Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 18:55
Behavioral task
behavioral1
Sample
f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe
-
Size
409KB
-
MD5
f672d1603b04f6a1bb2c1168429768de
-
SHA1
7321c9d98b08b4e2a59240666a17787d583e74f0
-
SHA256
d267c57b4520dcb86c9930857aef0d59457c832b820a3a4c568c63ffe2837165
-
SHA512
21bff6aea5afa8f983ce920f8d0b4774173ccd065dd44f01e03d31fba5bb706c6e1b7cc6e5ef4394724e539f2c4842ee13f64e182dae72a700ef08d9f33e6575
-
SSDEEP
12288:L2LfajrFOnz+EtLLz7YVWy+OPWejt/pTwQqXPU:L2Lmw+EtYVR1Fjt/pTwQqs
Malware Config
Extracted
warzonerat
111.90.146.200:5200
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 14 IoCs
Processes:
resource yara_rule behavioral2/memory/2492-9-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral2/memory/2492-14-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral2/memory/2492-5-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral2/memory/1852-38-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral2/memory/5040-60-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral2/memory/1852-61-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral2/memory/2492-23-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral2/memory/1852-80-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral2/memory/3812-98-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral2/memory/5040-120-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral2/memory/3812-156-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral2/memory/4676-189-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral2/memory/1912-212-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral2/memory/4900-235-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat -
Drops startup file 64 IoCs
Processes:
notepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exef672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\confirm.vbs notepad.exe -
Executes dropped EXE 64 IoCs
Processes:
images.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exepid process 4568 images.exe 1852 images.exe 4628 images.exe 1208 images.exe 3812 images.exe 4016 images.exe 4604 images.exe 4676 images.exe 4048 images.exe 3004 images.exe 1912 images.exe 368 images.exe 3196 images.exe 4264 images.exe 4900 images.exe 732 images.exe 1968 images.exe 3296 images.exe 4128 images.exe 3584 images.exe 4808 images.exe 4492 images.exe 4016 images.exe 892 images.exe 624 images.exe 4288 images.exe 5104 images.exe 4392 images.exe 3084 images.exe 5016 images.exe 4240 images.exe 2976 images.exe 3444 images.exe 4924 images.exe 2356 images.exe 2608 images.exe 4708 images.exe 3472 images.exe 2972 images.exe 2448 images.exe 3460 images.exe 868 images.exe 3172 images.exe 4492 images.exe 2008 images.exe 3104 images.exe 1052 images.exe 1656 images.exe 3976 images.exe 4392 images.exe 3076 images.exe 2252 images.exe 1860 images.exe 4636 images.exe 4972 images.exe 1108 images.exe 4616 images.exe 1440 images.exe 716 images.exe 3520 images.exe 2748 images.exe 1464 images.exe 3488 images.exe 3172 images.exe -
Processes:
resource yara_rule behavioral2/memory/432-0-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/432-2-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/4908-10-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/4908-16-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/4908-11-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/432-3-0x0000000000400000-0x00000000004D5000-memory.dmp upx C:\ProgramData\images.exe upx behavioral2/memory/4568-25-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/4568-28-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/4568-30-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/4520-32-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/4520-49-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/2984-53-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/2984-64-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/4628-56-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/4628-45-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/4520-35-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/1208-84-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/1208-86-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/4016-100-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/4016-101-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/4016-94-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/1208-89-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/4604-164-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/4048-177-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/3004-194-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/368-208-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/3196-218-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/4264-228-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral2/memory/732-241-0x0000000000400000-0x00000000004D5000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images1 = "C:\\ProgramData\\images.exe" f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe -
Suspicious use of SetThreadContext 64 IoCs
Processes:
f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exeimages.exef672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exedescription pid process target process PID 432 set thread context of 2492 432 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe PID 4568 set thread context of 1852 4568 images.exe images.exe PID 4520 set thread context of 5040 4520 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe PID 1208 set thread context of 3812 1208 images.exe images.exe PID 4604 set thread context of 4676 4604 images.exe images.exe PID 3004 set thread context of 1912 3004 images.exe images.exe PID 3196 set thread context of 4900 3196 images.exe images.exe PID 732 set thread context of 1968 732 images.exe images.exe PID 4128 set thread context of 3584 4128 images.exe images.exe PID 4492 set thread context of 4016 4492 images.exe images.exe PID 624 set thread context of 4288 624 images.exe images.exe PID 4392 set thread context of 3084 4392 images.exe images.exe PID 4240 set thread context of 2976 4240 images.exe images.exe PID 4924 set thread context of 2356 4924 images.exe images.exe PID 4708 set thread context of 3472 4708 images.exe images.exe PID 2448 set thread context of 3460 2448 images.exe images.exe PID 3172 set thread context of 4492 3172 images.exe images.exe PID 3104 set thread context of 1052 3104 images.exe images.exe PID 3976 set thread context of 4392 3976 images.exe images.exe PID 2252 set thread context of 1860 2252 images.exe images.exe PID 4972 set thread context of 1108 4972 images.exe images.exe PID 1440 set thread context of 716 1440 images.exe images.exe PID 2748 set thread context of 1464 2748 images.exe images.exe PID 3172 set thread context of 4988 3172 images.exe images.exe PID 3020 set thread context of 3104 3020 images.exe images.exe PID 756 set thread context of 3676 756 images.exe images.exe PID 4936 set thread context of 4348 4936 images.exe images.exe PID 1544 set thread context of 3196 1544 images.exe images.exe PID 732 set thread context of 2568 732 images.exe images.exe PID 4808 set thread context of 4472 4808 images.exe images.exe PID 4908 set thread context of 892 4908 images.exe images.exe PID 2824 set thread context of 4800 2824 images.exe images.exe PID 3772 set thread context of 4620 3772 images.exe images.exe PID 2544 set thread context of 3152 2544 images.exe images.exe PID 3208 set thread context of 4904 3208 images.exe images.exe PID 2392 set thread context of 4160 2392 images.exe images.exe PID 8 set thread context of 4836 8 images.exe images.exe PID 2920 set thread context of 1716 2920 images.exe images.exe PID 1592 set thread context of 4272 1592 images.exe images.exe PID 3944 set thread context of 3912 3944 images.exe images.exe PID 2504 set thread context of 4188 2504 images.exe images.exe PID 3080 set thread context of 4636 3080 images.exe images.exe PID 2420 set thread context of 1948 2420 images.exe images.exe PID 3112 set thread context of 832 3112 images.exe images.exe PID 1788 set thread context of 1708 1788 images.exe images.exe PID 4568 set thread context of 1840 4568 images.exe images.exe PID 4064 set thread context of 4896 4064 images.exe images.exe PID 3216 set thread context of 3248 3216 images.exe images.exe PID 5016 set thread context of 1512 5016 images.exe images.exe PID 1544 set thread context of 1868 1544 images.exe images.exe PID 4312 set thread context of 4420 4312 images.exe images.exe PID 1744 set thread context of 1972 1744 images.exe images.exe PID 2028 set thread context of 3760 2028 images.exe images.exe PID 3916 set thread context of 2604 3916 images.exe images.exe PID 4152 set thread context of 3864 4152 images.exe images.exe PID 4484 set thread context of 4256 4484 images.exe images.exe PID 3444 set thread context of 392 3444 images.exe images.exe PID 1512 set thread context of 3352 1512 images.exe images.exe PID 3536 set thread context of 4580 3536 images.exe images.exe PID 3116 set thread context of 4808 3116 images.exe images.exe PID 4128 set thread context of 4536 4128 images.exe images.exe PID 1884 set thread context of 1100 1884 images.exe images.exe PID 1628 set thread context of 3476 1628 images.exe images.exe PID 3772 set thread context of 4136 3772 images.exe images.exe -
NTFS ADS 1 IoCs
Processes:
f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exedescription ioc process File created C:\ProgramData:ApplicationData f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exef672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exeimages.exef672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exeimages.exef672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exepowershell.exepid process 432 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 432 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4568 images.exe 4568 images.exe 4520 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4520 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4628 images.exe 4628 images.exe 4628 images.exe 4628 images.exe 4628 images.exe 4628 images.exe 2984 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2984 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2984 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2984 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4628 images.exe 4628 images.exe 3484 powershell.exe 2984 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2984 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4628 images.exe 4628 images.exe 2984 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2984 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4628 images.exe 4628 images.exe 2984 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 2984 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4628 images.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exeimages.exef672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exeimages.exepid process 432 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 4568 images.exe 4520 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe 1208 images.exe 4604 images.exe 3004 images.exe 3196 images.exe 732 images.exe 4128 images.exe 4492 images.exe 624 images.exe 4392 images.exe 4240 images.exe 4924 images.exe 4708 images.exe 2448 images.exe 3172 images.exe 3104 images.exe 3976 images.exe 2252 images.exe 4972 images.exe 1440 images.exe 2748 images.exe 3172 images.exe 3020 images.exe 756 images.exe 4936 images.exe 1544 images.exe 732 images.exe 4808 images.exe 4908 images.exe 2824 images.exe 3772 images.exe 2544 images.exe 3208 images.exe 2392 images.exe 8 images.exe 2920 images.exe 1592 images.exe 3944 images.exe 2504 images.exe 3080 images.exe 2420 images.exe 3112 images.exe 1788 images.exe 4568 images.exe 4064 images.exe 3216 images.exe 5016 images.exe 1544 images.exe 4312 images.exe 1744 images.exe 2028 images.exe 3916 images.exe 4152 images.exe 4484 images.exe 3444 images.exe 1512 images.exe 3536 images.exe 3116 images.exe 4128 images.exe 1884 images.exe 1628 images.exe 3772 images.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3484 powershell.exe Token: SeDebugPrivilege 1592 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exef672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exef672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exeimages.exef672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exeimages.exeimages.exef672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exedescription pid process target process PID 432 wrote to memory of 1968 432 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe notepad.exe PID 432 wrote to memory of 1968 432 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe notepad.exe PID 432 wrote to memory of 1968 432 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe notepad.exe PID 432 wrote to memory of 1968 432 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe notepad.exe PID 432 wrote to memory of 1968 432 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe notepad.exe PID 432 wrote to memory of 2492 432 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe PID 432 wrote to memory of 2492 432 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe PID 432 wrote to memory of 2492 432 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe PID 432 wrote to memory of 4908 432 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe PID 432 wrote to memory of 4908 432 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe PID 432 wrote to memory of 4908 432 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe PID 2492 wrote to memory of 3484 2492 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe powershell.exe PID 2492 wrote to memory of 3484 2492 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe powershell.exe PID 2492 wrote to memory of 3484 2492 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe powershell.exe PID 2492 wrote to memory of 4568 2492 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe images.exe PID 2492 wrote to memory of 4568 2492 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe images.exe PID 2492 wrote to memory of 4568 2492 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe images.exe PID 4908 wrote to memory of 4520 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe PID 4908 wrote to memory of 4520 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe PID 4908 wrote to memory of 4520 4908 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe PID 4568 wrote to memory of 3548 4568 images.exe notepad.exe PID 4568 wrote to memory of 3548 4568 images.exe notepad.exe PID 4568 wrote to memory of 3548 4568 images.exe notepad.exe PID 4568 wrote to memory of 3548 4568 images.exe notepad.exe PID 4568 wrote to memory of 3548 4568 images.exe notepad.exe PID 4568 wrote to memory of 1852 4568 images.exe images.exe PID 4568 wrote to memory of 1852 4568 images.exe images.exe PID 4568 wrote to memory of 1852 4568 images.exe images.exe PID 4568 wrote to memory of 4628 4568 images.exe images.exe PID 4568 wrote to memory of 4628 4568 images.exe images.exe PID 4568 wrote to memory of 4628 4568 images.exe images.exe PID 4520 wrote to memory of 4760 4520 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe notepad.exe PID 4520 wrote to memory of 4760 4520 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe notepad.exe PID 4520 wrote to memory of 4760 4520 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe notepad.exe PID 4520 wrote to memory of 4760 4520 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe notepad.exe PID 4520 wrote to memory of 4760 4520 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe notepad.exe PID 4520 wrote to memory of 5040 4520 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe PID 4520 wrote to memory of 5040 4520 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe PID 4520 wrote to memory of 5040 4520 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe PID 4520 wrote to memory of 2984 4520 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe PID 4520 wrote to memory of 2984 4520 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe PID 4520 wrote to memory of 2984 4520 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe PID 4628 wrote to memory of 1208 4628 images.exe images.exe PID 4628 wrote to memory of 1208 4628 images.exe images.exe PID 4628 wrote to memory of 1208 4628 images.exe images.exe PID 1208 wrote to memory of 3976 1208 images.exe notepad.exe PID 1208 wrote to memory of 3976 1208 images.exe notepad.exe PID 1208 wrote to memory of 3976 1208 images.exe notepad.exe PID 1208 wrote to memory of 3976 1208 images.exe notepad.exe PID 1208 wrote to memory of 3976 1208 images.exe notepad.exe PID 1208 wrote to memory of 3812 1208 images.exe images.exe PID 1208 wrote to memory of 3812 1208 images.exe images.exe PID 1208 wrote to memory of 3812 1208 images.exe images.exe PID 1208 wrote to memory of 4016 1208 images.exe images.exe PID 1208 wrote to memory of 4016 1208 images.exe images.exe PID 1208 wrote to memory of 4016 1208 images.exe images.exe PID 5040 wrote to memory of 1592 5040 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe powershell.exe PID 5040 wrote to memory of 1592 5040 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe powershell.exe PID 5040 wrote to memory of 1592 5040 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe powershell.exe PID 5040 wrote to memory of 3552 5040 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe cmd.exe PID 5040 wrote to memory of 3552 5040 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe cmd.exe PID 5040 wrote to memory of 3552 5040 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe cmd.exe PID 5040 wrote to memory of 3552 5040 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe cmd.exe PID 5040 wrote to memory of 3552 5040 f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Drops startup file
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"2⤵
- Drops startup file
- Adds Run key to start application
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3484 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"4⤵
- Drops startup file
PID:3548 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"4⤵
- Executes dropped EXE
PID:1852 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 1852 2405952654⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"6⤵
- Drops startup file
PID:3976 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"6⤵
- Executes dropped EXE
PID:3812 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3812 2405973436⤵
- Executes dropped EXE
PID:4016 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4604 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"8⤵
- Drops startup file
PID:4568 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"8⤵
- Executes dropped EXE
PID:4676 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4676 2405994068⤵
- Executes dropped EXE
PID:4048 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3004 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"10⤵
- Drops startup file
PID:1240 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"10⤵
- Executes dropped EXE
PID:1912 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 1912 24060070310⤵
- Executes dropped EXE
PID:368 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3196 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"12⤵
- Drops startup file
PID:4972 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"12⤵
- Executes dropped EXE
PID:4900 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4900 24060195312⤵
- Executes dropped EXE
PID:4264 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:732 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"14⤵
- Drops startup file
PID:2144 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"14⤵
- Executes dropped EXE
PID:1968 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 1968 24060329614⤵
- Executes dropped EXE
PID:3296 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4128 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"16⤵PID:4388
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"16⤵
- Executes dropped EXE
PID:3584 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3584 24060475016⤵
- Executes dropped EXE
PID:4808 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4492 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"18⤵
- Drops startup file
PID:4952 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"18⤵
- Executes dropped EXE
PID:4016 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4016 24060617118⤵
- Executes dropped EXE
PID:892 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:624 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"20⤵PID:216
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"20⤵
- Executes dropped EXE
PID:4288 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4288 24060751520⤵
- Executes dropped EXE
PID:5104 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4392 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"22⤵
- Drops startup file
PID:3028 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"22⤵
- Executes dropped EXE
PID:3084 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3084 24060887522⤵
- Executes dropped EXE
PID:5016 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4240 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"24⤵
- Drops startup file
PID:4636 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"24⤵
- Executes dropped EXE
PID:2976 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 2976 24061026524⤵
- Executes dropped EXE
PID:3444 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4924 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"26⤵
- Drops startup file
PID:1340 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"26⤵
- Executes dropped EXE
PID:2356 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 2356 24061162526⤵
- Executes dropped EXE
PID:2608 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4708 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"28⤵
- Drops startup file
PID:2396 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"28⤵
- Executes dropped EXE
PID:3472 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3472 24061293728⤵
- Executes dropped EXE
PID:2972 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2448 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"30⤵
- Drops startup file
PID:8 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"30⤵
- Executes dropped EXE
PID:3460 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3460 24061423430⤵
- Executes dropped EXE
PID:868 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3172 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"32⤵PID:2920
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"32⤵
- Executes dropped EXE
PID:4492 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4492 24061556232⤵
- Executes dropped EXE
PID:2008 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3104 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"34⤵
- Drops startup file
PID:4896 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"34⤵
- Executes dropped EXE
PID:1052 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 1052 24061698434⤵
- Executes dropped EXE
PID:1656 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3976 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"36⤵PID:3704
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"36⤵
- Executes dropped EXE
PID:4392 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4392 24061823436⤵
- Executes dropped EXE
PID:3076 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2252 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"38⤵
- Drops startup file
PID:3292 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"38⤵
- Executes dropped EXE
PID:1860 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 1860 24061946838⤵
- Executes dropped EXE
PID:4636 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4972 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"40⤵PID:4700
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"40⤵
- Executes dropped EXE
PID:1108 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 1108 24062073440⤵
- Executes dropped EXE
PID:4616 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1440 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"42⤵
- Drops startup file
PID:2236 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"42⤵
- Executes dropped EXE
PID:716 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 716 24062204642⤵
- Executes dropped EXE
PID:3520 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2748 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"44⤵PID:840
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"44⤵
- Executes dropped EXE
PID:1464 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 1464 24062331244⤵
- Executes dropped EXE
PID:3488 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3172 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"46⤵
- Drops startup file
PID:2432 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"46⤵PID:4988
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4988 24062459346⤵PID:1832
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"47⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3020 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"48⤵PID:4896
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"48⤵PID:3104
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3104 24062585948⤵PID:2104
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"49⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:756 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"50⤵
- Drops startup file
PID:2480 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"50⤵PID:3676
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3676 24062712550⤵PID:3152
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"51⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4936 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"52⤵
- Drops startup file
PID:2932 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"52⤵PID:4348
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4348 24062837552⤵PID:4904
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"53⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1544 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"54⤵PID:3984
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"54⤵PID:3196
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3196 24062962554⤵PID:4780
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"55⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:732 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"56⤵
- Drops startup file
PID:2520 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"56⤵PID:2568
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 2568 24063082856⤵PID:1916
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"57⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4808 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"58⤵PID:5112
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"58⤵PID:4472
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4472 24063207858⤵PID:1520
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"59⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4908 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"60⤵
- Drops startup file
PID:3488 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"60⤵PID:892
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 892 24063340660⤵PID:3548
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"61⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2824 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"62⤵PID:3544
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"62⤵PID:4800
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4800 24063468762⤵PID:2428
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"63⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3772 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"64⤵PID:4680
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"64⤵PID:4620
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4620 24063595364⤵PID:4432
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"65⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2544 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"66⤵PID:3616
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"66⤵PID:3152
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3152 24063726566⤵PID:4244
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"67⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3208 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"68⤵
- Drops startup file
PID:392 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"68⤵PID:4904
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4904 24063851568⤵PID:1604
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"69⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2392 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"70⤵PID:4420
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"70⤵PID:4160
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4160 24063982870⤵PID:4728
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"71⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:8 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"72⤵
- Drops startup file
PID:1916 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"72⤵PID:4836
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4836 24064107872⤵PID:4000
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"73⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2920 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"74⤵
- Drops startup file
PID:4204 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"74⤵PID:1716
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 1716 24064237574⤵PID:1992
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"75⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1592 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"76⤵PID:3548
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"76⤵PID:4272
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4272 24064362576⤵PID:3132
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"77⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3944 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"78⤵PID:2428
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"78⤵PID:3912
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3912 24064489078⤵PID:4364
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"79⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2504 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"80⤵PID:5016
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"80⤵PID:4188
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4188 24064628180⤵PID:3292
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"81⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3080 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"82⤵PID:4376
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"82⤵PID:4636
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4636 24064751582⤵PID:4496
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"83⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2420 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"84⤵
- Drops startup file
PID:4312 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"84⤵PID:1948
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 1948 24064878184⤵PID:2392
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"85⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3112 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"86⤵
- Drops startup file
PID:408 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"86⤵PID:832
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 832 24065006286⤵PID:1452
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"87⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1788 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"88⤵
- Drops startup file
PID:5112 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"88⤵PID:1708
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 1708 24065145388⤵PID:544
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"89⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4568 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"90⤵
- Drops startup file
PID:2920 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"90⤵PID:1840
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 1840 24065270390⤵PID:4908
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"91⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4064 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"92⤵
- Drops startup file
PID:3904 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"92⤵PID:4896
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4896 24065395392⤵PID:5104
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"93⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3216 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"94⤵PID:4256
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"94⤵PID:3248
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3248 24065521894⤵PID:4308
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"95⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:5016 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"96⤵PID:1304
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"96⤵PID:1512
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 1512 24065650096⤵PID:940
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"97⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1544 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"98⤵PID:4448
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"98⤵PID:1868
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 1868 24065778198⤵PID:1604
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"99⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4312 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"100⤵PID:4116
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"100⤵PID:4420
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4420 240659015100⤵PID:4540
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"101⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1744 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"102⤵
- Drops startup file
PID:4156 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"102⤵PID:1972
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 1972 240660421102⤵PID:3992
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"103⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2028 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"104⤵PID:2332
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"104⤵PID:3760
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3760 240661625104⤵PID:932
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"105⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3916 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"106⤵
- Drops startup file
PID:3172 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"106⤵PID:2604
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 2604 240662890106⤵PID:948
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"107⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4152 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"108⤵PID:3772
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"108⤵PID:3864
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3864 240664203108⤵PID:2172
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"109⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4484 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"110⤵
- Drops startup file
PID:3004 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"110⤵PID:4256
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4256 240665500110⤵PID:316
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"111⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3444 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"112⤵
- Drops startup file
PID:2032 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"112⤵PID:392
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 392 240666796112⤵PID:4628
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"113⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1512 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"114⤵PID:4032
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"114⤵PID:3352
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3352 240668140114⤵PID:4264
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"115⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3536 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"116⤵
- Drops startup file
PID:4708 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"116⤵PID:4580
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4580 240669531116⤵PID:3296
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"117⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3116 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"118⤵PID:1768
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"118⤵PID:4808
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4808 240670875118⤵PID:3660
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"119⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4128 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"120⤵
- Drops startup file
PID:924 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"120⤵PID:4536
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4536 240672187120⤵PID:1560
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"121⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1884 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"122⤵
- Drops startup file
PID:4568 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"122⤵PID:1100
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 1100 240673437122⤵PID:1764
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"123⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1628 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"124⤵
- Drops startup file
PID:2564 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"124⤵PID:3476
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3476 240674750124⤵PID:4360
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"125⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3772 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"126⤵PID:1824
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"126⤵PID:4136
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4136 240676031126⤵PID:4680
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"127⤵PID:3004
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"128⤵
- Drops startup file
PID:1208 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"128⤵PID:4208
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4208 240677375128⤵PID:3028
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"129⤵PID:4776
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"130⤵
- Drops startup file
PID:5016 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"130⤵PID:3080
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3080 240678656130⤵PID:5052
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"131⤵PID:1512
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"132⤵PID:3996
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"132⤵PID:4296
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4296 240679906132⤵PID:4264
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"133⤵PID:2608
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"134⤵PID:2392
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"134⤵PID:2016
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 2016 240681156134⤵PID:4528
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"135⤵PID:2180
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"136⤵PID:4796
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"136⤵PID:4944
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4944 240682468136⤵PID:1508
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"137⤵PID:868
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"138⤵
- Drops startup file
PID:4128 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"138⤵PID:3796
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3796 240683781138⤵PID:1856
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"139⤵PID:780
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"140⤵
- Drops startup file
PID:980 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"140⤵PID:2400
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 2400 240685156140⤵PID:1764
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"141⤵PID:2428
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"142⤵PID:4048
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"142⤵PID:3032
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3032 240686515142⤵PID:4852
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"143⤵PID:4432
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"144⤵PID:3256
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"144⤵PID:3076
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3076 240687734144⤵PID:2644
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"145⤵PID:4888
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"146⤵PID:1260
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"146⤵PID:4364
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4364 240689015146⤵PID:4396
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"147⤵PID:1980
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"148⤵
- Drops startup file
PID:940 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"148⤵PID:4240
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4240 240690312148⤵PID:4368
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"149⤵PID:220
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"150⤵
- Drops startup file
PID:636 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"150⤵PID:3640
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3640 240691562150⤵PID:4336
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"151⤵PID:4688
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"152⤵PID:2628
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"152⤵PID:4312
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4312 240692984152⤵PID:1928
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"153⤵PID:2300
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"154⤵
- Drops startup file
PID:1452 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"154⤵PID:2384
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 2384 240694328154⤵PID:4788
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"155⤵PID:5044
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"156⤵PID:2012
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"156⤵PID:3692
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3692 240695562156⤵PID:924
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"157⤵PID:3112
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"158⤵PID:4604
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"158⤵PID:3488
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3488 240696843158⤵PID:3420
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"159⤵PID:1524
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"160⤵
- Drops startup file
PID:3544 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"160⤵PID:2008
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 2008 240698046160⤵PID:2184
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"161⤵PID:628
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"162⤵PID:4120
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"162⤵PID:3976
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3976 240699359162⤵PID:3704
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"163⤵PID:4476
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"164⤵PID:4360
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"164⤵PID:2172
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 2172 240700562164⤵PID:4852
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"165⤵PID:3256
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"166⤵PID:3208
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"166⤵PID:3280
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3280 240701812166⤵PID:1428
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"167⤵PID:1260
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"168⤵PID:3984
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"168⤵PID:1720
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 1720 240703093168⤵PID:4628
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"169⤵PID:4448
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"170⤵PID:688
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"170⤵PID:556
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 556 240704421170⤵PID:5052
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"171⤵PID:636
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"172⤵
- Drops startup file
PID:4292 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"172⤵PID:2520
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 2520 240705687172⤵PID:2608
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"173⤵PID:4528
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"174⤵
- Drops startup file
PID:3660 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"174⤵PID:8
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 8 240707062174⤵PID:4008
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"175⤵PID:1452
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"176⤵PID:1692
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"176⤵PID:1936
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 1936 240708265176⤵PID:2596
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"177⤵PID:2012
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"178⤵
- Drops startup file
PID:1232 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"178⤵PID:4180
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4180 240709578178⤵PID:2448
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"179⤵PID:4604
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"180⤵PID:928
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"180⤵PID:440
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 440 240710828180⤵PID:948
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"181⤵PID:3312
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"182⤵PID:3636
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"182⤵PID:4020
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4020 240712093182⤵PID:1764
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"183⤵PID:804
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"184⤵
- Drops startup file
PID:1404 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"184⤵PID:3704
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3704 240713390184⤵PID:452
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"185⤵PID:4852
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"186⤵
- Drops startup file
PID:1824 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"186⤵PID:2436
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 2436 240714593186⤵PID:3256
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"187⤵PID:1428
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"188⤵
- Drops startup file
PID:456 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"188⤵PID:3404
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3404 240715906188⤵PID:4376
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"189⤵PID:3948
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"190⤵PID:3308
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"190⤵PID:3140
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3140 240717250190⤵PID:5012
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"191⤵PID:4404
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"192⤵
- Drops startup file
PID:4780 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"192⤵PID:2460
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 2460 240718625192⤵PID:220
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"193⤵PID:1780
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"194⤵
- Drops startup file
PID:2628 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"194⤵PID:2044
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 2044 240719859194⤵PID:4592
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"195⤵PID:680
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"196⤵PID:836
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"196⤵PID:4788
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4788 240721078196⤵PID:3016
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"197⤵PID:3520
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"198⤵
- Drops startup file
PID:864 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"198⤵PID:3868
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3868 240722328198⤵PID:2012
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"199⤵PID:2448
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"200⤵
- Drops startup file
PID:4952 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"200⤵PID:4836
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4836 240723562200⤵PID:388
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"201⤵PID:3172
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"202⤵
- Drops startup file
PID:2888 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"202⤵PID:2184
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 2184 240724765202⤵PID:1832
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"203⤵PID:780
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"204⤵
- Drops startup file
PID:2292 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"204⤵PID:2884
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 2884 240726015204⤵PID:3192
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"205⤵PID:536
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"206⤵
- Drops startup file
PID:872 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"206⤵PID:3820
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3820 240727281206⤵PID:4316
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"207⤵PID:2032
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"208⤵
- Drops startup file
PID:1888 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"208⤵PID:2248
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 2248 240728515208⤵PID:3444
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"209⤵PID:456
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"210⤵PID:4148
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"210⤵PID:2456
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 2456 240729750210⤵PID:2996
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"211⤵PID:4708
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"212⤵
- Drops startup file
PID:1680 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"212⤵PID:4036
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4036 240731000212⤵PID:4444
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"213⤵PID:4780
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"214⤵
- Drops startup file
PID:332 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"214⤵PID:3204
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3204 240732296214⤵PID:4116
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"215⤵PID:2676
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"216⤵PID:2364
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"216⤵PID:2692
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 2692 240733515216⤵PID:3116
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"217⤵PID:3024
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"218⤵PID:3416
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"218⤵PID:4992
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4992 240734796218⤵PID:2204
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"219⤵PID:2668
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"220⤵
- Drops startup file
PID:400 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"220⤵PID:840
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 840 240736062220⤵PID:4076
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"221⤵PID:1616
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"222⤵PID:4328
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"222⤵PID:2768
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 2768 240737406222⤵PID:1992
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"223⤵PID:4576
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"224⤵PID:4956
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"224⤵PID:3312
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3312 240738593224⤵PID:3836
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"225⤵PID:3092
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"226⤵
- Drops startup file
PID:792 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"226⤵PID:368
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 368 240739859226⤵PID:3772
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"227⤵PID:2644
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"228⤵PID:4936
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"228⤵PID:4464
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 4464 240741062228⤵PID:4360
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"229⤵PID:4104
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"230⤵PID:4196
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"230⤵PID:3256
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 3256 240742281230⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe" 2 2492 2405932962⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"4⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1592 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"5⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f672d1603b04f6a1bb2c1168429768de_JaffaCakes118.exe" 2 5040 2405955464⤵
- Suspicious behavior: EnumeratesProcesses
PID:2984
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
409KB
MD5f672d1603b04f6a1bb2c1168429768de
SHA17321c9d98b08b4e2a59240666a17787d583e74f0
SHA256d267c57b4520dcb86c9930857aef0d59457c832b820a3a4c568c63ffe2837165
SHA51221bff6aea5afa8f983ce920f8d0b4774173ccd065dd44f01e03d31fba5bb706c6e1b7cc6e5ef4394724e539f2c4842ee13f64e182dae72a700ef08d9f33e6575
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD53eec57a063ddeef5a5584bd53b072634
SHA14fa6792f06bf298f5a0f62de1281f10a91f71b14
SHA256b10d3b025ce67a8180cca9f94f9d9e09db9394c4e7b3d7d64c33d990bc7eee82
SHA51226b54d912ca3dd113a324f3d9bd45459321fee39ca942ff3b1e8d73fefa2b1e32307f90b1a858502ada1fc40e37b94b9ac7a95ba1699687e62fc88bd1aa4a428
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
158B
MD53cccf9435b659bf318d80f780097ffbf
SHA1f0af7b20ad3498befcc19d90c0c1c7d4f021e77f
SHA256a5c69769ed69652017de0ac5b2b49978af9580a67f0ce473742fc3a04c00a86a
SHA512d28c78ce84c518b8446aaa2b10bced63c7877b969abdcc0d3b65251123c1472f66598935de7facab9f5608c2bdc01b03156b00413687ee40b272c1b307e29b40
-
Filesize
99B
MD522965bf780a1f6765b8c4f592ac43af6
SHA199c91c1351f21ab92cbc028da05b8bcb7e007f76
SHA256cfaa7ab524373e22fe317556e030491cd71d85db67f96692711178e38f377799
SHA51277327ea6a9d361c37997188d87a43d7ede626d78f7d22046d2b43f654f2133165263ac5919930f97251097febd0cf836dca17270c87048d581f6c359fc079988