Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21/01/2025, 08:56
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe
-
Size
249KB
-
MD5
036f727a7001a36950c174e97c6a56d1
-
SHA1
f6f711513dd41e66b3524a0483a962f189b78c89
-
SHA256
d3abee5ea5c536b8c1fa470fd4ef72346dc911391fd71911d86d9fcfbf272bc2
-
SHA512
eebdcac41f1ee28153cfa87390b1e8a4e123551b1efb2c1f8eb1ec09336c6df8c2d2eef140d15a119a0b305d67c7a2a2e094b4e3e1587ba1beb324d3821ed8bd
-
SSDEEP
6144:3WxFBPzhADSnh5j6GKcdgLPsKUfyDy3HGgqoE3Pc+JsHw:36PlA0h5NXKPsKwsy3HGX3Pc+qQ
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Checks computer location settings 2 TTPs 51 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation igfxdvr32.exe -
Deletes itself 1 IoCs
pid Process 1976 igfxdvr32.exe -
Executes dropped EXE 51 IoCs
pid Process 1976 igfxdvr32.exe 1540 igfxdvr32.exe 2148 igfxdvr32.exe 3044 igfxdvr32.exe 2196 igfxdvr32.exe 3036 igfxdvr32.exe 3332 igfxdvr32.exe 4228 igfxdvr32.exe 2336 igfxdvr32.exe 3528 igfxdvr32.exe 956 igfxdvr32.exe 4808 igfxdvr32.exe 2536 igfxdvr32.exe 2524 igfxdvr32.exe 4688 igfxdvr32.exe 1552 igfxdvr32.exe 1804 igfxdvr32.exe 2412 igfxdvr32.exe 2084 igfxdvr32.exe 4072 igfxdvr32.exe 4532 igfxdvr32.exe 1160 igfxdvr32.exe 632 igfxdvr32.exe 2732 igfxdvr32.exe 4492 igfxdvr32.exe 5052 igfxdvr32.exe 992 igfxdvr32.exe 4228 igfxdvr32.exe 2336 igfxdvr32.exe 3340 igfxdvr32.exe 2404 igfxdvr32.exe 3648 igfxdvr32.exe 4132 igfxdvr32.exe 3800 igfxdvr32.exe 320 igfxdvr32.exe 3108 igfxdvr32.exe 1572 igfxdvr32.exe 532 igfxdvr32.exe 2512 igfxdvr32.exe 2812 igfxdvr32.exe 3032 igfxdvr32.exe 2956 igfxdvr32.exe 1452 igfxdvr32.exe 2196 igfxdvr32.exe 2352 igfxdvr32.exe 1568 igfxdvr32.exe 3904 igfxdvr32.exe 3896 igfxdvr32.exe 5084 igfxdvr32.exe 4548 igfxdvr32.exe 2888 igfxdvr32.exe -
Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxdvr32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\ igfxdvr32.exe File created C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe File opened for modification C:\Windows\SysWOW64\igfxdvr32.exe igfxdvr32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 51 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxdvr32.exe -
Modifies registry class 51 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxdvr32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2940 JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe 2940 JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe 1976 igfxdvr32.exe 1976 igfxdvr32.exe 1540 igfxdvr32.exe 1540 igfxdvr32.exe 2148 igfxdvr32.exe 2148 igfxdvr32.exe 3044 igfxdvr32.exe 3044 igfxdvr32.exe 2196 igfxdvr32.exe 2196 igfxdvr32.exe 3036 igfxdvr32.exe 3036 igfxdvr32.exe 3332 igfxdvr32.exe 3332 igfxdvr32.exe 4228 igfxdvr32.exe 4228 igfxdvr32.exe 2336 igfxdvr32.exe 2336 igfxdvr32.exe 3528 igfxdvr32.exe 3528 igfxdvr32.exe 956 igfxdvr32.exe 956 igfxdvr32.exe 4808 igfxdvr32.exe 4808 igfxdvr32.exe 2536 igfxdvr32.exe 2536 igfxdvr32.exe 2524 igfxdvr32.exe 2524 igfxdvr32.exe 4688 igfxdvr32.exe 4688 igfxdvr32.exe 1552 igfxdvr32.exe 1552 igfxdvr32.exe 1804 igfxdvr32.exe 1804 igfxdvr32.exe 2412 igfxdvr32.exe 2412 igfxdvr32.exe 2084 igfxdvr32.exe 2084 igfxdvr32.exe 4072 igfxdvr32.exe 4072 igfxdvr32.exe 4532 igfxdvr32.exe 4532 igfxdvr32.exe 1160 igfxdvr32.exe 1160 igfxdvr32.exe 632 igfxdvr32.exe 632 igfxdvr32.exe 2732 igfxdvr32.exe 2732 igfxdvr32.exe 4492 igfxdvr32.exe 4492 igfxdvr32.exe 5052 igfxdvr32.exe 5052 igfxdvr32.exe 992 igfxdvr32.exe 992 igfxdvr32.exe 4228 igfxdvr32.exe 4228 igfxdvr32.exe 2336 igfxdvr32.exe 2336 igfxdvr32.exe 3340 igfxdvr32.exe 3340 igfxdvr32.exe 2404 igfxdvr32.exe 2404 igfxdvr32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2940 wrote to memory of 1976 2940 JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe 83 PID 2940 wrote to memory of 1976 2940 JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe 83 PID 2940 wrote to memory of 1976 2940 JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe 83 PID 1976 wrote to memory of 1540 1976 igfxdvr32.exe 85 PID 1976 wrote to memory of 1540 1976 igfxdvr32.exe 85 PID 1976 wrote to memory of 1540 1976 igfxdvr32.exe 85 PID 1540 wrote to memory of 2148 1540 igfxdvr32.exe 88 PID 1540 wrote to memory of 2148 1540 igfxdvr32.exe 88 PID 1540 wrote to memory of 2148 1540 igfxdvr32.exe 88 PID 2148 wrote to memory of 3044 2148 igfxdvr32.exe 93 PID 2148 wrote to memory of 3044 2148 igfxdvr32.exe 93 PID 2148 wrote to memory of 3044 2148 igfxdvr32.exe 93 PID 3044 wrote to memory of 2196 3044 igfxdvr32.exe 96 PID 3044 wrote to memory of 2196 3044 igfxdvr32.exe 96 PID 3044 wrote to memory of 2196 3044 igfxdvr32.exe 96 PID 2196 wrote to memory of 3036 2196 igfxdvr32.exe 101 PID 2196 wrote to memory of 3036 2196 igfxdvr32.exe 101 PID 2196 wrote to memory of 3036 2196 igfxdvr32.exe 101 PID 3036 wrote to memory of 3332 3036 igfxdvr32.exe 102 PID 3036 wrote to memory of 3332 3036 igfxdvr32.exe 102 PID 3036 wrote to memory of 3332 3036 igfxdvr32.exe 102 PID 3332 wrote to memory of 4228 3332 igfxdvr32.exe 103 PID 3332 wrote to memory of 4228 3332 igfxdvr32.exe 103 PID 3332 wrote to memory of 4228 3332 igfxdvr32.exe 103 PID 4228 wrote to memory of 2336 4228 igfxdvr32.exe 104 PID 4228 wrote to memory of 2336 4228 igfxdvr32.exe 104 PID 4228 wrote to memory of 2336 4228 igfxdvr32.exe 104 PID 2336 wrote to memory of 3528 2336 igfxdvr32.exe 105 PID 2336 wrote to memory of 3528 2336 igfxdvr32.exe 105 PID 2336 wrote to memory of 3528 2336 igfxdvr32.exe 105 PID 3528 wrote to memory of 956 3528 igfxdvr32.exe 108 PID 3528 wrote to memory of 956 3528 igfxdvr32.exe 108 PID 3528 wrote to memory of 956 3528 igfxdvr32.exe 108 PID 956 wrote to memory of 4808 956 igfxdvr32.exe 110 PID 956 wrote to memory of 4808 956 igfxdvr32.exe 110 PID 956 wrote to memory of 4808 956 igfxdvr32.exe 110 PID 4808 wrote to memory of 2536 4808 igfxdvr32.exe 111 PID 4808 wrote to memory of 2536 4808 igfxdvr32.exe 111 PID 4808 wrote to memory of 2536 4808 igfxdvr32.exe 111 PID 2536 wrote to memory of 2524 2536 igfxdvr32.exe 112 PID 2536 wrote to memory of 2524 2536 igfxdvr32.exe 112 PID 2536 wrote to memory of 2524 2536 igfxdvr32.exe 112 PID 2524 wrote to memory of 4688 2524 igfxdvr32.exe 113 PID 2524 wrote to memory of 4688 2524 igfxdvr32.exe 113 PID 2524 wrote to memory of 4688 2524 igfxdvr32.exe 113 PID 4688 wrote to memory of 1552 4688 igfxdvr32.exe 114 PID 4688 wrote to memory of 1552 4688 igfxdvr32.exe 114 PID 4688 wrote to memory of 1552 4688 igfxdvr32.exe 114 PID 1552 wrote to memory of 1804 1552 igfxdvr32.exe 115 PID 1552 wrote to memory of 1804 1552 igfxdvr32.exe 115 PID 1552 wrote to memory of 1804 1552 igfxdvr32.exe 115 PID 1804 wrote to memory of 2412 1804 igfxdvr32.exe 116 PID 1804 wrote to memory of 2412 1804 igfxdvr32.exe 116 PID 1804 wrote to memory of 2412 1804 igfxdvr32.exe 116 PID 2412 wrote to memory of 2084 2412 igfxdvr32.exe 117 PID 2412 wrote to memory of 2084 2412 igfxdvr32.exe 117 PID 2412 wrote to memory of 2084 2412 igfxdvr32.exe 117 PID 2084 wrote to memory of 4072 2084 igfxdvr32.exe 118 PID 2084 wrote to memory of 4072 2084 igfxdvr32.exe 118 PID 2084 wrote to memory of 4072 2084 igfxdvr32.exe 118 PID 4072 wrote to memory of 4532 4072 igfxdvr32.exe 119 PID 4072 wrote to memory of 4532 4072 igfxdvr32.exe 119 PID 4072 wrote to memory of 4532 4072 igfxdvr32.exe 119 PID 4532 wrote to memory of 1160 4532 igfxdvr32.exe 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_036f727a7001a36950c174e97c6a56d1.exe"1⤵
- Checks computer location settings
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE3⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE5⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE7⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE9⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE10⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE11⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE13⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE14⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE15⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE17⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE19⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE21⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE22⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE23⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1160 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:632 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE25⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2732 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4492 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE27⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5052 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:992 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE29⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4228 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE30⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2336 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE31⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3340 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE32⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2404 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE33⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3648 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE34⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4132 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE35⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3800 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE36⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:320 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE37⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3108 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE38⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1572 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE39⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:532 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE40⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2512 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE41⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2812 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE42⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3032 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE43⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2956 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE44⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1452 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE45⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2196 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE46⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2352 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE47⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1568 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE48⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3904 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE49⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3896 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE50⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5084 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE51⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4548 -
C:\Windows\SysWOW64\igfxdvr32.exe"C:\Windows\system32\igfxdvr32.exe" C:\Windows\SysWOW64\IGFXDV~1.EXE52⤵
- Executes dropped EXE
PID:2888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
249KB
MD5036f727a7001a36950c174e97c6a56d1
SHA1f6f711513dd41e66b3524a0483a962f189b78c89
SHA256d3abee5ea5c536b8c1fa470fd4ef72346dc911391fd71911d86d9fcfbf272bc2
SHA512eebdcac41f1ee28153cfa87390b1e8a4e123551b1efb2c1f8eb1ec09336c6df8c2d2eef140d15a119a0b305d67c7a2a2e094b4e3e1587ba1beb324d3821ed8bd