Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 04:03
Static task
static1
Behavioral task
behavioral1
Sample
249148f74e2f1fe28f274d45f876b5cd_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
249148f74e2f1fe28f274d45f876b5cd_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
249148f74e2f1fe28f274d45f876b5cd_JaffaCakes118.exe
-
Size
496KB
-
MD5
249148f74e2f1fe28f274d45f876b5cd
-
SHA1
9f8411885962c8c92619bef3fc57f21c828bad42
-
SHA256
7d5ea8cb79035f9855711f891d0eb7be47033c43ace219e70f8bb5d51e3e0f7e
-
SHA512
a1ccd117b0a5fe0f23a9ff41cb09c2d4e4bce098020ac5e2220b1375a2d1a1d29f57d3f3a28ac72e0e742b77a3b61e4ffffe34a1650ab9417a562d9dbbeeabda
-
SSDEEP
6144:Dr3HjxgAJJej39c8SluXWAqlu/ol89tE16gEelSowQb3:Dr3HjpQ39c83E1EemQb3
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 90387.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Cerberus = "C:\\Windows\\system32\\catroot4\\winsvr32.exe" 90387.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 90387.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Cerberus = "C:\\Windows\\system32\\catroot4\\winsvr32.exe" 90387.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{T5TBB77L-4678-0MKC-421Q-14416031DYU6} 90387.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{T5TBB77L-4678-0MKC-421Q-14416031DYU6}\StubPath = "C:\\Windows\\system32\\catroot4\\winsvr32.exe Restart" 90387.exe -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation 90387.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation winsvr32.exe -
Executes dropped EXE 64 IoCs
pid Process 1800 90387.exe 1508 90387.exe 4076 winsvr32.exe 1560 winsvr32.exe 4392 winsvr32.exe 2500 winsvr32.exe 2564 winsvr32.exe 1924 winsvr32.exe 5080 winsvr32.exe 3220 winsvr32.exe 4276 winsvr32.exe 2056 winsvr32.exe 2716 winsvr32.exe 4296 winsvr32.exe 2972 winsvr32.exe 4440 winsvr32.exe 3208 winsvr32.exe 4344 winsvr32.exe 744 winsvr32.exe 3096 winsvr32.exe 4556 winsvr32.exe 3348 winsvr32.exe 5060 winsvr32.exe 1688 winsvr32.exe 4384 winsvr32.exe 2608 winsvr32.exe 1140 winsvr32.exe 4684 winsvr32.exe 1784 winsvr32.exe 3004 winsvr32.exe 940 winsvr32.exe 1692 winsvr32.exe 4084 winsvr32.exe 2980 winsvr32.exe 4296 winsvr32.exe 4324 winsvr32.exe 3496 winsvr32.exe 2184 winsvr32.exe 2980 winsvr32.exe 5052 winsvr32.exe 3888 winsvr32.exe 4824 winsvr32.exe 2936 winsvr32.exe 1920 winsvr32.exe 2028 winsvr32.exe 3488 winsvr32.exe 2472 winsvr32.exe 812 winsvr32.exe 2248 winsvr32.exe 3512 winsvr32.exe 1496 winsvr32.exe 3792 winsvr32.exe 2336 winsvr32.exe 680 winsvr32.exe 4544 winsvr32.exe 4408 winsvr32.exe 3792 winsvr32.exe 1224 winsvr32.exe 4600 winsvr32.exe 3476 winsvr32.exe 4608 winsvr32.exe 840 winsvr32.exe 5048 winsvr32.exe 4772 winsvr32.exe -
Loads dropped DLL 64 IoCs
pid Process 4944 winsvr32.exe 2920 winsvr32.exe 4472 winsvr32.exe 3756 winsvr32.exe 3236 winsvr32.exe 4384 winsvr32.exe 216 winsvr32.exe 4904 winsvr32.exe 1180 winsvr32.exe 2060 winsvr32.exe 2240 winsvr32.exe 2028 winsvr32.exe 4592 winsvr32.exe 4408 winsvr32.exe 4832 winsvr32.exe 2376 winsvr32.exe 4596 winsvr32.exe 2272 winsvr32.exe 4296 winsvr32.exe 4956 winsvr32.exe 4320 winsvr32.exe 2084 winsvr32.exe 2240 winsvr32.exe 4340 winsvr32.exe 3596 winsvr32.exe 4584 winsvr32.exe 4472 winsvr32.exe 1508 winsvr32.exe 2584 winsvr32.exe 4384 winsvr32.exe 3616 winsvr32.exe 3064 winsvr32.exe 3504 winsvr32.exe 4912 winsvr32.exe 2600 winsvr32.exe 2244 winsvr32.exe 1776 winsvr32.exe 5016 winsvr32.exe 3304 winsvr32.exe 4340 winsvr32.exe 2972 winsvr32.exe 3724 winsvr32.exe 3560 winsvr32.exe 3640 winsvr32.exe 3088 winsvr32.exe 2520 winsvr32.exe 2932 winsvr32.exe 2912 winsvr32.exe 4240 winsvr32.exe 3288 winsvr32.exe 4268 winsvr32.exe 1048 winsvr32.exe 4024 winsvr32.exe 1152 winsvr32.exe 3864 winsvr32.exe 5076 winsvr32.exe 2576 winsvr32.exe 4544 winsvr32.exe 3704 winsvr32.exe 684 winsvr32.exe 5016 winsvr32.exe 4904 winsvr32.exe 4676 winsvr32.exe 3968 winsvr32.exe -
resource yara_rule behavioral2/files/0x000a000000023422-9.dat upx behavioral2/memory/1800-10-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/1508-35-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/1508-67-0x0000000010410000-0x0000000010446000-memory.dmp upx behavioral2/memory/1508-94-0x0000000010410000-0x0000000010446000-memory.dmp upx behavioral2/memory/4076-79-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/1800-64-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/1508-62-0x0000000010410000-0x0000000010446000-memory.dmp upx behavioral2/memory/1800-58-0x0000000010410000-0x0000000010446000-memory.dmp upx behavioral2/memory/1800-11-0x0000000010410000-0x0000000010446000-memory.dmp upx behavioral2/memory/4076-147-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/1560-215-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2500-231-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2500-284-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/1924-299-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/1924-353-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/3220-421-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4276-437-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4276-490-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2056-505-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2056-559-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2716-575-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2716-628-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4296-644-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4296-697-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2972-765-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/3208-833-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/744-848-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/744-902-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/3096-917-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/3096-971-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4556-987-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4556-1040-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/3348-1108-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/5060-1176-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/1688-1192-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/1688-1245-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2608-1313-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/1140-1329-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/1140-1382-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4684-1398-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4684-1451-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/3004-1467-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/3004-1520-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/940-1535-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/940-1589-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4084-1605-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4084-1658-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2980-1673-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2980-1727-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4324-1743-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/4324-1796-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/3496-1812-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/3496-1865-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2184-1881-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2184-1934-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2980-2002-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/5052-2070-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/3888-2137-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2936-2151-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/2936-2204-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/1920-2219-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/1920-2271-0x0000000000400000-0x0000000000423000-memory.dmp upx behavioral2/memory/3488-2337-0x0000000000400000-0x0000000000423000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cerberus = "C:\\Windows\\system32\\catroot4\\winsvr32.exe" 90387.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cerberus = "C:\\Windows\\system32\\catroot4\\winsvr32.exe" 90387.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\catroot4\winsvr32.exe 90387.exe File opened for modification C:\Windows\SysWOW64\catroot4\winsvr32.exe 90387.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 2588 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1800 90387.exe Token: SeDebugPrivilege 1800 90387.exe Token: SeDebugPrivilege 2588 taskkill.exe Token: SeDebugPrivilege 4076 winsvr32.exe Token: SeDebugPrivilege 4076 winsvr32.exe Token: SeDebugPrivilege 1560 winsvr32.exe Token: SeDebugPrivilege 1560 winsvr32.exe Token: SeDebugPrivilege 2500 winsvr32.exe Token: SeDebugPrivilege 2500 winsvr32.exe Token: SeDebugPrivilege 1924 winsvr32.exe Token: SeDebugPrivilege 1924 winsvr32.exe Token: SeDebugPrivilege 3220 winsvr32.exe Token: SeDebugPrivilege 3220 winsvr32.exe Token: SeDebugPrivilege 4276 winsvr32.exe Token: SeDebugPrivilege 4276 winsvr32.exe Token: SeDebugPrivilege 2056 winsvr32.exe Token: SeDebugPrivilege 2056 winsvr32.exe Token: SeDebugPrivilege 2716 winsvr32.exe Token: SeDebugPrivilege 2716 winsvr32.exe Token: SeDebugPrivilege 4296 winsvr32.exe Token: SeDebugPrivilege 4296 winsvr32.exe Token: SeDebugPrivilege 2972 winsvr32.exe Token: SeDebugPrivilege 2972 winsvr32.exe Token: SeDebugPrivilege 3208 winsvr32.exe Token: SeDebugPrivilege 3208 winsvr32.exe Token: SeDebugPrivilege 744 winsvr32.exe Token: SeDebugPrivilege 744 winsvr32.exe Token: SeDebugPrivilege 3096 winsvr32.exe Token: SeDebugPrivilege 3096 winsvr32.exe Token: SeDebugPrivilege 4556 winsvr32.exe Token: SeDebugPrivilege 4556 winsvr32.exe Token: SeDebugPrivilege 3348 winsvr32.exe Token: SeDebugPrivilege 3348 winsvr32.exe Token: SeDebugPrivilege 5060 winsvr32.exe Token: SeDebugPrivilege 5060 winsvr32.exe Token: SeDebugPrivilege 1688 winsvr32.exe Token: SeDebugPrivilege 1688 winsvr32.exe Token: SeDebugPrivilege 2608 winsvr32.exe Token: SeDebugPrivilege 2608 winsvr32.exe Token: SeDebugPrivilege 1140 winsvr32.exe Token: SeDebugPrivilege 1140 winsvr32.exe Token: SeDebugPrivilege 4684 winsvr32.exe Token: SeDebugPrivilege 4684 winsvr32.exe Token: SeDebugPrivilege 3004 winsvr32.exe Token: SeDebugPrivilege 3004 winsvr32.exe Token: SeDebugPrivilege 940 winsvr32.exe Token: SeDebugPrivilege 940 winsvr32.exe Token: SeDebugPrivilege 4084 winsvr32.exe Token: SeDebugPrivilege 4084 winsvr32.exe Token: SeDebugPrivilege 2980 winsvr32.exe Token: SeDebugPrivilege 2980 winsvr32.exe Token: SeDebugPrivilege 4324 winsvr32.exe Token: SeDebugPrivilege 4324 winsvr32.exe Token: SeDebugPrivilege 3496 winsvr32.exe Token: SeDebugPrivilege 3496 winsvr32.exe Token: SeDebugPrivilege 2184 winsvr32.exe Token: SeDebugPrivilege 2184 winsvr32.exe Token: SeDebugPrivilege 2980 winsvr32.exe Token: SeDebugPrivilege 2980 winsvr32.exe Token: SeDebugPrivilege 5052 winsvr32.exe Token: SeDebugPrivilege 5052 winsvr32.exe Token: SeDebugPrivilege 3888 winsvr32.exe Token: SeDebugPrivilege 3888 winsvr32.exe Token: SeDebugPrivilege 2936 winsvr32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1808 wrote to memory of 1800 1808 249148f74e2f1fe28f274d45f876b5cd_JaffaCakes118.exe 81 PID 1808 wrote to memory of 1800 1808 249148f74e2f1fe28f274d45f876b5cd_JaffaCakes118.exe 81 PID 1808 wrote to memory of 1800 1808 249148f74e2f1fe28f274d45f876b5cd_JaffaCakes118.exe 81 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82 PID 1800 wrote to memory of 1508 1800 90387.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\249148f74e2f1fe28f274d45f876b5cd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\249148f74e2f1fe28f274d45f876b5cd_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\90387.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\90387.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\90387.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\90387.exe3⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1508 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4076 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe5⤵
- Loads dropped DLL
PID:4944 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1560 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe7⤵
- Executes dropped EXE
PID:4392 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2500 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe9⤵
- Checks computer location settings
- Executes dropped EXE
PID:2564 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1924 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe11⤵
- Executes dropped EXE
PID:5080 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3220 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe13⤵
- Loads dropped DLL
PID:2920 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4276 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe15⤵
- Checks computer location settings
- Loads dropped DLL
PID:4472 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2056 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe17⤵
- Loads dropped DLL
PID:3756 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2716 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe19⤵
- Checks computer location settings
- Loads dropped DLL
PID:3236 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4296 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe21⤵
- Checks computer location settings
- Loads dropped DLL
PID:4384 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2972 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe23⤵
- Checks computer location settings
- Executes dropped EXE
PID:4440 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3208 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe25⤵
- Executes dropped EXE
PID:4344 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:744 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe27⤵
- Loads dropped DLL
PID:216 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3096 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe29⤵
- Loads dropped DLL
PID:4904 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4556 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe31⤵
- Checks computer location settings
- Loads dropped DLL
PID:1180 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3348 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe33⤵
- Loads dropped DLL
PID:2060 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5060 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe35⤵
- Loads dropped DLL
PID:2240 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1688 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe37⤵
- Checks computer location settings
- Executes dropped EXE
PID:4384 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2608 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe39⤵
- Checks computer location settings
- Loads dropped DLL
PID:2028 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1140 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe41⤵
- Loads dropped DLL
PID:4592 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4684 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe43⤵
- Executes dropped EXE
PID:1784 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3004 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe45⤵
- Checks computer location settings
- Loads dropped DLL
PID:4408 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:940 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe47⤵
- Checks computer location settings
- Executes dropped EXE
PID:1692 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4084 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe49⤵
- Loads dropped DLL
PID:4832 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2980 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe51⤵
- Checks computer location settings
- Executes dropped EXE
PID:4296 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4324 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe53⤵
- Checks computer location settings
- Loads dropped DLL
PID:2376 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3496 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe55⤵
- Loads dropped DLL
PID:4596 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2184 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe57⤵
- Loads dropped DLL
PID:2272 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2980 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe59⤵
- Checks computer location settings
- Loads dropped DLL
PID:4296 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5052 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe61⤵
- Loads dropped DLL
PID:4956 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3888 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe63⤵
- Executes dropped EXE
PID:4824 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2936 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe65⤵
- Loads dropped DLL
PID:4320 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"66⤵
- Executes dropped EXE
PID:1920 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe67⤵
- Checks computer location settings
- Executes dropped EXE
PID:2028 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"68⤵
- Executes dropped EXE
PID:3488 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe69⤵
- Checks computer location settings
- Loads dropped DLL
PID:2084 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"70⤵
- Executes dropped EXE
PID:2472 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe71⤵
- Loads dropped DLL
PID:2240 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"72⤵
- Executes dropped EXE
PID:812 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe73⤵
- Checks computer location settings
- Loads dropped DLL
PID:4340 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"74⤵
- Executes dropped EXE
PID:2248 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe75⤵
- Loads dropped DLL
PID:3596 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"76⤵
- Executes dropped EXE
PID:3512 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe77⤵
- Loads dropped DLL
PID:4584 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"78⤵
- Executes dropped EXE
PID:1496 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe79⤵
- Checks computer location settings
- Loads dropped DLL
PID:4472 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"80⤵
- Executes dropped EXE
PID:3792 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe81⤵
- Checks computer location settings
- Loads dropped DLL
PID:1508 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"82⤵
- Executes dropped EXE
PID:2336 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe83⤵
- Loads dropped DLL
PID:2584 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"84⤵
- Executes dropped EXE
PID:680 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe85⤵
- Checks computer location settings
- Loads dropped DLL
PID:4384 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"86⤵
- Executes dropped EXE
PID:4544 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe87⤵
- Executes dropped EXE
PID:4408 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"88⤵
- Executes dropped EXE
PID:3792 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe89⤵
- Loads dropped DLL
PID:3616 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"90⤵
- Executes dropped EXE
PID:1224 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe91⤵
- Loads dropped DLL
PID:3064 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"92⤵
- Executes dropped EXE
PID:4600 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe93⤵
- Checks computer location settings
- Executes dropped EXE
PID:3476 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"94⤵
- Executes dropped EXE
PID:4608 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe95⤵
- Executes dropped EXE
PID:840 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"96⤵
- Executes dropped EXE
PID:5048 -
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe97⤵
- Executes dropped EXE
PID:4772 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"98⤵PID:2564
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe99⤵PID:4320
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"100⤵PID:4556
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe101⤵
- Checks computer location settings
PID:1516 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"102⤵PID:436
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe103⤵PID:4596
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"104⤵PID:4380
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe105⤵
- Checks computer location settings
- Loads dropped DLL
PID:3504 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"106⤵PID:3348
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe107⤵PID:872
-
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"108⤵PID:3704
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe109⤵
- Loads dropped DLL
PID:4912 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"110⤵PID:4604
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe111⤵
- Loads dropped DLL
PID:2600 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"112⤵PID:2736
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe113⤵
- Checks computer location settings
- Loads dropped DLL
PID:2244 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"114⤵PID:2916
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe115⤵
- Loads dropped DLL
PID:1776 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"116⤵PID:5080
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe117⤵
- Checks computer location settings
PID:4136 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"118⤵PID:3724
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe119⤵
- Loads dropped DLL
PID:5016 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"120⤵PID:1400
-
C:\Windows\SysWOW64\catroot4\winsvr32.exeC:\Windows\SysWOW64\catroot4\winsvr32.exe121⤵
- Loads dropped DLL
PID:3304 -
C:\Windows\SysWOW64\catroot4\winsvr32.exe"C:\Windows\system32\catroot4\winsvr32.exe"122⤵PID:3640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-