Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
21/01/2025, 08:56
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe
-
Size
249KB
-
MD5
036f727a7001a36950c174e97c6a56d1
-
SHA1
f6f711513dd41e66b3524a0483a962f189b78c89
-
SHA256
d3abee5ea5c536b8c1fa470fd4ef72346dc911391fd71911d86d9fcfbf272bc2
-
SHA512
eebdcac41f1ee28153cfa87390b1e8a4e123551b1efb2c1f8eb1ec09336c6df8c2d2eef140d15a119a0b305d67c7a2a2e094b4e3e1587ba1beb324d3821ed8bd
-
SSDEEP
6144:3WxFBPzhADSnh5j6GKcdgLPsKUfyDy3HGgqoE3Pc+JsHw:36PlA0h5NXKPsKwsy3HGX3Pc+qQ
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Deletes itself 1 IoCs
pid Process 2836 igfxdvr32.exe -
Executes dropped EXE 48 IoCs
pid Process 2836 igfxdvr32.exe 2700 igfxdvr32.exe 2624 igfxdvr32.exe 3040 igfxdvr32.exe 1260 igfxdvr32.exe 2448 igfxdvr32.exe 2224 igfxdvr32.exe 472 igfxdvr32.exe 2588 igfxdvr32.exe 2136 igfxdvr32.exe 2352 igfxdvr32.exe 1960 igfxdvr32.exe 1460 igfxdvr32.exe 2016 igfxdvr32.exe 884 igfxdvr32.exe 580 igfxdvr32.exe 1828 igfxdvr32.exe 1672 igfxdvr32.exe 2852 igfxdvr32.exe 2868 igfxdvr32.exe 2112 igfxdvr32.exe 2012 igfxdvr32.exe 2480 igfxdvr32.exe 700 igfxdvr32.exe 1120 igfxdvr32.exe 1976 igfxdvr32.exe 1748 igfxdvr32.exe 1264 igfxdvr32.exe 2076 igfxdvr32.exe 2552 igfxdvr32.exe 2124 igfxdvr32.exe 784 igfxdvr32.exe 1724 igfxdvr32.exe 2024 igfxdvr32.exe 1248 igfxdvr32.exe 1908 igfxdvr32.exe 1072 igfxdvr32.exe 1936 igfxdvr32.exe 1584 igfxdvr32.exe 2776 igfxdvr32.exe 2956 igfxdvr32.exe 2144 igfxdvr32.exe 2868 igfxdvr32.exe 1972 igfxdvr32.exe 2660 igfxdvr32.exe 2764 igfxdvr32.exe 3044 igfxdvr32.exe 1548 igfxdvr32.exe -
Loads dropped DLL 64 IoCs
pid Process 2868 JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe 2868 JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe 2836 igfxdvr32.exe 2836 igfxdvr32.exe 2700 igfxdvr32.exe 2700 igfxdvr32.exe 2624 igfxdvr32.exe 2624 igfxdvr32.exe 3040 igfxdvr32.exe 3040 igfxdvr32.exe 1260 igfxdvr32.exe 1260 igfxdvr32.exe 2448 igfxdvr32.exe 2448 igfxdvr32.exe 2224 igfxdvr32.exe 2224 igfxdvr32.exe 472 igfxdvr32.exe 472 igfxdvr32.exe 2588 igfxdvr32.exe 2588 igfxdvr32.exe 2136 igfxdvr32.exe 2136 igfxdvr32.exe 2352 igfxdvr32.exe 2352 igfxdvr32.exe 1960 igfxdvr32.exe 1960 igfxdvr32.exe 1460 igfxdvr32.exe 1460 igfxdvr32.exe 2016 igfxdvr32.exe 2016 igfxdvr32.exe 884 igfxdvr32.exe 884 igfxdvr32.exe 580 igfxdvr32.exe 580 igfxdvr32.exe 1828 igfxdvr32.exe 1828 igfxdvr32.exe 1672 igfxdvr32.exe 1672 igfxdvr32.exe 2852 igfxdvr32.exe 2852 igfxdvr32.exe 2868 igfxdvr32.exe 2868 igfxdvr32.exe 2112 igfxdvr32.exe 2112 igfxdvr32.exe 2012 igfxdvr32.exe 2012 igfxdvr32.exe 2480 igfxdvr32.exe 2480 igfxdvr32.exe 700 igfxdvr32.exe 700 igfxdvr32.exe 1120 igfxdvr32.exe 1120 igfxdvr32.exe 1976 igfxdvr32.exe 1976 igfxdvr32.exe 1748 igfxdvr32.exe 1748 igfxdvr32.exe 1264 igfxdvr32.exe 1264 igfxdvr32.exe 2076 igfxdvr32.exe 2076 igfxdvr32.exe 2552 igfxdvr32.exe 2552 igfxdvr32.exe 2124 igfxdvr32.exe 2124 igfxdvr32.exe -
Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe File created C:\Windows\SysWOW64\igfxdvr32.exe JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 49 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe -
Suspicious behavior: EnumeratesProcesses 49 IoCs
pid Process 2868 JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe 2836 igfxdvr32.exe 2700 igfxdvr32.exe 2624 igfxdvr32.exe 3040 igfxdvr32.exe 1260 igfxdvr32.exe 2448 igfxdvr32.exe 2224 igfxdvr32.exe 472 igfxdvr32.exe 2588 igfxdvr32.exe 2136 igfxdvr32.exe 2352 igfxdvr32.exe 1960 igfxdvr32.exe 1460 igfxdvr32.exe 2016 igfxdvr32.exe 884 igfxdvr32.exe 580 igfxdvr32.exe 1828 igfxdvr32.exe 1672 igfxdvr32.exe 2852 igfxdvr32.exe 2868 igfxdvr32.exe 2112 igfxdvr32.exe 2012 igfxdvr32.exe 2480 igfxdvr32.exe 700 igfxdvr32.exe 1120 igfxdvr32.exe 1976 igfxdvr32.exe 1748 igfxdvr32.exe 1264 igfxdvr32.exe 2076 igfxdvr32.exe 2552 igfxdvr32.exe 2124 igfxdvr32.exe 784 igfxdvr32.exe 1724 igfxdvr32.exe 2024 igfxdvr32.exe 1248 igfxdvr32.exe 1908 igfxdvr32.exe 1072 igfxdvr32.exe 1936 igfxdvr32.exe 1584 igfxdvr32.exe 2776 igfxdvr32.exe 2956 igfxdvr32.exe 2144 igfxdvr32.exe 2868 igfxdvr32.exe 1972 igfxdvr32.exe 2660 igfxdvr32.exe 2764 igfxdvr32.exe 3044 igfxdvr32.exe 1548 igfxdvr32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2868 wrote to memory of 2836 2868 JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe 30 PID 2868 wrote to memory of 2836 2868 JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe 30 PID 2868 wrote to memory of 2836 2868 JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe 30 PID 2868 wrote to memory of 2836 2868 JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe 30 PID 2836 wrote to memory of 2700 2836 igfxdvr32.exe 31 PID 2836 wrote to memory of 2700 2836 igfxdvr32.exe 31 PID 2836 wrote to memory of 2700 2836 igfxdvr32.exe 31 PID 2836 wrote to memory of 2700 2836 igfxdvr32.exe 31 PID 2700 wrote to memory of 2624 2700 igfxdvr32.exe 32 PID 2700 wrote to memory of 2624 2700 igfxdvr32.exe 32 PID 2700 wrote to memory of 2624 2700 igfxdvr32.exe 32 PID 2700 wrote to memory of 2624 2700 igfxdvr32.exe 32 PID 2624 wrote to memory of 3040 2624 igfxdvr32.exe 33 PID 2624 wrote to memory of 3040 2624 igfxdvr32.exe 33 PID 2624 wrote to memory of 3040 2624 igfxdvr32.exe 33 PID 2624 wrote to memory of 3040 2624 igfxdvr32.exe 33 PID 3040 wrote to memory of 1260 3040 igfxdvr32.exe 34 PID 3040 wrote to memory of 1260 3040 igfxdvr32.exe 34 PID 3040 wrote to memory of 1260 3040 igfxdvr32.exe 34 PID 3040 wrote to memory of 1260 3040 igfxdvr32.exe 34 PID 1260 wrote to memory of 2448 1260 igfxdvr32.exe 35 PID 1260 wrote to memory of 2448 1260 igfxdvr32.exe 35 PID 1260 wrote to memory of 2448 1260 igfxdvr32.exe 35 PID 1260 wrote to memory of 2448 1260 igfxdvr32.exe 35 PID 2448 wrote to memory of 2224 2448 igfxdvr32.exe 36 PID 2448 wrote to memory of 2224 2448 igfxdvr32.exe 36 PID 2448 wrote to memory of 2224 2448 igfxdvr32.exe 36 PID 2448 wrote to memory of 2224 2448 igfxdvr32.exe 36 PID 2224 wrote to memory of 472 2224 igfxdvr32.exe 37 PID 2224 wrote to memory of 472 2224 igfxdvr32.exe 37 PID 2224 wrote to memory of 472 2224 igfxdvr32.exe 37 PID 2224 wrote to memory of 472 2224 igfxdvr32.exe 37 PID 472 wrote to memory of 2588 472 igfxdvr32.exe 38 PID 472 wrote to memory of 2588 472 igfxdvr32.exe 38 PID 472 wrote to memory of 2588 472 igfxdvr32.exe 38 PID 472 wrote to memory of 2588 472 igfxdvr32.exe 38 PID 2588 wrote to memory of 2136 2588 igfxdvr32.exe 39 PID 2588 wrote to memory of 2136 2588 igfxdvr32.exe 39 PID 2588 wrote to memory of 2136 2588 igfxdvr32.exe 39 PID 2588 wrote to memory of 2136 2588 igfxdvr32.exe 39 PID 2136 wrote to memory of 2352 2136 igfxdvr32.exe 40 PID 2136 wrote to memory of 2352 2136 igfxdvr32.exe 40 PID 2136 wrote to memory of 2352 2136 igfxdvr32.exe 40 PID 2136 wrote to memory of 2352 2136 igfxdvr32.exe 40 PID 2352 wrote to memory of 1960 2352 igfxdvr32.exe 41 PID 2352 wrote to memory of 1960 2352 igfxdvr32.exe 41 PID 2352 wrote to memory of 1960 2352 igfxdvr32.exe 41 PID 2352 wrote to memory of 1960 2352 igfxdvr32.exe 41 PID 1960 wrote to memory of 1460 1960 igfxdvr32.exe 42 PID 1960 wrote to memory of 1460 1960 igfxdvr32.exe 42 PID 1960 wrote to memory of 1460 1960 igfxdvr32.exe 42 PID 1960 wrote to memory of 1460 1960 igfxdvr32.exe 42 PID 1460 wrote to memory of 2016 1460 igfxdvr32.exe 43 PID 1460 wrote to memory of 2016 1460 igfxdvr32.exe 43 PID 1460 wrote to memory of 2016 1460 igfxdvr32.exe 43 PID 1460 wrote to memory of 2016 1460 igfxdvr32.exe 43 PID 2016 wrote to memory of 884 2016 igfxdvr32.exe 44 PID 2016 wrote to memory of 884 2016 igfxdvr32.exe 44 PID 2016 wrote to memory of 884 2016 igfxdvr32.exe 44 PID 2016 wrote to memory of 884 2016 igfxdvr32.exe 44 PID 884 wrote to memory of 580 884 igfxdvr32.exe 45 PID 884 wrote to memory of 580 884 igfxdvr32.exe 45 PID 884 wrote to memory of 580 884 igfxdvr32.exe 45 PID 884 wrote to memory of 580 884 igfxdvr32.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE4⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE5⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE11⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE13⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE14⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE15⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE17⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:580 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1828 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1672 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE20⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2852 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE21⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2868 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2112 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE23⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2012 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE24⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2480 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE25⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:700 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE26⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1120 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE27⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1976 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1748 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE29⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1264 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE30⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2076 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE31⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2552 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE32⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2124 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE33⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:784 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE34⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1724 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2024 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE36⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1248 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE37⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1908 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE38⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1072 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE39⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1936 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE40⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1584 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE41⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2776 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE42⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2956 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE43⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2144 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE44⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2868 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE45⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1972 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE46⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2660 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE47⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2764 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE48⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3044 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE49⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1548 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE50⤵PID:3000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
249KB
MD5036f727a7001a36950c174e97c6a56d1
SHA1f6f711513dd41e66b3524a0483a962f189b78c89
SHA256d3abee5ea5c536b8c1fa470fd4ef72346dc911391fd71911d86d9fcfbf272bc2
SHA512eebdcac41f1ee28153cfa87390b1e8a4e123551b1efb2c1f8eb1ec09336c6df8c2d2eef140d15a119a0b305d67c7a2a2e094b4e3e1587ba1beb324d3821ed8bd