Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20250410-en -
resource tags
arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system -
submitted
14/04/2025, 21:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe
Resource
win10v2004-20250410-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe
-
Size
139KB
-
MD5
b8e71a110e2d486a90a887936d53858b
-
SHA1
b88d920a4f81dbc13b1bd13a5d27bbd9cb95d4fe
-
SHA256
0deeea06292d6f54ab0411b538bf7cbf5128db7cc25f7e1072249389ef30f19f
-
SHA512
8479b9a50c3fd21c9fdb84664cd840e1c07bf633986e9f949e79a027705c85ad0c2ae274fd0d744c3461a8ad3520dc9022d98c1a45699820747b08f6542f6b3f
-
SSDEEP
3072:KDS20lw3+UeIybszdQGpCt6+hOJYRC0KlZrmhqY:KOQ3+UhuszdBpA6piyzrm4Y
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Checks computer location settings 2 TTPs 14 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Control Panel\International\Geo\Nation JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe Key value queried \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Control Panel\International\Geo\Nation igfxctk32.exe Key value queried \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Control Panel\International\Geo\Nation igfxctk32.exe Key value queried \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Control Panel\International\Geo\Nation igfxctk32.exe Key value queried \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Control Panel\International\Geo\Nation igfxctk32.exe Key value queried \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Control Panel\International\Geo\Nation igfxctk32.exe Key value queried \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Control Panel\International\Geo\Nation igfxctk32.exe Key value queried \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Control Panel\International\Geo\Nation igfxctk32.exe Key value queried \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Control Panel\International\Geo\Nation igfxctk32.exe Key value queried \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Control Panel\International\Geo\Nation igfxctk32.exe Key value queried \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Control Panel\International\Geo\Nation igfxctk32.exe Key value queried \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Control Panel\International\Geo\Nation igfxctk32.exe Key value queried \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Control Panel\International\Geo\Nation igfxctk32.exe Key value queried \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Control Panel\International\Geo\Nation igfxctk32.exe -
Deletes itself 1 IoCs
pid Process 3556 igfxctk32.exe -
Executes dropped EXE 26 IoCs
pid Process 4964 igfxctk32.exe 3556 igfxctk32.exe 3676 igfxctk32.exe 2388 igfxctk32.exe 2024 igfxctk32.exe 4828 igfxctk32.exe 2020 igfxctk32.exe 4492 igfxctk32.exe 4132 igfxctk32.exe 2132 igfxctk32.exe 5700 igfxctk32.exe 5016 igfxctk32.exe 3756 igfxctk32.exe 4316 igfxctk32.exe 4608 igfxctk32.exe 3448 igfxctk32.exe 3160 igfxctk32.exe 2276 igfxctk32.exe 412 igfxctk32.exe 1288 igfxctk32.exe 2100 igfxctk32.exe 4696 igfxctk32.exe 1328 igfxctk32.exe 5788 igfxctk32.exe 184 igfxctk32.exe 548 igfxctk32.exe -
Maps connected drives based on registry 3 TTPs 28 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxctk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxctk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxctk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxctk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxctk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxctk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxctk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxctk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxctk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxctk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxctk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxctk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxctk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxctk32.exe -
Drops file in System32 directory 42 IoCs
description ioc Process File created C:\Windows\SysWOW64\igfxctk32.exe JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe File created C:\Windows\SysWOW64\igfxctk32.exe igfxctk32.exe File opened for modification C:\Windows\SysWOW64\igfxctk32.exe igfxctk32.exe File opened for modification C:\Windows\SysWOW64\igfxctk32.exe JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe File created C:\Windows\SysWOW64\igfxctk32.exe igfxctk32.exe File opened for modification C:\Windows\SysWOW64\ igfxctk32.exe File opened for modification C:\Windows\SysWOW64\ igfxctk32.exe File opened for modification C:\Windows\SysWOW64\ igfxctk32.exe File opened for modification C:\Windows\SysWOW64\igfxctk32.exe igfxctk32.exe File opened for modification C:\Windows\SysWOW64\ igfxctk32.exe File opened for modification C:\Windows\SysWOW64\ JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe File opened for modification C:\Windows\SysWOW64\igfxctk32.exe igfxctk32.exe File created C:\Windows\SysWOW64\igfxctk32.exe igfxctk32.exe File created C:\Windows\SysWOW64\igfxctk32.exe igfxctk32.exe File opened for modification C:\Windows\SysWOW64\ igfxctk32.exe File opened for modification C:\Windows\SysWOW64\ igfxctk32.exe File opened for modification C:\Windows\SysWOW64\igfxctk32.exe igfxctk32.exe File created C:\Windows\SysWOW64\igfxctk32.exe igfxctk32.exe File created C:\Windows\SysWOW64\igfxctk32.exe igfxctk32.exe File opened for modification C:\Windows\SysWOW64\igfxctk32.exe igfxctk32.exe File created C:\Windows\SysWOW64\igfxctk32.exe igfxctk32.exe File created C:\Windows\SysWOW64\igfxctk32.exe igfxctk32.exe File opened for modification C:\Windows\SysWOW64\ igfxctk32.exe File opened for modification C:\Windows\SysWOW64\igfxctk32.exe igfxctk32.exe File opened for modification C:\Windows\SysWOW64\igfxctk32.exe igfxctk32.exe File opened for modification C:\Windows\SysWOW64\ igfxctk32.exe File opened for modification C:\Windows\SysWOW64\ igfxctk32.exe File opened for modification C:\Windows\SysWOW64\igfxctk32.exe igfxctk32.exe File opened for modification C:\Windows\SysWOW64\igfxctk32.exe igfxctk32.exe File created C:\Windows\SysWOW64\igfxctk32.exe igfxctk32.exe File opened for modification C:\Windows\SysWOW64\ igfxctk32.exe File opened for modification C:\Windows\SysWOW64\igfxctk32.exe igfxctk32.exe File opened for modification C:\Windows\SysWOW64\ igfxctk32.exe File opened for modification C:\Windows\SysWOW64\igfxctk32.exe igfxctk32.exe File created C:\Windows\SysWOW64\igfxctk32.exe igfxctk32.exe File opened for modification C:\Windows\SysWOW64\igfxctk32.exe igfxctk32.exe File opened for modification C:\Windows\SysWOW64\ igfxctk32.exe File created C:\Windows\SysWOW64\igfxctk32.exe igfxctk32.exe File opened for modification C:\Windows\SysWOW64\igfxctk32.exe igfxctk32.exe File created C:\Windows\SysWOW64\igfxctk32.exe igfxctk32.exe File opened for modification C:\Windows\SysWOW64\ igfxctk32.exe File created C:\Windows\SysWOW64\igfxctk32.exe igfxctk32.exe -
Suspicious use of SetThreadContext 14 IoCs
description pid Process procid_target PID 5616 set thread context of 3660 5616 JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe 86 PID 4964 set thread context of 3556 4964 igfxctk32.exe 93 PID 3676 set thread context of 2388 3676 igfxctk32.exe 95 PID 2024 set thread context of 4828 2024 igfxctk32.exe 100 PID 2020 set thread context of 4492 2020 igfxctk32.exe 103 PID 4132 set thread context of 2132 4132 igfxctk32.exe 105 PID 5700 set thread context of 5016 5700 igfxctk32.exe 107 PID 3756 set thread context of 4316 3756 igfxctk32.exe 109 PID 4608 set thread context of 3448 4608 igfxctk32.exe 111 PID 3160 set thread context of 2276 3160 igfxctk32.exe 113 PID 412 set thread context of 1288 412 igfxctk32.exe 115 PID 2100 set thread context of 4696 2100 igfxctk32.exe 117 PID 1328 set thread context of 5788 1328 igfxctk32.exe 119 PID 184 set thread context of 548 184 igfxctk32.exe 121 -
resource yara_rule behavioral1/memory/3660-0-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/3660-2-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/3660-3-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/3660-4-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/3660-31-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/3660-41-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/3556-46-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/3556-47-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/3556-45-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/3556-48-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/3556-53-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2388-57-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2388-60-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2388-67-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/4828-69-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/4828-75-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/4492-78-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/4492-84-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2132-87-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2132-95-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/5016-98-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/5016-104-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/4316-107-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/4316-113-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/3448-115-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/3448-122-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2276-125-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/2276-127-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/1288-134-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/1288-139-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/4696-145-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/4696-149-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/5788-155-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/5788-163-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral1/memory/548-165-0x0000000000400000-0x000000000045A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 28 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxctk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxctk32.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxctk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxctk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxctk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxctk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxctk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxctk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxctk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxctk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxctk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxctk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxctk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxctk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxctk32.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 3660 JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe 3660 JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe 3660 JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe 3660 JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe 3556 igfxctk32.exe 3556 igfxctk32.exe 3556 igfxctk32.exe 3556 igfxctk32.exe 2388 igfxctk32.exe 2388 igfxctk32.exe 2388 igfxctk32.exe 2388 igfxctk32.exe 4828 igfxctk32.exe 4828 igfxctk32.exe 4828 igfxctk32.exe 4828 igfxctk32.exe 4492 igfxctk32.exe 4492 igfxctk32.exe 4492 igfxctk32.exe 4492 igfxctk32.exe 2132 igfxctk32.exe 2132 igfxctk32.exe 2132 igfxctk32.exe 2132 igfxctk32.exe 5016 igfxctk32.exe 5016 igfxctk32.exe 5016 igfxctk32.exe 5016 igfxctk32.exe 4316 igfxctk32.exe 4316 igfxctk32.exe 4316 igfxctk32.exe 4316 igfxctk32.exe 3448 igfxctk32.exe 3448 igfxctk32.exe 3448 igfxctk32.exe 3448 igfxctk32.exe 2276 igfxctk32.exe 2276 igfxctk32.exe 2276 igfxctk32.exe 2276 igfxctk32.exe 1288 igfxctk32.exe 1288 igfxctk32.exe 1288 igfxctk32.exe 1288 igfxctk32.exe 4696 igfxctk32.exe 4696 igfxctk32.exe 4696 igfxctk32.exe 4696 igfxctk32.exe 5788 igfxctk32.exe 5788 igfxctk32.exe 5788 igfxctk32.exe 5788 igfxctk32.exe 548 igfxctk32.exe 548 igfxctk32.exe 548 igfxctk32.exe 548 igfxctk32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5616 wrote to memory of 3660 5616 JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe 86 PID 5616 wrote to memory of 3660 5616 JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe 86 PID 5616 wrote to memory of 3660 5616 JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe 86 PID 5616 wrote to memory of 3660 5616 JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe 86 PID 5616 wrote to memory of 3660 5616 JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe 86 PID 5616 wrote to memory of 3660 5616 JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe 86 PID 5616 wrote to memory of 3660 5616 JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe 86 PID 3660 wrote to memory of 4964 3660 JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe 92 PID 3660 wrote to memory of 4964 3660 JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe 92 PID 3660 wrote to memory of 4964 3660 JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe 92 PID 4964 wrote to memory of 3556 4964 igfxctk32.exe 93 PID 4964 wrote to memory of 3556 4964 igfxctk32.exe 93 PID 4964 wrote to memory of 3556 4964 igfxctk32.exe 93 PID 4964 wrote to memory of 3556 4964 igfxctk32.exe 93 PID 4964 wrote to memory of 3556 4964 igfxctk32.exe 93 PID 4964 wrote to memory of 3556 4964 igfxctk32.exe 93 PID 4964 wrote to memory of 3556 4964 igfxctk32.exe 93 PID 3556 wrote to memory of 3676 3556 igfxctk32.exe 94 PID 3556 wrote to memory of 3676 3556 igfxctk32.exe 94 PID 3556 wrote to memory of 3676 3556 igfxctk32.exe 94 PID 3676 wrote to memory of 2388 3676 igfxctk32.exe 95 PID 3676 wrote to memory of 2388 3676 igfxctk32.exe 95 PID 3676 wrote to memory of 2388 3676 igfxctk32.exe 95 PID 3676 wrote to memory of 2388 3676 igfxctk32.exe 95 PID 3676 wrote to memory of 2388 3676 igfxctk32.exe 95 PID 3676 wrote to memory of 2388 3676 igfxctk32.exe 95 PID 3676 wrote to memory of 2388 3676 igfxctk32.exe 95 PID 2388 wrote to memory of 2024 2388 igfxctk32.exe 99 PID 2388 wrote to memory of 2024 2388 igfxctk32.exe 99 PID 2388 wrote to memory of 2024 2388 igfxctk32.exe 99 PID 2024 wrote to memory of 4828 2024 igfxctk32.exe 100 PID 2024 wrote to memory of 4828 2024 igfxctk32.exe 100 PID 2024 wrote to memory of 4828 2024 igfxctk32.exe 100 PID 2024 wrote to memory of 4828 2024 igfxctk32.exe 100 PID 2024 wrote to memory of 4828 2024 igfxctk32.exe 100 PID 2024 wrote to memory of 4828 2024 igfxctk32.exe 100 PID 2024 wrote to memory of 4828 2024 igfxctk32.exe 100 PID 4828 wrote to memory of 2020 4828 igfxctk32.exe 101 PID 4828 wrote to memory of 2020 4828 igfxctk32.exe 101 PID 4828 wrote to memory of 2020 4828 igfxctk32.exe 101 PID 2020 wrote to memory of 4492 2020 igfxctk32.exe 103 PID 2020 wrote to memory of 4492 2020 igfxctk32.exe 103 PID 2020 wrote to memory of 4492 2020 igfxctk32.exe 103 PID 2020 wrote to memory of 4492 2020 igfxctk32.exe 103 PID 2020 wrote to memory of 4492 2020 igfxctk32.exe 103 PID 2020 wrote to memory of 4492 2020 igfxctk32.exe 103 PID 2020 wrote to memory of 4492 2020 igfxctk32.exe 103 PID 4492 wrote to memory of 4132 4492 igfxctk32.exe 104 PID 4492 wrote to memory of 4132 4492 igfxctk32.exe 104 PID 4492 wrote to memory of 4132 4492 igfxctk32.exe 104 PID 4132 wrote to memory of 2132 4132 igfxctk32.exe 105 PID 4132 wrote to memory of 2132 4132 igfxctk32.exe 105 PID 4132 wrote to memory of 2132 4132 igfxctk32.exe 105 PID 4132 wrote to memory of 2132 4132 igfxctk32.exe 105 PID 4132 wrote to memory of 2132 4132 igfxctk32.exe 105 PID 4132 wrote to memory of 2132 4132 igfxctk32.exe 105 PID 4132 wrote to memory of 2132 4132 igfxctk32.exe 105 PID 2132 wrote to memory of 5700 2132 igfxctk32.exe 106 PID 2132 wrote to memory of 5700 2132 igfxctk32.exe 106 PID 2132 wrote to memory of 5700 2132 igfxctk32.exe 106 PID 5700 wrote to memory of 5016 5700 igfxctk32.exe 107 PID 5700 wrote to memory of 5016 5700 igfxctk32.exe 107 PID 5700 wrote to memory of 5016 5700 igfxctk32.exe 107 PID 5700 wrote to memory of 5016 5700 igfxctk32.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b8e71a110e2d486a90a887936d53858b.exe"2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\SysWOW64\igfxctk32.exe"C:\Windows\system32\igfxctk32.exe" C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\igfxctk32.exe"C:\Windows\system32\igfxctk32.exe" C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SysWOW64\igfxctk32.exe"C:\Windows\system32\igfxctk32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\SysWOW64\igfxctk32.exe"C:\Windows\system32\igfxctk32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\igfxctk32.exe"C:\Windows\system32\igfxctk32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\igfxctk32.exe"C:\Windows\system32\igfxctk32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\igfxctk32.exe"C:\Windows\system32\igfxctk32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\igfxctk32.exe"C:\Windows\system32\igfxctk32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\igfxctk32.exe"C:\Windows\system32\igfxctk32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\igfxctk32.exe"C:\Windows\system32\igfxctk32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\igfxctk32.exe"C:\Windows\system32\igfxctk32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Windows\SysWOW64\igfxctk32.exe"C:\Windows\system32\igfxctk32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5016 -
C:\Windows\SysWOW64\igfxctk32.exe"C:\Windows\system32\igfxctk32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3756 -
C:\Windows\SysWOW64\igfxctk32.exe"C:\Windows\system32\igfxctk32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4316 -
C:\Windows\SysWOW64\igfxctk32.exe"C:\Windows\system32\igfxctk32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4608 -
C:\Windows\SysWOW64\igfxctk32.exe"C:\Windows\system32\igfxctk32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3448 -
C:\Windows\SysWOW64\igfxctk32.exe"C:\Windows\system32\igfxctk32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3160 -
C:\Windows\SysWOW64\igfxctk32.exe"C:\Windows\system32\igfxctk32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2276 -
C:\Windows\SysWOW64\igfxctk32.exe"C:\Windows\system32\igfxctk32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:412 -
C:\Windows\SysWOW64\igfxctk32.exe"C:\Windows\system32\igfxctk32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1288 -
C:\Windows\SysWOW64\igfxctk32.exe"C:\Windows\system32\igfxctk32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2100 -
C:\Windows\SysWOW64\igfxctk32.exe"C:\Windows\system32\igfxctk32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4696 -
C:\Windows\SysWOW64\igfxctk32.exe"C:\Windows\system32\igfxctk32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1328 -
C:\Windows\SysWOW64\igfxctk32.exe"C:\Windows\system32\igfxctk32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5788 -
C:\Windows\SysWOW64\igfxctk32.exe"C:\Windows\system32\igfxctk32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:184 -
C:\Windows\SysWOW64\igfxctk32.exe"C:\Windows\system32\igfxctk32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:548 -
C:\Windows\SysWOW64\igfxctk32.exe"C:\Windows\system32\igfxctk32.exe" C:\Windows\SysWOW64\IGFXCT~1.EXE29⤵PID:6044
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139KB
MD5b8e71a110e2d486a90a887936d53858b
SHA1b88d920a4f81dbc13b1bd13a5d27bbd9cb95d4fe
SHA2560deeea06292d6f54ab0411b538bf7cbf5128db7cc25f7e1072249389ef30f19f
SHA5128479b9a50c3fd21c9fdb84664cd840e1c07bf633986e9f949e79a027705c85ad0c2ae274fd0d744c3461a8ad3520dc9022d98c1a45699820747b08f6542f6b3f