Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2024, 12:09
Static task
static1
Behavioral task
behavioral1
Sample
1a0f363e69c03fe992e6a28cf4823815_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1a0f363e69c03fe992e6a28cf4823815_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
1a0f363e69c03fe992e6a28cf4823815_JaffaCakes118.exe
-
Size
168KB
-
MD5
1a0f363e69c03fe992e6a28cf4823815
-
SHA1
4a6aa3f65685d4b4f896288f8a96047e6ae3166b
-
SHA256
dc270d82b4639c4783ab2469e8428cfb979921035502d6ee3002f0d839d82c6c
-
SHA512
e3adf529db0c04d6b73d95efa4451f7ac36387615c388039520989b2969edde740797490f14481015a96ff11ac0ff435de4bdf59a54336fea21acc110ae2f2e0
-
SSDEEP
3072:gLuC9XN6Q22l61bgI3fZD5uA9vfB0q1wdNp9Txfs5Bw0/Cq:M9d6Qdl8ffv4fp9T0BzN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2668 wuauolts.exe 1852 wuauolts.exe 4712 wuauolts.exe 4716 wuauolts.exe 4668 wuauolts.exe 4908 wuauolts.exe 4508 wuauolts.exe 1400 wuauolts.exe 3928 wuauolts.exe 4440 wuauolts.exe 3388 wuauolts.exe 3424 wuauolts.exe 3848 wuauolts.exe 4024 wuauolts.exe 1348 wuauolts.exe 1788 wuauolts.exe 4900 wuauolts.exe 4992 wuauolts.exe 1472 wuauolts.exe 2624 wuauolts.exe 4924 wuauolts.exe 4412 wuauolts.exe 2960 wuauolts.exe 4720 wuauolts.exe 2320 wuauolts.exe 4984 wuauolts.exe 4032 wuauolts.exe 824 wuauolts.exe 1320 wuauolts.exe 4708 wuauolts.exe 4628 wuauolts.exe 1104 wuauolts.exe 3600 wuauolts.exe 624 wuauolts.exe 4624 wuauolts.exe 2976 wuauolts.exe 5072 wuauolts.exe 8 wuauolts.exe 4724 wuauolts.exe 1188 wuauolts.exe 1680 wuauolts.exe 4824 wuauolts.exe 216 wuauolts.exe 4504 wuauolts.exe 4436 wuauolts.exe 4324 wuauolts.exe 1956 wuauolts.exe 1372 wuauolts.exe 2272 wuauolts.exe 3576 wuauolts.exe 1040 wuauolts.exe 3880 wuauolts.exe 4284 wuauolts.exe 4684 wuauolts.exe 2164 wuauolts.exe 2688 wuauolts.exe 3836 wuauolts.exe 3764 wuauolts.exe 3656 wuauolts.exe 2856 wuauolts.exe 2008 wuauolts.exe 5076 wuauolts.exe 1056 wuauolts.exe 2480 wuauolts.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\n: Process not Found File opened (read-only) \??\w: wuauolts.exe File opened (read-only) \??\x: Process not Found File opened (read-only) \??\v: wuauolts.exe File opened (read-only) \??\o: Process not Found File opened (read-only) \??\e: Process not Found File opened (read-only) \??\t: Process not Found File opened (read-only) \??\m: Process not Found File opened (read-only) \??\s: wuauolts.exe File opened (read-only) \??\i: Process not Found File opened (read-only) \??\k: Process not Found File opened (read-only) \??\m: Process not Found File opened (read-only) \??\e: wuauolts.exe File opened (read-only) \??\j: Process not Found File opened (read-only) \??\k: Process not Found File opened (read-only) \??\s: Process not Found File opened (read-only) \??\r: Process not Found File opened (read-only) \??\u: Process not Found File opened (read-only) \??\e: wuauolts.exe File opened (read-only) \??\l: wuauolts.exe File opened (read-only) \??\y: Process not Found File opened (read-only) \??\n: Process not Found File opened (read-only) \??\v: Process not Found File opened (read-only) \??\r: wuauolts.exe File opened (read-only) \??\g: Process not Found File opened (read-only) \??\q: Process not Found File opened (read-only) \??\q: Process not Found File opened (read-only) \??\u: Process not Found File opened (read-only) \??\l: Process not Found File opened (read-only) \??\o: Process not Found File opened (read-only) \??\l: Process not Found File opened (read-only) \??\e: wuauolts.exe File opened (read-only) \??\k: Process not Found File opened (read-only) \??\v: Process not Found File opened (read-only) \??\h: Process not Found File opened (read-only) \??\z: Process not Found File opened (read-only) \??\l: Process not Found File opened (read-only) \??\r: Process not Found File opened (read-only) \??\n: Process not Found File opened (read-only) \??\g: wuauolts.exe File opened (read-only) \??\h: Process not Found File opened (read-only) \??\w: Process not Found File opened (read-only) \??\u: wuauolts.exe File opened (read-only) \??\o: wuauolts.exe File opened (read-only) \??\g: Process not Found File opened (read-only) \??\n: Process not Found File opened (read-only) \??\r: Process not Found File opened (read-only) \??\v: Process not Found File opened (read-only) \??\u: Process not Found File opened (read-only) \??\z: wuauolts.exe File opened (read-only) \??\w: Process not Found File opened (read-only) \??\e: Process not Found File opened (read-only) \??\x: Process not Found File opened (read-only) \??\h: Process not Found File opened (read-only) \??\e: Process not Found File opened (read-only) \??\n: Process not Found File opened (read-only) \??\r: Process not Found File opened (read-only) \??\z: wuauolts.exe File opened (read-only) \??\q: Process not Found File opened (read-only) \??\x: Process not Found File opened (read-only) \??\j: Process not Found File opened (read-only) \??\g: Process not Found File opened (read-only) \??\n: Process not Found File opened (read-only) \??\v: Process not Found -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 2024 1a0f363e69c03fe992e6a28cf4823815_JaffaCakes118.exe 2668 wuauolts.exe 1852 wuauolts.exe 4712 wuauolts.exe 4716 wuauolts.exe 4668 wuauolts.exe 4908 wuauolts.exe 4508 wuauolts.exe 1400 wuauolts.exe 3928 wuauolts.exe 4440 wuauolts.exe 3388 wuauolts.exe 3424 wuauolts.exe 3848 wuauolts.exe 4024 wuauolts.exe 1348 wuauolts.exe 1788 wuauolts.exe 4900 wuauolts.exe 4992 wuauolts.exe 1472 wuauolts.exe 2624 wuauolts.exe 4924 wuauolts.exe 4412 wuauolts.exe 2960 wuauolts.exe 4720 wuauolts.exe 2320 wuauolts.exe 4984 wuauolts.exe 4032 wuauolts.exe 824 wuauolts.exe 1320 wuauolts.exe 4708 wuauolts.exe 4628 wuauolts.exe 1104 wuauolts.exe 3600 wuauolts.exe 624 wuauolts.exe 4624 wuauolts.exe 2976 wuauolts.exe 5072 wuauolts.exe 8 wuauolts.exe 4724 wuauolts.exe 1188 wuauolts.exe 1680 wuauolts.exe 4824 wuauolts.exe 216 wuauolts.exe 4504 wuauolts.exe 4436 wuauolts.exe 4324 wuauolts.exe 1956 wuauolts.exe 1372 wuauolts.exe 2272 wuauolts.exe 3576 wuauolts.exe 1040 wuauolts.exe 3880 wuauolts.exe 4684 wuauolts.exe 2164 wuauolts.exe 2688 wuauolts.exe 3836 wuauolts.exe 3764 wuauolts.exe 3656 wuauolts.exe 2856 wuauolts.exe 2008 wuauolts.exe 5076 wuauolts.exe 1056 wuauolts.exe 2480 wuauolts.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2024 wrote to memory of 2668 2024 1a0f363e69c03fe992e6a28cf4823815_JaffaCakes118.exe 88 PID 2024 wrote to memory of 2668 2024 1a0f363e69c03fe992e6a28cf4823815_JaffaCakes118.exe 88 PID 2024 wrote to memory of 2668 2024 1a0f363e69c03fe992e6a28cf4823815_JaffaCakes118.exe 88 PID 2668 wrote to memory of 1852 2668 wuauolts.exe 89 PID 2668 wrote to memory of 1852 2668 wuauolts.exe 89 PID 2668 wrote to memory of 1852 2668 wuauolts.exe 89 PID 1852 wrote to memory of 4712 1852 wuauolts.exe 90 PID 1852 wrote to memory of 4712 1852 wuauolts.exe 90 PID 1852 wrote to memory of 4712 1852 wuauolts.exe 90 PID 4712 wrote to memory of 4716 4712 wuauolts.exe 91 PID 4712 wrote to memory of 4716 4712 wuauolts.exe 91 PID 4712 wrote to memory of 4716 4712 wuauolts.exe 91 PID 4716 wrote to memory of 4668 4716 wuauolts.exe 92 PID 4716 wrote to memory of 4668 4716 wuauolts.exe 92 PID 4716 wrote to memory of 4668 4716 wuauolts.exe 92 PID 4668 wrote to memory of 4908 4668 wuauolts.exe 93 PID 4668 wrote to memory of 4908 4668 wuauolts.exe 93 PID 4668 wrote to memory of 4908 4668 wuauolts.exe 93 PID 4908 wrote to memory of 4508 4908 wuauolts.exe 94 PID 4908 wrote to memory of 4508 4908 wuauolts.exe 94 PID 4908 wrote to memory of 4508 4908 wuauolts.exe 94 PID 4508 wrote to memory of 1400 4508 wuauolts.exe 95 PID 4508 wrote to memory of 1400 4508 wuauolts.exe 95 PID 4508 wrote to memory of 1400 4508 wuauolts.exe 95 PID 1400 wrote to memory of 3928 1400 wuauolts.exe 96 PID 1400 wrote to memory of 3928 1400 wuauolts.exe 96 PID 1400 wrote to memory of 3928 1400 wuauolts.exe 96 PID 3928 wrote to memory of 4440 3928 wuauolts.exe 97 PID 3928 wrote to memory of 4440 3928 wuauolts.exe 97 PID 3928 wrote to memory of 4440 3928 wuauolts.exe 97 PID 4440 wrote to memory of 3388 4440 wuauolts.exe 98 PID 4440 wrote to memory of 3388 4440 wuauolts.exe 98 PID 4440 wrote to memory of 3388 4440 wuauolts.exe 98 PID 3388 wrote to memory of 3424 3388 wuauolts.exe 99 PID 3388 wrote to memory of 3424 3388 wuauolts.exe 99 PID 3388 wrote to memory of 3424 3388 wuauolts.exe 99 PID 3424 wrote to memory of 3848 3424 wuauolts.exe 100 PID 3424 wrote to memory of 3848 3424 wuauolts.exe 100 PID 3424 wrote to memory of 3848 3424 wuauolts.exe 100 PID 3848 wrote to memory of 4024 3848 wuauolts.exe 102 PID 3848 wrote to memory of 4024 3848 wuauolts.exe 102 PID 3848 wrote to memory of 4024 3848 wuauolts.exe 102 PID 4024 wrote to memory of 1348 4024 wuauolts.exe 104 PID 4024 wrote to memory of 1348 4024 wuauolts.exe 104 PID 4024 wrote to memory of 1348 4024 wuauolts.exe 104 PID 1348 wrote to memory of 1788 1348 wuauolts.exe 105 PID 1348 wrote to memory of 1788 1348 wuauolts.exe 105 PID 1348 wrote to memory of 1788 1348 wuauolts.exe 105 PID 1788 wrote to memory of 4900 1788 wuauolts.exe 106 PID 1788 wrote to memory of 4900 1788 wuauolts.exe 106 PID 1788 wrote to memory of 4900 1788 wuauolts.exe 106 PID 4900 wrote to memory of 4992 4900 wuauolts.exe 107 PID 4900 wrote to memory of 4992 4900 wuauolts.exe 107 PID 4900 wrote to memory of 4992 4900 wuauolts.exe 107 PID 4992 wrote to memory of 1472 4992 wuauolts.exe 108 PID 4992 wrote to memory of 1472 4992 wuauolts.exe 108 PID 4992 wrote to memory of 1472 4992 wuauolts.exe 108 PID 1472 wrote to memory of 2624 1472 wuauolts.exe 109 PID 1472 wrote to memory of 2624 1472 wuauolts.exe 109 PID 1472 wrote to memory of 2624 1472 wuauolts.exe 109 PID 2624 wrote to memory of 4924 2624 wuauolts.exe 110 PID 2624 wrote to memory of 4924 2624 wuauolts.exe 110 PID 2624 wrote to memory of 4924 2624 wuauolts.exe 110 PID 4924 wrote to memory of 4412 4924 wuauolts.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a0f363e69c03fe992e6a28cf4823815_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1a0f363e69c03fe992e6a28cf4823815_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe7⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe8⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe9⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe10⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe11⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe12⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe13⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe14⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe15⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe16⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe17⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe18⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe19⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe20⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe21⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe22⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe23⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4412 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe24⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2960 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe25⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4720 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe26⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2320 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe27⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4984 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe28⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4032 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe29⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:824 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe30⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1320 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe31⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4708 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe32⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4628 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe33⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1104 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe34⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3600 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe35⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:624 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe36⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4624 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe37⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2976 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe38⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5072 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe39⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:8 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe40⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4724 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe41⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1188 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe42⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1680 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe43⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4824 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe44⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:216 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe45⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4504 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe46⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4436 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe47⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4324 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe48⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1956 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe49⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1372 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe50⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2272 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe51⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3576 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe52⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1040 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe53⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3880 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe54⤵
- Executes dropped EXE
PID:4284 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe55⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4684 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe56⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2164 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe57⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2688 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe58⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3836 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe59⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3764 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3656 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe61⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2856 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe62⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2008 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe63⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5076 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe64⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1056 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe65⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2480 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe66⤵PID:4392
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe67⤵PID:2216
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe68⤵PID:2912
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe69⤵
- Enumerates connected drives
PID:3768 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe70⤵PID:3624
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe71⤵PID:864
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe72⤵PID:5148
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe73⤵PID:5192
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe74⤵PID:5228
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe75⤵PID:5260
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe76⤵PID:5292
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe77⤵PID:5324
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe78⤵PID:5352
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe79⤵PID:5384
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe80⤵PID:5416
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe81⤵PID:5444
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe82⤵PID:5472
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe83⤵PID:5504
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe84⤵PID:5536
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe85⤵PID:5564
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe86⤵PID:5600
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe87⤵PID:5632
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe88⤵PID:5660
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe89⤵PID:5692
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe90⤵PID:5720
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe91⤵PID:5748
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe92⤵PID:5776
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe93⤵PID:5812
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe94⤵PID:5876
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe95⤵PID:5912
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe96⤵PID:5944
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe97⤵PID:5972
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe98⤵PID:6004
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe99⤵PID:6040
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe100⤵PID:6072
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe101⤵PID:6104
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe102⤵PID:6132
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe103⤵PID:5184
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe104⤵PID:5272
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe105⤵PID:5404
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe106⤵PID:5496
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe107⤵PID:5560
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe108⤵PID:5644
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe109⤵PID:5740
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe110⤵PID:5864
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe111⤵PID:5952
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe112⤵PID:6032
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe113⤵PID:6124
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe114⤵PID:5368
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe115⤵PID:5608
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe116⤵PID:5932
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe117⤵PID:5304
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe118⤵PID:6164
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe119⤵PID:6204
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe120⤵PID:6248
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe121⤵PID:6304
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe122⤵PID:6348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-