Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 06:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe
Resource
win7-20240508-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe
Resource
win10v2004-20240508-en
4 signatures
150 seconds
General
-
Target
24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe
-
Size
26KB
-
MD5
24ed9ee01ba3c03fc913deee79b6be7e
-
SHA1
e289553d5d1dba1a6e19926d01d53460425d5058
-
SHA256
c66ae62d7247e69f68fddc720d1a621b47120325b3de23c4e7fb6c671b7b912b
-
SHA512
5e050f6852dab1c04af1beb5daeb0d283d39daf9e69e4a55719937c581b35b6b16395dfc6635db311e5b68e21ba50fb185e32b01bb78480ee2c30e5000b301e5
-
SSDEEP
768:54HXLfu27edOT00khOPqs98ewanaX/mw/6xLI:5IpSdOT00k0qsGw6ewia
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1740 infocard.exe 3040 infocard.exe 2840 infocard.exe 2644 infocard.exe 2832 infocard.exe 2544 infocard.exe 2768 infocard.exe 2812 infocard.exe 2568 infocard.exe 2980 infocard.exe 2988 infocard.exe 2588 infocard.exe 2760 infocard.exe 2872 infocard.exe 1980 infocard.exe 316 infocard.exe 1732 infocard.exe 1260 infocard.exe 2252 infocard.exe 328 infocard.exe 2740 infocard.exe 584 infocard.exe 348 infocard.exe 1636 infocard.exe 1708 infocard.exe 1540 infocard.exe 3036 infocard.exe 2696 infocard.exe 828 infocard.exe 568 infocard.exe 1836 infocard.exe 108 infocard.exe 2472 infocard.exe 2300 infocard.exe 2340 infocard.exe 1812 infocard.exe 1664 infocard.exe 2056 infocard.exe 1384 infocard.exe 796 infocard.exe 2604 infocard.exe 1696 infocard.exe 2156 infocard.exe 716 infocard.exe 2044 infocard.exe 2128 infocard.exe 1748 infocard.exe 1180 infocard.exe 2012 infocard.exe 2208 infocard.exe 1800 infocard.exe 1768 infocard.exe 2488 infocard.exe 1968 infocard.exe 1600 infocard.exe 1716 infocard.exe 3056 infocard.exe 2664 infocard.exe 3060 infocard.exe 2800 infocard.exe 2908 infocard.exe 2288 infocard.exe 3048 infocard.exe 2780 infocard.exe -
Loads dropped DLL 64 IoCs
pid Process 2040 24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe 2040 24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe 1740 infocard.exe 3040 infocard.exe 3040 infocard.exe 2840 infocard.exe 2644 infocard.exe 2644 infocard.exe 2832 infocard.exe 2544 infocard.exe 2544 infocard.exe 2768 infocard.exe 2812 infocard.exe 2812 infocard.exe 2568 infocard.exe 2980 infocard.exe 2980 infocard.exe 2988 infocard.exe 2588 infocard.exe 2588 infocard.exe 2760 infocard.exe 2872 infocard.exe 2872 infocard.exe 1980 infocard.exe 316 infocard.exe 316 infocard.exe 1732 infocard.exe 1260 infocard.exe 1260 infocard.exe 2252 infocard.exe 328 infocard.exe 328 infocard.exe 2740 infocard.exe 584 infocard.exe 584 infocard.exe 348 infocard.exe 1636 infocard.exe 1636 infocard.exe 1708 infocard.exe 1540 infocard.exe 1540 infocard.exe 2696 infocard.exe 2696 infocard.exe 568 infocard.exe 568 infocard.exe 108 infocard.exe 108 infocard.exe 2300 infocard.exe 2300 infocard.exe 1812 infocard.exe 1812 infocard.exe 2056 infocard.exe 2056 infocard.exe 796 infocard.exe 796 infocard.exe 1696 infocard.exe 1696 infocard.exe 716 infocard.exe 716 infocard.exe 2128 infocard.exe 2128 infocard.exe 1180 infocard.exe 1180 infocard.exe 2208 infocard.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe infocard.exe File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe infocard.exe File created C:\Windows\SysWOW64\infocard.exe infocard.exe File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe infocard.exe File created C:\Windows\SysWOW64\infocard.exe infocard.exe File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe infocard.exe File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe infocard.exe File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe infocard.exe File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe infocard.exe File created C:\Windows\SysWOW64\infocard.exe infocard.exe File created C:\Windows\SysWOW64\infocard.exe infocard.exe File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe infocard.exe File created C:\Windows\SysWOW64\infocard.exe Process not Found -
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 2116 set thread context of 2040 2116 24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe 28 PID 1740 set thread context of 3040 1740 infocard.exe 30 PID 2840 set thread context of 2644 2840 infocard.exe 32 PID 2832 set thread context of 2544 2832 infocard.exe 34 PID 2768 set thread context of 2812 2768 infocard.exe 36 PID 2568 set thread context of 2980 2568 infocard.exe 38 PID 2988 set thread context of 2588 2988 infocard.exe 40 PID 2760 set thread context of 2872 2760 infocard.exe 42 PID 1980 set thread context of 316 1980 infocard.exe 44 PID 1732 set thread context of 1260 1732 infocard.exe 46 PID 2252 set thread context of 328 2252 infocard.exe 48 PID 2740 set thread context of 584 2740 infocard.exe 50 PID 348 set thread context of 1636 348 infocard.exe 52 PID 1708 set thread context of 1540 1708 infocard.exe 54 PID 3036 set thread context of 2696 3036 infocard.exe 56 PID 828 set thread context of 568 828 infocard.exe 58 PID 1836 set thread context of 108 1836 infocard.exe 60 PID 2472 set thread context of 2300 2472 infocard.exe 62 PID 2340 set thread context of 1812 2340 infocard.exe 64 PID 1664 set thread context of 2056 1664 infocard.exe 66 PID 1384 set thread context of 796 1384 infocard.exe 68 PID 2604 set thread context of 1696 2604 infocard.exe 70 PID 2156 set thread context of 716 2156 infocard.exe 72 PID 2044 set thread context of 2128 2044 infocard.exe 74 PID 1748 set thread context of 1180 1748 infocard.exe 76 PID 2012 set thread context of 2208 2012 infocard.exe 78 PID 1800 set thread context of 1768 1800 infocard.exe 80 PID 2488 set thread context of 1968 2488 infocard.exe 82 PID 1600 set thread context of 1716 1600 infocard.exe 84 PID 3056 set thread context of 2664 3056 infocard.exe 86 PID 3060 set thread context of 2800 3060 infocard.exe 88 PID 2908 set thread context of 2288 2908 infocard.exe 90 PID 3048 set thread context of 2780 3048 infocard.exe 92 PID 2412 set thread context of 2552 2412 infocard.exe 94 PID 2512 set thread context of 2564 2512 infocard.exe 96 PID 2516 set thread context of 2976 2516 infocard.exe 98 PID 2220 set thread context of 2984 2220 infocard.exe 100 PID 2988 set thread context of 1648 2988 infocard.exe 102 PID 2836 set thread context of 2556 2836 infocard.exe 104 PID 2876 set thread context of 780 2876 infocard.exe 106 PID 1048 set thread context of 1460 1048 infocard.exe 108 PID 2492 set thread context of 1808 2492 infocard.exe 110 PID 824 set thread context of 2576 824 infocard.exe 112 PID 1976 set thread context of 868 1976 infocard.exe 114 PID 788 set thread context of 700 788 infocard.exe 116 PID 1168 set thread context of 1688 1168 infocard.exe 118 PID 2432 set thread context of 2616 2432 infocard.exe 120 PID 1684 set thread context of 2332 1684 infocard.exe 122 PID 2068 set thread context of 1264 2068 infocard.exe 124 PID 1880 set thread context of 1836 1880 infocard.exe 126 PID 1796 set thread context of 2388 1796 infocard.exe 128 PID 1764 set thread context of 1620 1764 infocard.exe 130 PID 1352 set thread context of 2924 1352 infocard.exe 132 PID 1396 set thread context of 1844 1396 infocard.exe 134 PID 2604 set thread context of 1016 2604 infocard.exe 136 PID 2940 set thread context of 2124 2940 infocard.exe 138 PID 2028 set thread context of 1520 2028 infocard.exe 140 PID 1616 set thread context of 2416 1616 infocard.exe 142 PID 904 set thread context of 1628 904 infocard.exe 144 PID 1568 set thread context of 1600 1568 infocard.exe 148 PID 1524 set thread context of 2992 1524 infocard.exe 150 PID 2304 set thread context of 2820 2304 infocard.exe 152 PID 2652 set thread context of 2776 2652 infocard.exe 154 PID 2624 set thread context of 2832 2624 infocard.exe 156 -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2040 2116 24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe 28 PID 2116 wrote to memory of 2040 2116 24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe 28 PID 2116 wrote to memory of 2040 2116 24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe 28 PID 2116 wrote to memory of 2040 2116 24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe 28 PID 2116 wrote to memory of 2040 2116 24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe 28 PID 2116 wrote to memory of 2040 2116 24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe 28 PID 2040 wrote to memory of 1740 2040 24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe 29 PID 2040 wrote to memory of 1740 2040 24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe 29 PID 2040 wrote to memory of 1740 2040 24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe 29 PID 2040 wrote to memory of 1740 2040 24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe 29 PID 1740 wrote to memory of 3040 1740 infocard.exe 30 PID 1740 wrote to memory of 3040 1740 infocard.exe 30 PID 1740 wrote to memory of 3040 1740 infocard.exe 30 PID 1740 wrote to memory of 3040 1740 infocard.exe 30 PID 1740 wrote to memory of 3040 1740 infocard.exe 30 PID 1740 wrote to memory of 3040 1740 infocard.exe 30 PID 3040 wrote to memory of 2840 3040 infocard.exe 31 PID 3040 wrote to memory of 2840 3040 infocard.exe 31 PID 3040 wrote to memory of 2840 3040 infocard.exe 31 PID 3040 wrote to memory of 2840 3040 infocard.exe 31 PID 2840 wrote to memory of 2644 2840 infocard.exe 32 PID 2840 wrote to memory of 2644 2840 infocard.exe 32 PID 2840 wrote to memory of 2644 2840 infocard.exe 32 PID 2840 wrote to memory of 2644 2840 infocard.exe 32 PID 2840 wrote to memory of 2644 2840 infocard.exe 32 PID 2840 wrote to memory of 2644 2840 infocard.exe 32 PID 2644 wrote to memory of 2832 2644 infocard.exe 33 PID 2644 wrote to memory of 2832 2644 infocard.exe 33 PID 2644 wrote to memory of 2832 2644 infocard.exe 33 PID 2644 wrote to memory of 2832 2644 infocard.exe 33 PID 2832 wrote to memory of 2544 2832 infocard.exe 34 PID 2832 wrote to memory of 2544 2832 infocard.exe 34 PID 2832 wrote to memory of 2544 2832 infocard.exe 34 PID 2832 wrote to memory of 2544 2832 infocard.exe 34 PID 2832 wrote to memory of 2544 2832 infocard.exe 34 PID 2832 wrote to memory of 2544 2832 infocard.exe 34 PID 2544 wrote to memory of 2768 2544 infocard.exe 35 PID 2544 wrote to memory of 2768 2544 infocard.exe 35 PID 2544 wrote to memory of 2768 2544 infocard.exe 35 PID 2544 wrote to memory of 2768 2544 infocard.exe 35 PID 2768 wrote to memory of 2812 2768 infocard.exe 36 PID 2768 wrote to memory of 2812 2768 infocard.exe 36 PID 2768 wrote to memory of 2812 2768 infocard.exe 36 PID 2768 wrote to memory of 2812 2768 infocard.exe 36 PID 2768 wrote to memory of 2812 2768 infocard.exe 36 PID 2768 wrote to memory of 2812 2768 infocard.exe 36 PID 2812 wrote to memory of 2568 2812 infocard.exe 37 PID 2812 wrote to memory of 2568 2812 infocard.exe 37 PID 2812 wrote to memory of 2568 2812 infocard.exe 37 PID 2812 wrote to memory of 2568 2812 infocard.exe 37 PID 2568 wrote to memory of 2980 2568 infocard.exe 38 PID 2568 wrote to memory of 2980 2568 infocard.exe 38 PID 2568 wrote to memory of 2980 2568 infocard.exe 38 PID 2568 wrote to memory of 2980 2568 infocard.exe 38 PID 2568 wrote to memory of 2980 2568 infocard.exe 38 PID 2568 wrote to memory of 2980 2568 infocard.exe 38 PID 2980 wrote to memory of 2988 2980 infocard.exe 39 PID 2980 wrote to memory of 2988 2980 infocard.exe 39 PID 2980 wrote to memory of 2988 2980 infocard.exe 39 PID 2980 wrote to memory of 2988 2980 infocard.exe 39 PID 2988 wrote to memory of 2588 2988 infocard.exe 40 PID 2988 wrote to memory of 2588 2988 infocard.exe 40 PID 2988 wrote to memory of 2588 2988 infocard.exe 40 PID 2988 wrote to memory of 2588 2988 infocard.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2760 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1980 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:316 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1732 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1260 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2252 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:328 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2740 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:584 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:348 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1708 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3036 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:828 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1836 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:108 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2472 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2340 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1664 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1384 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:796 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2604 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2156 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:716 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2044 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1748 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1180 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2012 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1800 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe54⤵
- Executes dropped EXE
PID:1768 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2488 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe56⤵
- Executes dropped EXE
PID:1968 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1600 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe58⤵
- Executes dropped EXE
PID:1716 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3056 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe60⤵
- Executes dropped EXE
PID:2664 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3060 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe62⤵
- Executes dropped EXE
PID:2800 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"63⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2908 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe64⤵
- Executes dropped EXE
PID:2288 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"65⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3048 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe66⤵
- Executes dropped EXE
PID:2780 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"67⤵
- Suspicious use of SetThreadContext
PID:2412 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe68⤵PID:2552
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"69⤵
- Suspicious use of SetThreadContext
PID:2512 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe70⤵PID:2564
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"71⤵
- Suspicious use of SetThreadContext
PID:2516 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe72⤵PID:2976
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"73⤵
- Suspicious use of SetThreadContext
PID:2220 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe74⤵PID:2984
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"75⤵
- Suspicious use of SetThreadContext
PID:2988 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe76⤵PID:1648
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"77⤵
- Suspicious use of SetThreadContext
PID:2836 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe78⤵PID:2556
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"79⤵
- Suspicious use of SetThreadContext
PID:2876 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe80⤵PID:780
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"81⤵
- Suspicious use of SetThreadContext
PID:1048 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe82⤵PID:1460
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"83⤵
- Suspicious use of SetThreadContext
PID:2492 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe84⤵PID:1808
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"85⤵
- Suspicious use of SetThreadContext
PID:824 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe86⤵PID:2576
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"87⤵
- Suspicious use of SetThreadContext
PID:1976 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe88⤵PID:868
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"89⤵
- Suspicious use of SetThreadContext
PID:788 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe90⤵
- Drops file in System32 directory
PID:700 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"91⤵
- Suspicious use of SetThreadContext
PID:1168 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe92⤵PID:1688
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"93⤵
- Suspicious use of SetThreadContext
PID:2432 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe94⤵PID:2616
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"95⤵
- Suspicious use of SetThreadContext
PID:1684 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe96⤵PID:2332
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"97⤵
- Suspicious use of SetThreadContext
PID:2068 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe98⤵PID:1264
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"99⤵
- Suspicious use of SetThreadContext
PID:1880 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe100⤵PID:1836
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"101⤵
- Suspicious use of SetThreadContext
PID:1796 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe102⤵PID:2388
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"103⤵
- Suspicious use of SetThreadContext
PID:1764 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe104⤵PID:1620
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"105⤵
- Suspicious use of SetThreadContext
PID:1352 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe106⤵PID:2924
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"107⤵
- Suspicious use of SetThreadContext
PID:1396 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe108⤵PID:1844
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"109⤵
- Suspicious use of SetThreadContext
PID:2604 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe110⤵PID:1016
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"111⤵
- Suspicious use of SetThreadContext
PID:2940 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe112⤵PID:2124
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"113⤵
- Suspicious use of SetThreadContext
PID:2028 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe114⤵PID:1520
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"115⤵
- Suspicious use of SetThreadContext
PID:1616 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe116⤵PID:2416
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"117⤵
- Suspicious use of SetThreadContext
PID:904 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe118⤵PID:1628
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"119⤵PID:1952
-
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe120⤵PID:2488
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"121⤵
- Suspicious use of SetThreadContext
PID:1568 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe122⤵PID:1600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-