxsvr64.exe 1252 igfxsvr64.exe -
Loads dropped DLL 64 IoCs
pid Process 2756 JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe 2756 JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe 2644 igfxsvr64.exe 2644 igfxsvr64.exe 2840 igfxsvr64.exe 2840 igfxsvr64.exe 264 igfxsvr64.exe 264 igfxsvr64.exe 2956 igfxsvr64.exe 2956 igfxsvr64.exe 1152 igfxsvr64.exe 1152 igfxsvr64.exe 2420 igfxsvr64.exe 2420 igfxsvr64.exe 1108 igfxsvr64.exe 1108 igfxsvr64.exe 2292 igfxsvr64.exe 2292 igfxsvr64.exe 1996 igfxsvr64.exe 1996 igfxsvr64.exe 1012 igfxsvr64.exe 1012 igfxsvr64.exe 2812 igfxsvr64.exe 2812 igfxsvr64.exe 2584 igfxsvr64.exe 2584 igfxsvr64.exe 1792 igfxsvr64.exe 1792 igfxsvr64.exe 2936 igfxsvr64.exe 2936 igfxsvr64.exe 2864 igfxsvr64.exe 2864 igfxsvr64.exe 1904 igfxsvr64.exe 1904 igfxsvr64.exe 2052 igfxsvr64.exe 2052 igfxsvr64.exe 1040 igfxsvr64.exe 1040 igfxsvr64.exe 296 igfxsvr64.exe 296 igfxsvr64.exe 600 igfxsvr64.exe 600 igfxsvr64.exe 1676 igfxsvr64.exe 1676 igfxsvr64.exe 1692 igfxsvr64.exe 1692 igfxsvr64.exe 2892 igfxsvr64.exe 2892 igfxsvr64.exe 2616 igfxsvr64.exe 2616 igfxsvr64.exe 2996 igfxsvr64.exe 2996 igfxsvr64.exe 352 igfxsvr64.exe 352 igfxsvr64.exe 2700 igfxsvr64.exe 2700 igfxsvr64.exe 2868 igfxsvr64.exe 2868 igfxsvr64.exe 1848 igfxsvr64.exe 1848 igfxsvr64.exe 3048 igfxsvr64.exe 3048 igfxsvr64.exe 1956 igfxsvr64.exe 1956 igfxsvr64.exe -
Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxsvr64.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe File opened for modification C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\ igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File created C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\ igfxsvr64.exe File created C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\ igfxsvr64.exe File created C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File created C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File created C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\ igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\ igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\ igfxsvr64.exe File created C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File created C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\ igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\ igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\ igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\ igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\ igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\ igfxsvr64.exe File created C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\ igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File created C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File created C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File created C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\ igfxsvr64.exe File created C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File created C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\igfxsvr64.exe JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe File opened for modification C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\ igfxsvr64.exe File created C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File created C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\ igfxsvr64.exe File created C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\ igfxsvr64.exe File created C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\ igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\ igfxsvr64.exe File created C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File created C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\ igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\ igfxsvr64.exe File created C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe File opened for modification C:\Windows\SysWOW64\igfxsvr64.exe igfxsvr64.exe -
Suspicious use of SetThreadContext 60 IoCs
description pid Process procid_target PID 2448 set thread context of 2756 2448 JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe 30 PID 2948 set thread context of 2644 2948 igfxsvr64.exe 32 PID 2308 set thread context of 2840 2308 igfxsvr64.exe 34 PID 2504 set thread context of 264 2504 igfxsvr64.exe 36 PID 2296 set thread context of 2956 2296 igfxsvr64.exe 38 PID 1848 set thread context of 1152 1848 igfxsvr64.exe 40 PID 1140 set thread context of 2420 1140 igfxsvr64.exe 42 PID 2180 set thread context of 1108 2180 igfxsvr64.exe 44 PID 956 set thread context of 2292 956 igfxsvr64.exe 46 PID 924 set thread context of 1996 924 igfxsvr64.exe 49 PID 536 set thread context of 1012 536 igfxsvr64.exe 51 PID 2348 set thread context of 2812 2348 igfxsvr64.exe 53 PID 2732 set thread context of 2584 2732 igfxsvr64.exe 55 PID 2712 set thread context of 1792 2712 igfxsvr64.exe 57 PID 1976 set thread context of 2936 1976 igfxsvr64.exe 59 PID 2324 set thread context of 2864 2324 igfxsvr64.exe 61 PID 620 set thread context of 1904 620 igfxsvr64.exe 63 PID 2240 set thread context of 2052 2240 igfxsvr64.exe 65 PID 2780 set thread context of 1040 2780 igfxsvr64.exe 67 PID 1448 set thread context of 296 1448 igfxsvr64.exe 69 PID 1344 set thread context of 600 1344 igfxsvr64.exe 71 PID 564 set thread context of 1676 564 igfxsvr64.exe 73 PID 1740 set thread context of 1692 1740 igfxsvr64.exe 75 PID 2748 set thread context of 2892 2748 igfxsvr64.exe 77 PID 2980 set thread context of 2616 2980 igfxsvr64.exe 79 PID 1920 set thread context of 2996 1920 igfxsvr64.exe 81 PID 2416 set thread context of 352 2416 igfxsvr64.exe 83 PID 2988 set thread context of 2700 2988 igfxsvr64.exe 85 PID 2280 set thread context of 2868 2280 igfxsvr64.exe 87 PID 2104 set thread context of 1848 2104 igfxsvr64.exe 89 PID 808 set thread context of 3048 808 igfxsvr64.exe 91 PID 2252 set thread context of 1956 2252 igfxsvr64.exe 93 PID 1396 set thread context of 1252 1396 igfxsvr64.exe 95 PID 924 set thread context of 640 924 igfxsvr64.exe 97 PID 332 set thread context of 3068 332 igfxsvr64.exe 99 PID 2740 set thread context of 2496 2740 igfxsvr64.exe 101 PID 2732 set thread context of 3024 2732 igfxsvr64.exe 103 PID 2712 set thread context of 2012 2712 igfxsvr64.exe 105 PID 532 set thread context of 2516 532 igfxsvr64.exe 107 PID 2932 set thread context of 2760 2932 igfxsvr64.exe 109 PID 2324 set thread context of 1316 2324 igfxsvr64.exe 111 PID 604 set thread context of 2444 604 igfxsvr64.exe 113 PID 2576 set thread context of 2340 2576 igfxsvr64.exe 115 PID 2016 set thread context of 1336 2016 igfxsvr64.exe 117 PID 688 set thread context of 1396 688 igfxsvr64.exe 119 PID 2392 set thread context of 3064 2392 igfxsvr64.exe 121 PID 1588 set thread context of 1584 1588 igfxsvr64.exe 123 PID 2748 set thread context of 2808 2748 igfxsvr64.exe 125 PID 2628 set thread context of 1256 2628 igfxsvr64.exe 127 PID 1612 set thread context of 2076 1612 igfxsvr64.exe 129 PID 2272 set thread context of 2156 2272 igfxsvr64.exe 131 PID 1928 set thread context of 2328 1928 igfxsvr64.exe 133 PID 2128 set thread context of 2944 2128 igfxsvr64.exe 135 PID 2436 set thread context of 2240 2436 igfxsvr64.exe 137 PID 748 set thread context of 2064 748 igfxsvr64.exe 139 PID 1736 set thread context of 956 1736 igfxsvr64.exe 141 PID 896 set thread context of 2336 896 igfxsvr64.exe 143 PID 2384 set thread context of 1932 2384 igfxsvr64.exe 145 PID 1580 set thread context of 920 1580 igfxsvr64.exe 147 PID 2624 set thread context of 2592 2624 igfxsvr64.exe 149 -
resource yara_rule behavioral1/memory/2756-8-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2756-11-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2756-13-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2756-12-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2756-10-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2756-5-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2756-4-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2756-26-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2644-38-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2644-40-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2644-39-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2644-48-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2840-56-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2840-64-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/264-76-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/264-82-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2956-100-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/1152-121-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2420-140-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/1108-149-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/1108-159-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2292-167-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2292-177-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/1996-194-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/1012-206-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/1012-213-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2812-233-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2584-250-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/1792-264-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/1792-270-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2936-284-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2936-287-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2864-297-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2864-302-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/1904-312-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/1904-317-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2052-331-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/1040-341-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/1040-346-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/296-355-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/296-361-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/600-376-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/1676-389-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/1692-403-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2892-417-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2616-431-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2996-445-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/352-460-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2700-473-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2868-488-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/1848-496-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/1848-502-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/3048-516-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/1956-530-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/1252-540-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/1252-545-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/640-559-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/3068-571-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/3068-574-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2496-582-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2496-591-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/3024-603-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/3024-606-0x0000000000400000-0x000000000045E000-memory.dmp upx behavioral1/memory/2012-616-0x0000000000400000-0x000000000045E000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxsvr64.exe -
Suspicious behavior: EnumeratesProcesses 59 IoCs
pid Process 2756 JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe 2644 igfxsvr64.exe 2840 igfxsvr64.exe 264 igfxsvr64.exe 2956 igfxsvr64.exe 1152 igfxsvr64.exe 2420 igfxsvr64.exe 1108 igfxsvr64.exe 2292 igfxsvr64.exe 1996 igfxsvr64.exe 1012 igfxsvr64.exe 2812 igfxsvr64.exe 2584 igfxsvr64.exe 1792 igfxsvr64.exe 2936 igfxsvr64.exe 2864 igfxsvr64.exe 1904 igfxsvr64.exe 2052 igfxsvr64.exe 1040 igfxsvr64.exe 296 igfxsvr64.exe 600 igfxsvr64.exe 1676 igfxsvr64.exe 1692 igfxsvr64.exe 2892 igfxsvr64.exe 2616 igfxsvr64.exe 2996 igfxsvr64.exe 352 igfxsvr64.exe 2700 igfxsvr64.exe 2868 igfxsvr64.exe 1848 igfxsvr64.exe 3048 igfxsvr64.exe 1956 igfxsvr64.exe 1252 igfxsvr64.exe 640 igfxsvr64.exe 3068 igfxsvr64.exe 3024 igfxsvr64.exe 2012 igfxsvr64.exe 2516 igfxsvr64.exe 2760 igfxsvr64.exe 1316 igfxsvr64.exe 2444 igfxsvr64.exe 2340 igfxsvr64.exe 1336 igfxsvr64.exe 1396 igfxsvr64.exe 3064 igfxsvr64.exe 1584 igfxsvr64.exe 2808 igfxsvr64.exe 1256 igfxsvr64.exe 2076 igfxsvr64.exe 2156 igfxsvr64.exe 2328 igfxsvr64.exe 2944 igfxsvr64.exe 2240 igfxsvr64.exe 2064 igfxsvr64.exe 956 igfxsvr64.exe 2336 igfxsvr64.exe 1932 igfxsvr64.exe 920 igfxsvr64.exe 2592 igfxsvr64.exe -
Suspicious use of SetWindowsHookEx 60 IoCs
pid Process 2448 JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe 2948 igfxsvr64.exe 2308 igfxsvr64.exe 2504 igfxsvr64.exe 2296 igfxsvr64.exe 1848 igfxsvr64.exe 1140 igfxsvr64.exe 2180 igfxsvr64.exe 956 igfxsvr64.exe 924 igfxsvr64.exe 536 igfxsvr64.exe 2348 igfxsvr64.exe 2732 igfxsvr64.exe 2712 igfxsvr64.exe 1976 igfxsvr64.exe 2324 igfxsvr64.exe 620 igfxsvr64.exe 2240 igfxsvr64.exe 2780 igfxsvr64.exe 1448 igfxsvr64.exe 1344 igfxsvr64.exe 564 igfxsvr64.exe 1740 igfxsvr64.exe 2748 igfxsvr64.exe 2980 igfxsvr64.exe 1920 igfxsvr64.exe 2416 igfxsvr64.exe 2988 igfxsvr64.exe 2280 igfxsvr64.exe 2104 igfxsvr64.exe 808 igfxsvr64.exe 2252 igfxsvr64.exe 1396 igfxsvr64.exe 924 igfxsvr64.exe 332 igfxsvr64.exe 2740 igfxsvr64.exe 2732 igfxsvr64.exe 2712 igfxsvr64.exe 532 igfxsvr64.exe 2932 igfxsvr64.exe 2324 igfxsvr64.exe 604 igfxsvr64.exe 2576 igfxsvr64.exe 2016 igfxsvr64.exe 688 igfxsvr64.exe 2392 igfxsvr64.exe 1588 igfxsvr64.exe 2748 igfxsvr64.exe 2628 igfxsvr64.exe 1612 igfxsvr64.exe 2272 igfxsvr64.exe 1928 igfxsvr64.exe 2128 igfxsvr64.exe 2436 igfxsvr64.exe 748 igfxsvr64.exe 1736 igfxsvr64.exe 896 igfxsvr64.exe 2384 igfxsvr64.exe 1580 igfxsvr64.exe 2624 igfxsvr64.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2448 wrote to memory of 2756 2448 JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe 30 PID 2448 wrote to memory of 2756 2448 JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe 30 PID 2448 wrote to memory of 2756 2448 JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe 30 PID 2448 wrote to memory of 2756 2448 JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe 30 PID 2448 wrote to memory of 2756 2448 JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe 30 PID 2448 wrote to memory of 2756 2448 JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe 30 PID 2448 wrote to memory of 2756 2448 JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe 30 PID 2448 wrote to memory of 2756 2448 JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe 30 PID 2756 wrote to memory of 2948 2756 JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe 31 PID 2756 wrote to memory of 2948 2756 JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe 31 PID 2756 wrote to memory of 2948 2756 JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe 31 PID 2756 wrote to memory of 2948 2756 JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe 31 PID 2948 wrote to memory of 2644 2948 igfxsvr64.exe 32 PID 2948 wrote to memory of 2644 2948 igfxsvr64.exe 32 PID 2948 wrote to memory of 2644 2948 igfxsvr64.exe 32 PID 2948 wrote to memory of 2644 2948 igfxsvr64.exe 32 PID 2948 wrote to memory of 2644 2948 igfxsvr64.exe 32 PID 2948 wrote to memory of 2644 2948 igfxsvr64.exe 32 PID 2948 wrote to memory of 2644 2948 igfxsvr64.exe 32 PID 2948 wrote to memory of 2644 2948 igfxsvr64.exe 32 PID 2644 wrote to memory of 2308 2644 igfxsvr64.exe 33 PID 2644 wrote to memory of 2308 2644 igfxsvr64.exe 33 PID 2644 wrote to memory of 2308 2644 igfxsvr64.exe 33 PID 2644 wrote to memory of 2308 2644 igfxsvr64.exe 33 PID 2308 wrote to memory of 2840 2308 igfxsvr64.exe 34 PID 2308 wrote to memory of 2840 2308 igfxsvr64.exe 34 PID 2308 wrote to memory of 2840 2308 igfxsvr64.exe 34 PID 2308 wrote to memory of 2840 2308 igfxsvr64.exe 34 PID 2308 wrote to memory of 2840 2308 igfxsvr64.exe 34 PID 2308 wrote to memory of 2840 2308 igfxsvr64.exe 34 PID 2308 wrote to memory of 2840 2308 igfxsvr64.exe 34 PID 2308 wrote to memory of 2840 2308 igfxsvr64.exe 34 PID 2840 wrote to memory of 2504 2840 igfxsvr64.exe 35 PID 2840 wrote to memory of 2504 2840 igfxsvr64.exe 35 PID 2840 wrote to memory of 2504 2840 igfxsvr64.exe 35 PID 2840 wrote to memory of 2504 2840 igfxsvr64.exe 35 PID 2504 wrote to memory of 264 2504 igfxsvr64.exe 36 PID 2504 wrote to memory of 264 2504 igfxsvr64.exe 36 PID 2504 wrote to memory of 264 2504 igfxsvr64.exe 36 PID 2504 wrote to memory of 264 2504 igfxsvr64.exe 36 PID 2504 wrote to memory of 264 2504 igfxsvr64.exe 36 PID 2504 wrote to memory of 264 2504 igfxsvr64.exe 36 PID 2504 wrote to memory of 264 2504 igfxsvr64.exe 36 PID 2504 wrote to memory of 264 2504 igfxsvr64.exe 36 PID 264 wrote to memory of 2296 264 igfxsvr64.exe 37 PID 264 wrote to memory of 2296 264 igfxsvr64.exe 37 PID 264 wrote to memory of 2296 264 igfxsvr64.exe 37 PID 264 wrote to memory of 2296 264 igfxsvr64.exe 37 PID 2296 wrote to memory of 2956 2296 igfxsvr64.exe 38 PID 2296 wrote to memory of 2956 2296 igfxsvr64.exe 38 PID 2296 wrote to memory of 2956 2296 igfxsvr64.exe 38 PID 2296 wrote to memory of 2956 2296 igfxsvr64.exe 38 PID 2296 wrote to memory of 2956 2296 igfxsvr64.exe 38 PID 2296 wrote to memory of 2956 2296 igfxsvr64.exe 38 PID 2296 wrote to memory of 2956 2296 igfxsvr64.exe 38 PID 2296 wrote to memory of 2956 2296 igfxsvr64.exe 38 PID 2956 wrote to memory of 1848 2956 igfxsvr64.exe 39 PID 2956 wrote to memory of 1848 2956 igfxsvr64.exe 39 PID 2956 wrote to memory of 1848 2956 igfxsvr64.exe 39 PID 2956 wrote to memory of 1848 2956 igfxsvr64.exe 39 PID 1848 wrote to memory of 1152 1848 igfxsvr64.exe 40 PID 1848 wrote to memory of 1152 1848 igfxsvr64.exe 40 PID 1848 wrote to memory of 1152 1848 igfxsvr64.exe 40 PID 1848 wrote to memory of 1152 1848 igfxsvr64.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_02bcd02ac649b47c88df945125551f16.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_02bcd02ac649b47c88df945125551f16.exe2⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE4⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE12⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1152 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1140 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE14⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2420 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2180 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:1108 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:956 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE18⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2292 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:924 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE20⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1996 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:536 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1012 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2348 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE24⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2812 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2732 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE26⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2584 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2712 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE28⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1792 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1976 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE30⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:2936 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2324 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE32⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2864 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:620 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE34⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1904 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2240 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE36⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2052 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2780 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE38⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1040 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1448 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE40⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:296 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1344 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE42⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:600 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:564 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE44⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1676 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1740 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE46⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1692 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2748 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE48⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2892 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2980 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE50⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2616 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1920 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE52⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2996 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2416 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE54⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:352 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2988 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE56⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2700 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2280 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE58⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2868 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2104 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE60⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1848 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:808 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE62⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3048 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE63⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2252 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE64⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1956 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE65⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1396 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE66⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1252 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE67⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:924 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE68⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:640 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE69⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:332 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE70⤵
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3068 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE71⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2740 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE72⤵
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
PID:2496 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE73⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2732 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE74⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3024 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE75⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2712 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE76⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2012 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE77⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:532 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE78⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2516 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE79⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2932 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE80⤵
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2760 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE81⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2324 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE82⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1316 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE83⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:604 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE84⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2444 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE85⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2576 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE86⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2340 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE87⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2016 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE88⤵
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1336 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE89⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:688 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE90⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1396 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE91⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2392 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE92⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3064 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE93⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1588 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE94⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1584 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE95⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2748 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE96⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2808 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE97⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2628 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE98⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1256 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE99⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1612 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE100⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2076 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE101⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2272 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE102⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2156 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE103⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1928 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE104⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2328 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE105⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2128 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE106⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2944 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE107⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2436 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE108⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:2240 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE109⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:748 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE110⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2064 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE111⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1736 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE112⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:956 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE113⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:896 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE114⤵
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2336 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE115⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2384 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE116⤵
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1932 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE117⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1580 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE118⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:920 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\system32\igfxsvr64.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE119⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2624 -
C:\Windows\SysWOW64\igfxsvr64.exe"C:\Windows\SysWOW64\igfxsvr64.exe " C:\Windows\SysWOW64\IGFXSV~1.EXE120⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:2592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD502bcd02ac649b47c88df945125551f16
SHA1431a617ff4ff5a5ba599262eec35073fca7f79bd
SHA256f53ec0d23818613b780d630e985a96cc27f8c15206bca27480fce13f24b134ea
SHA512046daf4b9732bbf237b541c4fdc88ed0461e20466712cd5ae5359180c78c497c1c7e980cf2f767d92cc98da8db39a0bed9f049ed216f8b6c86344114708faf40