Analysis
-
max time kernel
60s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 16:24
Static task
static1
Behavioral task
behavioral1
Sample
5a51e1e48cf514de495c13d1af463bc2_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
5a51e1e48cf514de495c13d1af463bc2_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
5a51e1e48cf514de495c13d1af463bc2_JaffaCakes118.exe
-
Size
840KB
-
MD5
5a51e1e48cf514de495c13d1af463bc2
-
SHA1
d7b288ecebebe4467bef48da25db6ba4fc424a89
-
SHA256
ec35c0f70e43316469957b8829e748bf1541bb1eff27f931e0f6df1310993030
-
SHA512
d803cf5f128d3e1879b99c567ec122b663daea8acc8a693e130e006f66e5eecfbe8c4b93117a6b7d8e15eeb1ec8e916c0b68b26ef77f02b167fd62d0224867c6
-
SSDEEP
12288:Y4YIo+/zfgajmG/4rzaM6SbjhlDdFbzZ4StxEF63U1wcJ5w:Y17YzgbGxSbjDd75txU6Z
Malware Config
Extracted
warzonerat
savagesquad.ooguy.com:5437
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 2 IoCs
resource yara_rule behavioral2/memory/1204-88-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral2/memory/1204-89-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation FGUI.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation XXZZ.EXE -
Executes dropped EXE 64 IoCs
pid Process 3276 FGUI.EXE 3128 XXZZ.EXE 312 XXZZ.EXE 4972 XXZZ.EXE 808 XXZZ.EXE 1556 XXZZ.EXE 1708 XXZZ.EXE 1200 XXZZ.EXE 4896 XXZZ.EXE 440 XXZZ.EXE 3268 XXZZ.EXE 3408 XXZZ.EXE 1208 XXZZ.EXE 3124 XXZZ.EXE 1808 XXZZ.EXE 3832 XXZZ.EXE 3140 XXZZ.EXE 3820 XXZZ.EXE 3624 XXZZ.EXE 2780 XXZZ.EXE 4960 XXZZ.EXE 3244 XXZZ.EXE 1440 XXZZ.EXE 5100 XXZZ.EXE 3304 XXZZ.EXE 1792 XXZZ.EXE 116 XXZZ.EXE 4616 XXZZ.EXE 3036 XXZZ.EXE 2080 XXZZ.EXE 3284 XXZZ.EXE 4472 XXZZ.EXE 4468 XXZZ.EXE 4068 XXZZ.EXE 3576 XXZZ.EXE 1616 XXZZ.EXE 2188 XXZZ.EXE 3620 XXZZ.EXE 1692 XXZZ.EXE 3848 XXZZ.EXE 3268 XXZZ.EXE 3408 XXZZ.EXE 2920 XXZZ.EXE 2052 XXZZ.EXE 3140 XXZZ.EXE 3460 XXZZ.EXE 4376 XXZZ.EXE 2476 XXZZ.EXE 1340 XXZZ.EXE 4540 XXZZ.EXE 3432 XXZZ.EXE 4780 XXZZ.EXE 3228 XXZZ.EXE 3196 XXZZ.EXE 644 XXZZ.EXE 3356 XXZZ.EXE 1636 XXZZ.EXE 1496 XXZZ.EXE 2492 XXZZ.EXE 1100 XXZZ.EXE 940 XXZZ.EXE 2404 XXZZ.EXE 4928 XXZZ.EXE 3728 XXZZ.EXE -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3276 set thread context of 1204 3276 FGUI.EXE 399 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2324 schtasks.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4472 wrote to memory of 3276 4472 5a51e1e48cf514de495c13d1af463bc2_JaffaCakes118.exe 83 PID 4472 wrote to memory of 3276 4472 5a51e1e48cf514de495c13d1af463bc2_JaffaCakes118.exe 83 PID 4472 wrote to memory of 3276 4472 5a51e1e48cf514de495c13d1af463bc2_JaffaCakes118.exe 83 PID 4472 wrote to memory of 3128 4472 5a51e1e48cf514de495c13d1af463bc2_JaffaCakes118.exe 84 PID 4472 wrote to memory of 3128 4472 5a51e1e48cf514de495c13d1af463bc2_JaffaCakes118.exe 84 PID 4472 wrote to memory of 3128 4472 5a51e1e48cf514de495c13d1af463bc2_JaffaCakes118.exe 84 PID 3128 wrote to memory of 312 3128 XXZZ.EXE 85 PID 3128 wrote to memory of 312 3128 XXZZ.EXE 85 PID 3128 wrote to memory of 312 3128 XXZZ.EXE 85 PID 312 wrote to memory of 4972 312 XXZZ.EXE 86 PID 312 wrote to memory of 4972 312 XXZZ.EXE 86 PID 312 wrote to memory of 4972 312 XXZZ.EXE 86 PID 4972 wrote to memory of 808 4972 XXZZ.EXE 88 PID 4972 wrote to memory of 808 4972 XXZZ.EXE 88 PID 4972 wrote to memory of 808 4972 XXZZ.EXE 88 PID 808 wrote to memory of 1556 808 XXZZ.EXE 89 PID 808 wrote to memory of 1556 808 XXZZ.EXE 89 PID 808 wrote to memory of 1556 808 XXZZ.EXE 89 PID 1556 wrote to memory of 1708 1556 XXZZ.EXE 91 PID 1556 wrote to memory of 1708 1556 XXZZ.EXE 91 PID 1556 wrote to memory of 1708 1556 XXZZ.EXE 91 PID 1708 wrote to memory of 1200 1708 XXZZ.EXE 92 PID 1708 wrote to memory of 1200 1708 XXZZ.EXE 92 PID 1708 wrote to memory of 1200 1708 XXZZ.EXE 92 PID 1200 wrote to memory of 4896 1200 XXZZ.EXE 191 PID 1200 wrote to memory of 4896 1200 XXZZ.EXE 191 PID 1200 wrote to memory of 4896 1200 XXZZ.EXE 191 PID 4896 wrote to memory of 440 4896 XXZZ.EXE 94 PID 4896 wrote to memory of 440 4896 XXZZ.EXE 94 PID 4896 wrote to memory of 440 4896 XXZZ.EXE 94 PID 440 wrote to memory of 3268 440 XXZZ.EXE 129 PID 440 wrote to memory of 3268 440 XXZZ.EXE 129 PID 440 wrote to memory of 3268 440 XXZZ.EXE 129 PID 3268 wrote to memory of 3408 3268 XXZZ.EXE 195 PID 3268 wrote to memory of 3408 3268 XXZZ.EXE 195 PID 3268 wrote to memory of 3408 3268 XXZZ.EXE 195 PID 3408 wrote to memory of 1208 3408 XXZZ.EXE 97 PID 3408 wrote to memory of 1208 3408 XXZZ.EXE 97 PID 3408 wrote to memory of 1208 3408 XXZZ.EXE 97 PID 1208 wrote to memory of 3124 1208 XXZZ.EXE 99 PID 1208 wrote to memory of 3124 1208 XXZZ.EXE 99 PID 1208 wrote to memory of 3124 1208 XXZZ.EXE 99 PID 3124 wrote to memory of 1808 3124 XXZZ.EXE 100 PID 3124 wrote to memory of 1808 3124 XXZZ.EXE 100 PID 3124 wrote to memory of 1808 3124 XXZZ.EXE 100 PID 1808 wrote to memory of 3832 1808 XXZZ.EXE 101 PID 1808 wrote to memory of 3832 1808 XXZZ.EXE 101 PID 1808 wrote to memory of 3832 1808 XXZZ.EXE 101 PID 3832 wrote to memory of 3140 3832 XXZZ.EXE 166 PID 3832 wrote to memory of 3140 3832 XXZZ.EXE 166 PID 3832 wrote to memory of 3140 3832 XXZZ.EXE 166 PID 3140 wrote to memory of 3820 3140 XXZZ.EXE 103 PID 3140 wrote to memory of 3820 3140 XXZZ.EXE 103 PID 3140 wrote to memory of 3820 3140 XXZZ.EXE 103 PID 3820 wrote to memory of 3624 3820 XXZZ.EXE 104 PID 3820 wrote to memory of 3624 3820 XXZZ.EXE 104 PID 3820 wrote to memory of 3624 3820 XXZZ.EXE 104 PID 3624 wrote to memory of 2780 3624 XXZZ.EXE 105 PID 3624 wrote to memory of 2780 3624 XXZZ.EXE 105 PID 3624 wrote to memory of 2780 3624 XXZZ.EXE 105 PID 2780 wrote to memory of 4960 2780 XXZZ.EXE 106 PID 2780 wrote to memory of 4960 2780 XXZZ.EXE 106 PID 2780 wrote to memory of 4960 2780 XXZZ.EXE 106 PID 4960 wrote to memory of 3244 4960 XXZZ.EXE 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a51e1e48cf514de495c13d1af463bc2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5a51e1e48cf514de495c13d1af463bc2_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\FGUI.EXE"C:\Users\Admin\AppData\Local\Temp\FGUI.EXE"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3276 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hPiAzoSzIFRAVl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2A.tmp"3⤵
- Creates scheduled task(s)
PID:2324 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:1472
-
-
-
C:\Users\Admin\AppData\Local\Temp\FGUI.EXE"C:\Users\Admin\AppData\Local\Temp\FGUI.EXE"3⤵PID:1204
-
-
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"8⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"22⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"23⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"24⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"25⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"26⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"27⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"28⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"29⤵
- Checks computer location settings
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"30⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"31⤵
- Checks computer location settings
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"32⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"33⤵
- Checks computer location settings
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"34⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"35⤵
- Checks computer location settings
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"36⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"37⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"38⤵
- Checks computer location settings
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"39⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"40⤵
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"41⤵
- Checks computer location settings
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"42⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"43⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"44⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"45⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"46⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"47⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"48⤵
- Executes dropped EXE
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"49⤵
- Checks computer location settings
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"50⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"51⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"52⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"53⤵
- Executes dropped EXE
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"54⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"55⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"56⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"57⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"58⤵
- Checks computer location settings
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"59⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"60⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"61⤵
- Executes dropped EXE
PID:940 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"62⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"63⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"64⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"65⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"66⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"67⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"68⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"69⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"70⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"71⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"72⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"73⤵
- Checks computer location settings
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"74⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"75⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"76⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"77⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"78⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"79⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"80⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"81⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"82⤵
- Checks computer location settings
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"83⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"84⤵
- Checks computer location settings
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"85⤵
- Checks computer location settings
PID:644 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"86⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"87⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"88⤵
- Checks computer location settings
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"89⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"90⤵
- Checks computer location settings
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"91⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"92⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"93⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"94⤵
- Checks computer location settings
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"95⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"96⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"97⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"98⤵
- Checks computer location settings
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"99⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"100⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"101⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"102⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"103⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"104⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"105⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"106⤵
- Checks computer location settings
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"107⤵
- Checks computer location settings
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"108⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"109⤵
- Checks computer location settings
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"110⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"111⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"112⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"113⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"114⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"115⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"116⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"117⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"118⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"119⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"120⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"121⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"C:\Users\Admin\AppData\Local\Temp\XXZZ.EXE"122⤵PID:3160
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-