Analysis
-
max time kernel
149s -
max time network
105s -
platform
windows11-21h2_x64 -
resource
win11-20250410-en -
resource tags
arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system -
submitted
18/04/2025, 00:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe
Resource
win10v2004-20250410-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe
Resource
win11-20250410-en
windows11-21h2-x64
11 signatures
150 seconds
General
-
Target
JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe
-
Size
221KB
-
MD5
bbc7b46f6d0713910da177ae15a0a7e8
-
SHA1
7a1f17df1956019475445b02d2b6cf0219f8ea8b
-
SHA256
63a0481af7fbbb4f1b32728d90e00bd860e7172aa7be4cac9aa8023422534dab
-
SHA512
1563365b484f55309a534e69b3655ce276d3b24f809af7f0be04bdacc7dbb2c748a27dfd988307126d24788e1cd4484345ae2f0268314de96dd0e7e992868e05
-
SSDEEP
6144:/gU6qjunLsOI2bKmLPbBnBmVxEYMUe+lntZGprGegxE:/1uLsOIO/PbBBmETUe+ZtZAYxE
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Deletes itself 1 IoCs
pid Process 4520 igfxpers32.exe -
Executes dropped EXE 45 IoCs
pid Process 4520 igfxpers32.exe 4224 igfxpers32.exe 4840 igfxpers32.exe 4156 igfxpers32.exe 2676 igfxpers32.exe 4636 igfxpers32.exe 872 igfxpers32.exe 732 igfxpers32.exe 2112 igfxpers32.exe 5172 igfxpers32.exe 1808 igfxpers32.exe 2032 igfxpers32.exe 4592 igfxpers32.exe 2820 igfxpers32.exe 2400 igfxpers32.exe 3576 igfxpers32.exe 1008 igfxpers32.exe 3356 igfxpers32.exe 3900 igfxpers32.exe 1780 igfxpers32.exe 4064 igfxpers32.exe 3524 igfxpers32.exe 2968 igfxpers32.exe 1112 igfxpers32.exe 3296 igfxpers32.exe 4752 igfxpers32.exe 4436 igfxpers32.exe 460 igfxpers32.exe 5084 igfxpers32.exe 1164 igfxpers32.exe 5816 igfxpers32.exe 440 igfxpers32.exe 6068 igfxpers32.exe 3480 igfxpers32.exe 5516 igfxpers32.exe 4484 igfxpers32.exe 6092 igfxpers32.exe 5904 igfxpers32.exe 5356 igfxpers32.exe 3848 igfxpers32.exe 1828 igfxpers32.exe 5572 igfxpers32.exe 3188 igfxpers32.exe 4732 igfxpers32.exe 4648 igfxpers32.exe -
Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum igfxpers32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 igfxpers32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File opened for modification C:\Windows\SysWOW64\igfxpers32.exe JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe File opened for modification C:\Windows\SysWOW64\ igfxpers32.exe File created C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File opened for modification C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File created C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File opened for modification C:\Windows\SysWOW64\ JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe File created C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File opened for modification C:\Windows\SysWOW64\ igfxpers32.exe File opened for modification C:\Windows\SysWOW64\ igfxpers32.exe File created C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File opened for modification C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File created C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File opened for modification C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File created C:\Windows\SysWOW64\igfxpers32.exe JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe File opened for modification C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File opened for modification C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File opened for modification C:\Windows\SysWOW64\ igfxpers32.exe File created C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File created C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File opened for modification C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File opened for modification C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File created C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File created C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File opened for modification C:\Windows\SysWOW64\ igfxpers32.exe File opened for modification C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File created C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File opened for modification C:\Windows\SysWOW64\ igfxpers32.exe File opened for modification C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File opened for modification C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File created C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File created C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File opened for modification C:\Windows\SysWOW64\ igfxpers32.exe File created C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File opened for modification C:\Windows\SysWOW64\ igfxpers32.exe File opened for modification C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File opened for modification C:\Windows\SysWOW64\ igfxpers32.exe File opened for modification C:\Windows\SysWOW64\ igfxpers32.exe File opened for modification C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File created C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File opened for modification C:\Windows\SysWOW64\ igfxpers32.exe File created C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File opened for modification C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File opened for modification C:\Windows\SysWOW64\ igfxpers32.exe File opened for modification C:\Windows\SysWOW64\ igfxpers32.exe File opened for modification C:\Windows\SysWOW64\ igfxpers32.exe File opened for modification C:\Windows\SysWOW64\ igfxpers32.exe File opened for modification C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File created C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File opened for modification C:\Windows\SysWOW64\ igfxpers32.exe File created C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File opened for modification C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File opened for modification C:\Windows\SysWOW64\ igfxpers32.exe File opened for modification C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File opened for modification C:\Windows\SysWOW64\ igfxpers32.exe File opened for modification C:\Windows\SysWOW64\ igfxpers32.exe File opened for modification C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File created C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File created C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File opened for modification C:\Windows\SysWOW64\ igfxpers32.exe File opened for modification C:\Windows\SysWOW64\ igfxpers32.exe File created C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe File opened for modification C:\Windows\SysWOW64\ igfxpers32.exe File opened for modification C:\Windows\SysWOW64\igfxpers32.exe igfxpers32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 45 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language igfxpers32.exe -
Modifies registry class 45 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ igfxpers32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 4520 igfxpers32.exe 4520 igfxpers32.exe 4520 igfxpers32.exe 4520 igfxpers32.exe 4520 igfxpers32.exe 4520 igfxpers32.exe 4520 igfxpers32.exe 4520 igfxpers32.exe 4520 igfxpers32.exe 4520 igfxpers32.exe 4520 igfxpers32.exe 4520 igfxpers32.exe 4520 igfxpers32.exe 4520 igfxpers32.exe 4520 igfxpers32.exe 4520 igfxpers32.exe 4520 igfxpers32.exe 4520 igfxpers32.exe 4520 igfxpers32.exe 4520 igfxpers32.exe 4520 igfxpers32.exe 4520 igfxpers32.exe 4520 igfxpers32.exe 4520 igfxpers32.exe 4520 igfxpers32.exe 4520 igfxpers32.exe 4520 igfxpers32.exe 4520 igfxpers32.exe 4520 igfxpers32.exe 4520 igfxpers32.exe 4224 igfxpers32.exe 4224 igfxpers32.exe 4224 igfxpers32.exe 4224 igfxpers32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5932 wrote to memory of 4520 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 78 PID 5932 wrote to memory of 4520 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 78 PID 5932 wrote to memory of 4520 5932 JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe 78 PID 4520 wrote to memory of 4224 4520 igfxpers32.exe 79 PID 4520 wrote to memory of 4224 4520 igfxpers32.exe 79 PID 4520 wrote to memory of 4224 4520 igfxpers32.exe 79 PID 4224 wrote to memory of 4840 4224 igfxpers32.exe 80 PID 4224 wrote to memory of 4840 4224 igfxpers32.exe 80 PID 4224 wrote to memory of 4840 4224 igfxpers32.exe 80 PID 4840 wrote to memory of 4156 4840 igfxpers32.exe 81 PID 4840 wrote to memory of 4156 4840 igfxpers32.exe 81 PID 4840 wrote to memory of 4156 4840 igfxpers32.exe 81 PID 4156 wrote to memory of 2676 4156 igfxpers32.exe 82 PID 4156 wrote to memory of 2676 4156 igfxpers32.exe 82 PID 4156 wrote to memory of 2676 4156 igfxpers32.exe 82 PID 2676 wrote to memory of 4636 2676 igfxpers32.exe 83 PID 2676 wrote to memory of 4636 2676 igfxpers32.exe 83 PID 2676 wrote to memory of 4636 2676 igfxpers32.exe 83 PID 4636 wrote to memory of 872 4636 igfxpers32.exe 84 PID 4636 wrote to memory of 872 4636 igfxpers32.exe 84 PID 4636 wrote to memory of 872 4636 igfxpers32.exe 84 PID 872 wrote to memory of 732 872 igfxpers32.exe 85 PID 872 wrote to memory of 732 872 igfxpers32.exe 85 PID 872 wrote to memory of 732 872 igfxpers32.exe 85 PID 732 wrote to memory of 2112 732 igfxpers32.exe 86 PID 732 wrote to memory of 2112 732 igfxpers32.exe 86 PID 732 wrote to memory of 2112 732 igfxpers32.exe 86 PID 2112 wrote to memory of 5172 2112 igfxpers32.exe 87 PID 2112 wrote to memory of 5172 2112 igfxpers32.exe 87 PID 2112 wrote to memory of 5172 2112 igfxpers32.exe 87 PID 5172 wrote to memory of 1808 5172 igfxpers32.exe 88 PID 5172 wrote to memory of 1808 5172 igfxpers32.exe 88 PID 5172 wrote to memory of 1808 5172 igfxpers32.exe 88 PID 1808 wrote to memory of 2032 1808 igfxpers32.exe 89 PID 1808 wrote to memory of 2032 1808 igfxpers32.exe 89 PID 1808 wrote to memory of 2032 1808 igfxpers32.exe 89 PID 2032 wrote to memory of 4592 2032 igfxpers32.exe 90 PID 2032 wrote to memory of 4592 2032 igfxpers32.exe 90 PID 2032 wrote to memory of 4592 2032 igfxpers32.exe 90 PID 4592 wrote to memory of 2820 4592 igfxpers32.exe 91 PID 4592 wrote to memory of 2820 4592 igfxpers32.exe 91 PID 4592 wrote to memory of 2820 4592 igfxpers32.exe 91 PID 2820 wrote to memory of 2400 2820 igfxpers32.exe 92 PID 2820 wrote to memory of 2400 2820 igfxpers32.exe 92 PID 2820 wrote to memory of 2400 2820 igfxpers32.exe 92 PID 2400 wrote to memory of 3576 2400 igfxpers32.exe 93 PID 2400 wrote to memory of 3576 2400 igfxpers32.exe 93 PID 2400 wrote to memory of 3576 2400 igfxpers32.exe 93 PID 3576 wrote to memory of 1008 3576 igfxpers32.exe 94 PID 3576 wrote to memory of 1008 3576 igfxpers32.exe 94 PID 3576 wrote to memory of 1008 3576 igfxpers32.exe 94 PID 1008 wrote to memory of 3356 1008 igfxpers32.exe 95 PID 1008 wrote to memory of 3356 1008 igfxpers32.exe 95 PID 1008 wrote to memory of 3356 1008 igfxpers32.exe 95 PID 3356 wrote to memory of 3900 3356 igfxpers32.exe 96 PID 3356 wrote to memory of 3900 3356 igfxpers32.exe 96 PID 3356 wrote to memory of 3900 3356 igfxpers32.exe 96 PID 3900 wrote to memory of 1780 3900 igfxpers32.exe 97 PID 3900 wrote to memory of 1780 3900 igfxpers32.exe 97 PID 3900 wrote to memory of 1780 3900 igfxpers32.exe 97 PID 1780 wrote to memory of 4064 1780 igfxpers32.exe 98 PID 1780 wrote to memory of 4064 1780 igfxpers32.exe 98 PID 1780 wrote to memory of 4064 1780 igfxpers32.exe 98 PID 4064 wrote to memory of 3524 4064 igfxpers32.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bbc7b46f6d0713910da177ae15a0a7e8.exe"1⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE2⤵
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE3⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE4⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE5⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE6⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE7⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE8⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE9⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE10⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE11⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE12⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE13⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE14⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE15⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE16⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE17⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE18⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE19⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE20⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE21⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE22⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3524 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE24⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2968 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE25⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1112 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE26⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3296 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE27⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4752 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE28⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4436 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE29⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:460 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE30⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5084 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE31⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1164 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE32⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5816 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE33⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:440 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE34⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6068 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE35⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3480 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE36⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5516 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE37⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4484 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE38⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6092 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE39⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5904 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE40⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5356 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3848 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE42⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1828 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE43⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5572 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE44⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3188 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE45⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4732 -
C:\Windows\SysWOW64\igfxpers32.exe"C:\Windows\system32\igfxpers32.exe" C:\Windows\SysWOW64\IGFXPE~1.EXE46⤵
- Executes dropped EXE
- Maps connected drives based on registry
PID:4648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
221KB
MD5bbc7b46f6d0713910da177ae15a0a7e8
SHA17a1f17df1956019475445b02d2b6cf0219f8ea8b
SHA25663a0481af7fbbb4f1b32728d90e00bd860e7172aa7be4cac9aa8023422534dab
SHA5121563365b484f55309a534e69b3655ce276d3b24f809af7f0be04bdacc7dbb2c748a27dfd988307126d24788e1cd4484345ae2f0268314de96dd0e7e992868e05