Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
21/04/2024, 10:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ff1c8b8cbb3d61e6ffbf3292a9a6a60f_JaffaCakes118.exe
Resource
win7-20240220-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
ff1c8b8cbb3d61e6ffbf3292a9a6a60f_JaffaCakes118.exe
Resource
win10v2004-20240412-en
3 signatures
150 seconds
General
-
Target
ff1c8b8cbb3d61e6ffbf3292a9a6a60f_JaffaCakes118.exe
-
Size
116KB
-
MD5
ff1c8b8cbb3d61e6ffbf3292a9a6a60f
-
SHA1
dd120011a9a70a31428006d4877948718f0ff76a
-
SHA256
4e5b08a0cea9c5d16604d648e7cec22c65afc0f6c3804c29d61fe9f2222581a8
-
SHA512
f0036ea2d5adb2451977059eeaa519c41972027c0b9ff709e092c1fc22f83cc62bd45aa3259bd0d7e877b52afe70612e85cd3e04ff646aed64da7b15b80afaee
-
SSDEEP
1536:Yeq9pLswa4zHMAx1guAIbqIYVKNCe7fi1KPIwiRtmGWzsmUMX8T93ilyeZsQ:QVX7z9sHtVEfzj5qMXA3ilyeZsQ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2004 kb20060927.log 2880 kb20060927.log 2580 kb20060927.log 2648 kb20060927.log 2540 kb20060927.log 1268 kb20060927.log 2420 kb20060927.log 2572 kb20060927.log 2472 kb20060927.log 2428 kb20060927.log 2388 kb20060927.log 2432 kb20060927.log 2552 kb20060927.log 2668 kb20060927.log 2804 kb20060927.log 1740 kb20060927.log 344 kb20060927.log 1020 kb20060927.log 1500 kb20060927.log 2680 kb20060927.log 908 kb20060927.log 2180 kb20060927.log 2188 kb20060927.log 1012 kb20060927.log 1224 kb20060927.log 304 kb20060927.log 1800 kb20060927.log 2768 kb20060927.log 2196 kb20060927.log 1652 kb20060927.log 2316 kb20060927.log 1560 kb20060927.log 1464 kb20060927.log 2424 kb20060927.log 1604 kb20060927.log 1448 kb20060927.log 1720 kb20060927.log 1952 kb20060927.log 1236 kb20060927.log 2904 kb20060927.log 3024 kb20060927.log 2204 kb20060927.log 2480 kb20060927.log 628 kb20060927.log 2364 kb20060927.log 2152 kb20060927.log 1784 kb20060927.log 2104 kb20060927.log 2076 kb20060927.log 540 kb20060927.log 688 kb20060927.log 296 kb20060927.log 1416 kb20060927.log 576 kb20060927.log 588 kb20060927.log 1568 kb20060927.log 868 kb20060927.log 2744 kb20060927.log 1276 kb20060927.log 2220 kb20060927.log 1252 kb20060927.log 652 kb20060927.log 696 kb20060927.log 2780 kb20060927.log -
Loads dropped DLL 64 IoCs
pid Process 2868 ff1c8b8cbb3d61e6ffbf3292a9a6a60f_JaffaCakes118.exe 2868 ff1c8b8cbb3d61e6ffbf3292a9a6a60f_JaffaCakes118.exe 2004 kb20060927.log 2004 kb20060927.log 2880 kb20060927.log 2880 kb20060927.log 2580 kb20060927.log 2580 kb20060927.log 2648 kb20060927.log 2648 kb20060927.log 2540 kb20060927.log 2540 kb20060927.log 1268 kb20060927.log 1268 kb20060927.log 2420 kb20060927.log 2420 kb20060927.log 2572 kb20060927.log 2572 kb20060927.log 2472 kb20060927.log 2472 kb20060927.log 2428 kb20060927.log 2428 kb20060927.log 2388 kb20060927.log 2388 kb20060927.log 2432 kb20060927.log 2432 kb20060927.log 2552 kb20060927.log 2552 kb20060927.log 2668 kb20060927.log 2668 kb20060927.log 2804 kb20060927.log 2804 kb20060927.log 1740 kb20060927.log 1740 kb20060927.log 344 kb20060927.log 344 kb20060927.log 1020 kb20060927.log 1020 kb20060927.log 1500 kb20060927.log 1500 kb20060927.log 2680 kb20060927.log 2680 kb20060927.log 908 kb20060927.log 908 kb20060927.log 2180 kb20060927.log 2180 kb20060927.log 2188 kb20060927.log 2188 kb20060927.log 1012 kb20060927.log 1012 kb20060927.log 1224 kb20060927.log 1224 kb20060927.log 304 kb20060927.log 304 kb20060927.log 1800 kb20060927.log 1800 kb20060927.log 2768 kb20060927.log 2768 kb20060927.log 2196 kb20060927.log 2196 kb20060927.log 1652 kb20060927.log 1652 kb20060927.log 2316 kb20060927.log 2316 kb20060927.log -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log Process not Found File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log Process not Found File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log Process not Found File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log Process not Found File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log File created C:\Windows\SysWOW64\kb20060927.log kb20060927.log -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2868 wrote to memory of 2004 2868 ff1c8b8cbb3d61e6ffbf3292a9a6a60f_JaffaCakes118.exe 29 PID 2868 wrote to memory of 2004 2868 ff1c8b8cbb3d61e6ffbf3292a9a6a60f_JaffaCakes118.exe 29 PID 2868 wrote to memory of 2004 2868 ff1c8b8cbb3d61e6ffbf3292a9a6a60f_JaffaCakes118.exe 29 PID 2868 wrote to memory of 2004 2868 ff1c8b8cbb3d61e6ffbf3292a9a6a60f_JaffaCakes118.exe 29 PID 2004 wrote to memory of 2880 2004 kb20060927.log 30 PID 2004 wrote to memory of 2880 2004 kb20060927.log 30 PID 2004 wrote to memory of 2880 2004 kb20060927.log 30 PID 2004 wrote to memory of 2880 2004 kb20060927.log 30 PID 2880 wrote to memory of 2580 2880 kb20060927.log 31 PID 2880 wrote to memory of 2580 2880 kb20060927.log 31 PID 2880 wrote to memory of 2580 2880 kb20060927.log 31 PID 2880 wrote to memory of 2580 2880 kb20060927.log 31 PID 2580 wrote to memory of 2648 2580 kb20060927.log 32 PID 2580 wrote to memory of 2648 2580 kb20060927.log 32 PID 2580 wrote to memory of 2648 2580 kb20060927.log 32 PID 2580 wrote to memory of 2648 2580 kb20060927.log 32 PID 2648 wrote to memory of 2540 2648 kb20060927.log 33 PID 2648 wrote to memory of 2540 2648 kb20060927.log 33 PID 2648 wrote to memory of 2540 2648 kb20060927.log 33 PID 2648 wrote to memory of 2540 2648 kb20060927.log 33 PID 2540 wrote to memory of 1268 2540 kb20060927.log 34 PID 2540 wrote to memory of 1268 2540 kb20060927.log 34 PID 2540 wrote to memory of 1268 2540 kb20060927.log 34 PID 2540 wrote to memory of 1268 2540 kb20060927.log 34 PID 1268 wrote to memory of 2420 1268 kb20060927.log 35 PID 1268 wrote to memory of 2420 1268 kb20060927.log 35 PID 1268 wrote to memory of 2420 1268 kb20060927.log 35 PID 1268 wrote to memory of 2420 1268 kb20060927.log 35 PID 2420 wrote to memory of 2572 2420 kb20060927.log 36 PID 2420 wrote to memory of 2572 2420 kb20060927.log 36 PID 2420 wrote to memory of 2572 2420 kb20060927.log 36 PID 2420 wrote to memory of 2572 2420 kb20060927.log 36 PID 2572 wrote to memory of 2472 2572 kb20060927.log 37 PID 2572 wrote to memory of 2472 2572 kb20060927.log 37 PID 2572 wrote to memory of 2472 2572 kb20060927.log 37 PID 2572 wrote to memory of 2472 2572 kb20060927.log 37 PID 2472 wrote to memory of 2428 2472 kb20060927.log 38 PID 2472 wrote to memory of 2428 2472 kb20060927.log 38 PID 2472 wrote to memory of 2428 2472 kb20060927.log 38 PID 2472 wrote to memory of 2428 2472 kb20060927.log 38 PID 2428 wrote to memory of 2388 2428 kb20060927.log 39 PID 2428 wrote to memory of 2388 2428 kb20060927.log 39 PID 2428 wrote to memory of 2388 2428 kb20060927.log 39 PID 2428 wrote to memory of 2388 2428 kb20060927.log 39 PID 2388 wrote to memory of 2432 2388 kb20060927.log 40 PID 2388 wrote to memory of 2432 2388 kb20060927.log 40 PID 2388 wrote to memory of 2432 2388 kb20060927.log 40 PID 2388 wrote to memory of 2432 2388 kb20060927.log 40 PID 2432 wrote to memory of 2552 2432 kb20060927.log 41 PID 2432 wrote to memory of 2552 2432 kb20060927.log 41 PID 2432 wrote to memory of 2552 2432 kb20060927.log 41 PID 2432 wrote to memory of 2552 2432 kb20060927.log 41 PID 2552 wrote to memory of 2668 2552 kb20060927.log 42 PID 2552 wrote to memory of 2668 2552 kb20060927.log 42 PID 2552 wrote to memory of 2668 2552 kb20060927.log 42 PID 2552 wrote to memory of 2668 2552 kb20060927.log 42 PID 2668 wrote to memory of 2804 2668 kb20060927.log 43 PID 2668 wrote to memory of 2804 2668 kb20060927.log 43 PID 2668 wrote to memory of 2804 2668 kb20060927.log 43 PID 2668 wrote to memory of 2804 2668 kb20060927.log 43 PID 2804 wrote to memory of 1740 2804 kb20060927.log 44 PID 2804 wrote to memory of 1740 2804 kb20060927.log 44 PID 2804 wrote to memory of 1740 2804 kb20060927.log 44 PID 2804 wrote to memory of 1740 2804 kb20060927.log 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff1c8b8cbb3d61e6ffbf3292a9a6a60f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ff1c8b8cbb3d61e6ffbf3292a9a6a60f_JaffaCakes118.exe"1⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\ff1c8b8cbb3d61e6ffbf3292a9a6a60f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ff1c8b8cbb3d61e6ffbf3292a9a6a60f_JaffaCakes118.exe1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Users\Admin\AppData\Local\Temp\ff1c8b8cbb3d61e6ffbf3292a9a6a60f_JaffaCakes118.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:344 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1020 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1012 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1224 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:304 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log33⤵
- Executes dropped EXE
PID:1560 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log34⤵
- Executes dropped EXE
PID:1464 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log35⤵
- Executes dropped EXE
PID:2424 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log36⤵
- Executes dropped EXE
PID:1604 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log37⤵
- Executes dropped EXE
PID:1448 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log38⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1720 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log39⤵
- Executes dropped EXE
PID:1952 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log40⤵
- Executes dropped EXE
PID:1236 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log41⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2904 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log42⤵
- Executes dropped EXE
PID:3024 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log43⤵
- Executes dropped EXE
PID:2204 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log44⤵
- Executes dropped EXE
PID:2480 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log45⤵
- Executes dropped EXE
PID:628 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log46⤵
- Executes dropped EXE
PID:2364 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log47⤵
- Executes dropped EXE
PID:2152 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log48⤵
- Executes dropped EXE
PID:1784 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log49⤵
- Executes dropped EXE
PID:2104 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log50⤵
- Executes dropped EXE
PID:2076 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log51⤵
- Executes dropped EXE
PID:540 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log52⤵
- Executes dropped EXE
PID:688 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log53⤵
- Executes dropped EXE
PID:296 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log54⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1416 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log55⤵
- Executes dropped EXE
PID:576 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log56⤵
- Executes dropped EXE
PID:588 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log57⤵
- Executes dropped EXE
PID:1568 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log58⤵
- Executes dropped EXE
PID:868 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log59⤵
- Executes dropped EXE
PID:2744 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log60⤵
- Executes dropped EXE
PID:1276 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log61⤵
- Executes dropped EXE
PID:2220 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log62⤵
- Executes dropped EXE
PID:1252 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log63⤵
- Executes dropped EXE
PID:652 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log64⤵
- Executes dropped EXE
PID:696 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log65⤵
- Executes dropped EXE
PID:2780 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log66⤵PID:2776
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log67⤵PID:700
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log68⤵
- Drops file in System32 directory
PID:456 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log69⤵PID:2688
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log70⤵PID:1152
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log71⤵PID:2852
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log72⤵PID:2960
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log73⤵PID:3036
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log74⤵PID:1792
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log75⤵PID:1600
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log76⤵PID:1788
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log77⤵PID:1700
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log78⤵PID:1324
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log79⤵PID:1884
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log80⤵PID:1676
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log81⤵PID:1672
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log82⤵PID:1688
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log83⤵PID:1664
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log84⤵PID:612
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log85⤵PID:3000
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log86⤵PID:2024
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log87⤵PID:2992
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log88⤵PID:2268
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log89⤵PID:3040
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log90⤵PID:3044
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log91⤵PID:1556
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log92⤵PID:984
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log93⤵PID:1208
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log94⤵PID:2156
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log95⤵PID:572
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log96⤵PID:2884
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log97⤵PID:896
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log98⤵PID:1984
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log99⤵PID:1760
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log100⤵PID:2108
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log101⤵PID:2020
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log102⤵PID:2068
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log103⤵PID:1524
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log104⤵PID:1640
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log105⤵
- Drops file in System32 directory
PID:2696 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log106⤵PID:2868
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log107⤵
- Drops file in System32 directory
PID:2004 -
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log108⤵PID:1992
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log109⤵PID:2476
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log110⤵PID:2900
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log111⤵PID:2968
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log112⤵PID:2608
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log113⤵PID:2652
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log114⤵PID:2512
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log115⤵PID:2540
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log116⤵PID:2536
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log117⤵PID:2516
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log118⤵PID:2508
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log119⤵PID:2624
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log120⤵PID:2600
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log121⤵PID:2672
-
C:\Windows\SysWOW64\kb20060927.log"C:\Windows\system32\kb20060927.log" *C:\Windows\SysWOW64\kb20060927.log122⤵PID:2096
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-