Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 04:03
Static task
static1
Behavioral task
behavioral1
Sample
249148f74e2f1fe28f274d45f876b5cd_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
249148f74e2f1fe28f274d45f876b5cd_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
249148f74e2f1fe28f274d45f876b5cd_JaffaCakes118.exe
-
Size
496KB
-
MD5
249148f74e2f1fe28f274d45f876b5cd
-
SHA1
9f8411885962c8c92619bef3fc57f21c828bad42
-
SHA256
7d5ea8cb79035f9855711f891d0eb7be47033c43ace219e70f8bb5d51e3e0f7e
-
SHA512
a1ccd117b0a5fe0f23a9ff41cb09c2d4e4bce098020ac5e2220b1375a2d1a1d29f57d3f3a28ac72e0e742b77a3b61e4ffffe34a1650ab9417a562d9dbbeeabda
-
SSDEEP
6144:Dr3HjxgAJJej39c8SluXWAqlu/ol89tE16gEelSowQb3:Dr3HjpQ39c83E1EemQb3
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 99494.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Cerberus = "C:\\Windows\\system32\\catroot4\\winsvr32.exe" 99494.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 99494.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Cerberus = "C:\\Windows\\system32\\catroot4\\winsvr32.exe" 99494.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{T5TBB77L-4678-0MKC-421Q-14416031DYU6} 99494.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{T5TBB77L-4678-0MKC-421Q-14416031DYU6}\StubPath = "C:\\Windows\\system32\\catroot4\\winsvr32.exe Restart" 99494.exe -
Deletes itself 1 IoCs
pid Process 1540 cmd.exe -
Executes dropped EXE 64 IoCs
pid Process 2452 99494.exe 2140 99494.exe 1964 winsvr32.exe 1776 winsvr32.exe 1468 winsvr32.exe 2420 winsvr32.exe 2724 winsvr32.exe 2748 winsvr32.exe 476 winsvr32.exe 1864 winsvr32.exe 2200 winsvr32.exe 1940 winsvr32.exe 2544 winsvr32.exe 1284 winsvr32.exe 2584 winsvr32.exe 616 winsvr32.exe 1272 winsvr32.exe 1956 winsvr32.exe 1040 winsvr32.exe 940 winsvr32.exe 3036 winsvr32.exe 1144 winsvr32.exe 2176 winsvr32.exe 1320 winsvr32.exe 476 winsvr32.exe 792 winsvr32.exe 1484 winsvr32.exe 772 winsvr32.exe 2948 winsvr32.exe 3020 winsvr32.exe 744 winsvr32.exe 2832 winsvr32.exe 3060 winsvr32.exe 2628 winsvr32.exe 2428 winsvr32.exe 1468 winsvr32.exe 1380 winsvr32.exe 2260 winsvr32.exe 2824 winsvr32.exe 2580 winsvr32.exe 2228 winsvr32.exe 1044 winsvr32.exe 2828 winsvr32.exe 2556 winsvr32.exe 2064 winsvr32.exe 2280 winsvr32.exe 624 winsvr32.exe 2412 winsvr32.exe 3020 winsvr32.exe 2040 winsvr32.exe 2536 winsvr32.exe 1592 winsvr32.exe 2328 winsvr32.exe 2396 winsvr32.exe 1768 winsvr32.exe 1764 winsvr32.exe 2464 winsvr32.exe 2152 winsvr32.exe 2784 winsvr32.exe 1804 winsvr32.exe 624 winsvr32.exe 2244 winsvr32.exe 2204 winsvr32.exe 1180 winsvr32.exe -
Loads dropped DLL 64 IoCs
pid Process 2452 99494.exe 2140 99494.exe 2140 99494.exe 1964 winsvr32.exe 1776 winsvr32.exe 1776 winsvr32.exe 2420 winsvr32.exe 2420 winsvr32.exe 2748 winsvr32.exe 2748 winsvr32.exe 1864 winsvr32.exe 1864 winsvr32.exe 1940 winsvr32.exe 1940 winsvr32.exe 1284 winsvr32.exe 1284 winsvr32.exe 616 winsvr32.exe 616 winsvr32.exe 1956 winsvr32.exe 1956 winsvr32.exe 940 winsvr32.exe 940 winsvr32.exe 1144 winsvr32.exe 1144 winsvr32.exe 1320 winsvr32.exe 1320 winsvr32.exe 792 winsvr32.exe 792 winsvr32.exe 772 winsvr32.exe 772 winsvr32.exe 3020 winsvr32.exe 3020 winsvr32.exe 2832 winsvr32.exe 2832 winsvr32.exe 2628 winsvr32.exe 2628 winsvr32.exe 1468 winsvr32.exe 1468 winsvr32.exe 2260 winsvr32.exe 2260 winsvr32.exe 2580 winsvr32.exe 2580 winsvr32.exe 1044 winsvr32.exe 1044 winsvr32.exe 2556 winsvr32.exe 2556 winsvr32.exe 2280 winsvr32.exe 2280 winsvr32.exe 2412 winsvr32.exe 2412 winsvr32.exe 2040 winsvr32.exe 2040 winsvr32.exe 1592 winsvr32.exe 1592 winsvr32.exe 2396 winsvr32.exe 2396 winsvr32.exe 1764 winsvr32.exe 1764 winsvr32.exe 2152 winsvr32.exe 2152 winsvr32.exe 1804 winsvr32.exe 1804 winsvr32.exe 2244 winsvr32.exe 2244 winsvr32.exe -
resource yara_rule behavioral1/files/0x000a000000012280-6.dat upx behavioral1/memory/2452-8-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2140-26-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2452-25-0x0000000000260000-0x0000000000283000-memory.dmp upx behavioral1/memory/2452-237-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2140-247-0x0000000010410000-0x0000000010446000-memory.dmp upx behavioral1/memory/1964-273-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2140-270-0x0000000003FB0000-0x0000000003FD3000-memory.dmp upx behavioral1/memory/1964-277-0x00000000002F0000-0x0000000000313000-memory.dmp upx behavioral1/memory/1964-535-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1468-811-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2724-1087-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/476-1107-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/476-1365-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2200-1641-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2544-1917-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2584-2193-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/616-2196-0x0000000003E70000-0x0000000003E93000-memory.dmp upx behavioral1/memory/1272-2470-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1040-2489-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1040-2747-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/3036-3023-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2176-3299-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/476-3575-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1484-3851-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2948-4127-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/744-4400-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2832-4402-0x0000000003E70000-0x0000000003E93000-memory.dmp upx behavioral1/memory/3060-4673-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2428-4945-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1380-5218-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2824-5491-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2228-5762-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2828-6034-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2064-6052-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2064-6309-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/624-6326-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/624-6583-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2412-6598-0x0000000003E70000-0x0000000003E93000-memory.dmp upx behavioral1/memory/3020-6856-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2536-7128-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1592-7144-0x0000000003E70000-0x0000000003E93000-memory.dmp upx behavioral1/memory/2328-7401-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1768-7673-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2464-7945-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2784-7961-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2784-8218-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/624-8491-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2204-8508-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2204-8765-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2560-9038-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1504-9310-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1248-9325-0x0000000003E70000-0x0000000003E93000-memory.dmp upx behavioral1/memory/2852-9583-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/3040-9855-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1348-10127-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/624-10401-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/236-10673-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2832-10945-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1744-11217-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2720-11489-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/2588-11761-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1608-12033-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral1/memory/1776-12305-0x0000000000400000-0x0000000000423000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cerberus = "C:\\Windows\\system32\\catroot4\\winsvr32.exe" 99494.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cerberus = "C:\\Windows\\system32\\catroot4\\winsvr32.exe" 99494.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\catroot4\winsvr32.exe 99494.exe File opened for modification C:\Windows\SysWOW64\catroot4\winsvr32.exe 99494.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 1864 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2452 99494.exe Token: SeDebugPrivilege 2452 99494.exe Token: SeDebugPrivilege 1964 winsvr32.exe Token: SeDebugPrivilege 1964 winsvr32.exe Token: SeDebugPrivilege 1864 taskkill.exe Token: SeDebugPrivilege 1468 winsvr32.exe Token: SeDebugPrivilege 1468 winsvr32.exe Token: SeDebugPrivilege 2724 winsvr32.exe Token: SeDebugPrivilege 2724 winsvr32.exe Token: SeDebugPrivilege 476 winsvr32.exe Token: SeDebugPrivilege 476 winsvr32.exe Token: SeDebugPrivilege 2200 winsvr32.exe Token: SeDebugPrivilege 2200 winsvr32.exe Token: SeDebugPrivilege 2544 winsvr32.exe Token: SeDebugPrivilege 2544 winsvr32.exe Token: SeDebugPrivilege 2584 winsvr32.exe Token: SeDebugPrivilege 2584 winsvr32.exe Token: SeDebugPrivilege 1272 winsvr32.exe Token: SeDebugPrivilege 1272 winsvr32.exe Token: SeDebugPrivilege 1040 winsvr32.exe Token: SeDebugPrivilege 1040 winsvr32.exe Token: SeDebugPrivilege 3036 winsvr32.exe Token: SeDebugPrivilege 3036 winsvr32.exe Token: SeDebugPrivilege 2176 winsvr32.exe Token: SeDebugPrivilege 2176 winsvr32.exe Token: SeDebugPrivilege 476 winsvr32.exe Token: SeDebugPrivilege 476 winsvr32.exe Token: SeDebugPrivilege 1484 winsvr32.exe Token: SeDebugPrivilege 1484 winsvr32.exe Token: SeDebugPrivilege 2948 winsvr32.exe Token: SeDebugPrivilege 2948 winsvr32.exe Token: SeDebugPrivilege 744 winsvr32.exe Token: SeDebugPrivilege 744 winsvr32.exe Token: SeDebugPrivilege 3060 winsvr32.exe Token: SeDebugPrivilege 3060 winsvr32.exe Token: SeDebugPrivilege 2428 winsvr32.exe Token: SeDebugPrivilege 2428 winsvr32.exe Token: SeDebugPrivilege 1380 winsvr32.exe Token: SeDebugPrivilege 1380 winsvr32.exe Token: SeDebugPrivilege 2824 winsvr32.exe Token: SeDebugPrivilege 2824 winsvr32.exe Token: SeDebugPrivilege 2228 winsvr32.exe Token: SeDebugPrivilege 2228 winsvr32.exe Token: SeDebugPrivilege 2828 winsvr32.exe Token: SeDebugPrivilege 2828 winsvr32.exe Token: SeDebugPrivilege 2064 winsvr32.exe Token: SeDebugPrivilege 2064 winsvr32.exe Token: SeDebugPrivilege 624 winsvr32.exe Token: SeDebugPrivilege 624 winsvr32.exe Token: SeDebugPrivilege 3020 winsvr32.exe Token: SeDebugPrivilege 3020 winsvr32.exe Token: SeDebugPrivilege 2536 winsvr32.exe Token: SeDebugPrivilege 2536 winsvr32.exe Token: SeDebugPrivilege 2328 winsvr32.exe Token: SeDebugPrivilege 2328 winsvr32.exe Token: SeDebugPrivilege 1768 winsvr32.exe Token: SeDebugPrivilege 1768 winsvr32.exe Token: SeDebugPrivilege 2464 winsvr32.exe Token: SeDebugPrivilege 2464 winsvr32.exe Token: SeDebugPrivilege 2784 winsvr32.exe Token: SeDebugPrivilege 2784 winsvr32.exe Token: SeDebugPrivilege 624 winsvr32.exe Token: SeDebugPrivilege 624 winsvr32.exe Token: SeDebugPrivilege 2204 winsvr32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2452 2240 249148f74e2f1fe28f274d45f876b5cd_JaffaCakes118.exe 28 PID 2240 wrote to memory of 2452 2240 249148f74e2f1fe28f274d45f876b5cd_JaffaCakes118.exe 28 PID 2240 wrote to memory of 2452 2240 249148f74e2f1fe28f274d45f876b5cd_JaffaCakes118.exe 28 PID 2240 wrote to memory of 2452 2240 249148f74e2f1fe28f274d45f876b5cd_JaffaCakes118.exe 28 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29 PID 2452 wrote to memory of 2140 2452 99494.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\249148f74e2f1fe28f274d45f876b5cd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\249148f74e2f1fe28f274d45f876b5cd_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\99494.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\99494.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\99494.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\99494.exe"3⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2140 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1964 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1468 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2724 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:476 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2200 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2544 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1284 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2584 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:616 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1272 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1040 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:940 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3036 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1144 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2176 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:476 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:792 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1484 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2948 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:744 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3060 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2428 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1468 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1380 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2824 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2228 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2828 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2064 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:624 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3020 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2536 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2328 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1768 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2464 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2784 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:624 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2204 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe65⤵
- Executes dropped EXE
PID:1180 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"66⤵PID:2560
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe67⤵PID:2988
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"68⤵PID:1504
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe69⤵PID:1248
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"70⤵PID:2852
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe71⤵PID:1316
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"72⤵PID:3040
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe73⤵PID:804
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"74⤵PID:1348
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe75⤵PID:1212
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"76⤵PID:624
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe77⤵PID:2856
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"78⤵PID:236
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe79⤵PID:644
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"80⤵PID:2832
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe81⤵PID:296
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"82⤵PID:1744
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe83⤵PID:2136
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"84⤵PID:2720
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe85⤵PID:2200
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"86⤵PID:2588
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe87⤵PID:2284
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"88⤵PID:1608
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe89⤵PID:2036
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"90⤵PID:1776
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe91⤵PID:872
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"92⤵PID:2808
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe93⤵PID:2604
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"94⤵PID:2408
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe95⤵PID:2108
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"96⤵PID:2632
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe97⤵PID:2676
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"98⤵PID:604
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe99⤵PID:744
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"100⤵PID:2180
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe101⤵PID:1780
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"102⤵PID:1520
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe103⤵PID:3024
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"104⤵PID:848
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe105⤵PID:2348
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"106⤵PID:2136
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe107⤵PID:1624
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"108⤵PID:1764
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe109⤵PID:1856
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"110⤵PID:2880
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe111⤵PID:1348
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"112⤵PID:2728
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe113⤵PID:1708
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"114⤵PID:3048
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe115⤵PID:2176
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"116⤵PID:740
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe117⤵PID:1776
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"118⤵PID:2416
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe119⤵PID:616
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"120⤵PID:1636
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe121⤵PID:1680
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"122⤵PID:1548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-