Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04-07-2024 06:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe
-
Size
26KB
-
MD5
24ed9ee01ba3c03fc913deee79b6be7e
-
SHA1
e289553d5d1dba1a6e19926d01d53460425d5058
-
SHA256
c66ae62d7247e69f68fddc720d1a621b47120325b3de23c4e7fb6c671b7b912b
-
SHA512
5e050f6852dab1c04af1beb5daeb0d283d39daf9e69e4a55719937c581b35b6b16395dfc6635db311e5b68e21ba50fb185e32b01bb78480ee2c30e5000b301e5
-
SSDEEP
768:54HXLfu27edOT00khOPqs98ewanaX/mw/6xLI:5IpSdOT00k0qsGw6ewia
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3456 infocard.exe 2860 infocard.exe 4972 infocard.exe 3408 infocard.exe 628 infocard.exe 2940 infocard.exe 3400 infocard.exe 1752 infocard.exe 3572 infocard.exe 1984 infocard.exe 4224 infocard.exe 3348 infocard.exe 2328 infocard.exe 932 infocard.exe 1204 infocard.exe 1996 infocard.exe 4552 infocard.exe 2744 infocard.exe 3576 infocard.exe 2140 infocard.exe 4960 infocard.exe 2768 infocard.exe 3228 infocard.exe 940 infocard.exe 2084 infocard.exe 3136 infocard.exe 4692 infocard.exe 5088 infocard.exe 4500 infocard.exe 3184 infocard.exe 1688 infocard.exe 4564 infocard.exe 1172 infocard.exe 1884 infocard.exe 4328 infocard.exe 392 infocard.exe 4388 infocard.exe 5044 infocard.exe 4112 infocard.exe 4084 infocard.exe 1288 infocard.exe 3528 infocard.exe 848 infocard.exe 3968 infocard.exe 3708 infocard.exe 740 infocard.exe 2300 infocard.exe 924 infocard.exe 4164 infocard.exe 3384 infocard.exe 2820 infocard.exe 4880 infocard.exe 2384 infocard.exe 1892 infocard.exe 388 infocard.exe 2680 infocard.exe 4832 infocard.exe 2208 infocard.exe 212 infocard.exe 4288 infocard.exe 5116 infocard.exe 2068 infocard.exe 1304 infocard.exe 3324 infocard.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe infocard.exe File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe infocard.exe File created C:\Windows\SysWOW64\infocard.exe infocard.exe File created C:\Windows\SysWOW64\infocard.exe infocard.exe File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe infocard.exe File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe infocard.exe File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe infocard.exe File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe infocard.exe File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe infocard.exe File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe Process not Found File created C:\Windows\SysWOW64\infocard.exe infocard.exe File created C:\Windows\SysWOW64\infocard.exe infocard.exe File created C:\Windows\SysWOW64\infocard.exe infocard.exe File created C:\Windows\SysWOW64\infocard.exe infocard.exe -
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 4892 set thread context of 2972 4892 24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe 81 PID 3456 set thread context of 2860 3456 infocard.exe 83 PID 4972 set thread context of 3408 4972 infocard.exe 85 PID 628 set thread context of 2940 628 infocard.exe 87 PID 3400 set thread context of 1752 3400 infocard.exe 89 PID 3572 set thread context of 1984 3572 infocard.exe 91 PID 4224 set thread context of 3348 4224 infocard.exe 93 PID 2328 set thread context of 932 2328 infocard.exe 95 PID 1204 set thread context of 1996 1204 infocard.exe 97 PID 4552 set thread context of 2744 4552 infocard.exe 99 PID 3576 set thread context of 2140 3576 infocard.exe 101 PID 4960 set thread context of 2768 4960 infocard.exe 103 PID 3228 set thread context of 940 3228 infocard.exe 105 PID 2084 set thread context of 3136 2084 infocard.exe 107 PID 4692 set thread context of 5088 4692 infocard.exe 109 PID 4500 set thread context of 3184 4500 infocard.exe 111 PID 1688 set thread context of 4564 1688 infocard.exe 113 PID 1172 set thread context of 1884 1172 infocard.exe 115 PID 4328 set thread context of 392 4328 infocard.exe 117 PID 4388 set thread context of 5044 4388 infocard.exe 119 PID 4112 set thread context of 4084 4112 infocard.exe 121 PID 1288 set thread context of 3528 1288 infocard.exe 123 PID 848 set thread context of 3968 848 infocard.exe 125 PID 3708 set thread context of 740 3708 infocard.exe 127 PID 2300 set thread context of 924 2300 infocard.exe 129 PID 4164 set thread context of 3384 4164 infocard.exe 131 PID 2820 set thread context of 4880 2820 infocard.exe 134 PID 2384 set thread context of 1892 2384 infocard.exe 136 PID 388 set thread context of 2680 388 infocard.exe 138 PID 4832 set thread context of 2208 4832 infocard.exe 140 PID 212 set thread context of 4288 212 infocard.exe 142 PID 5116 set thread context of 2068 5116 infocard.exe 144 PID 1304 set thread context of 3324 1304 infocard.exe 146 PID 3948 set thread context of 4972 3948 infocard.exe 148 PID 4748 set thread context of 3680 4748 infocard.exe 150 PID 3204 set thread context of 4528 3204 infocard.exe 152 PID 4688 set thread context of 1900 4688 infocard.exe 154 PID 4852 set thread context of 1832 4852 infocard.exe 156 PID 5024 set thread context of 4580 5024 infocard.exe 158 PID 2328 set thread context of 1076 2328 infocard.exe 160 PID 3880 set thread context of 908 3880 infocard.exe 162 PID 1880 set thread context of 1472 1880 infocard.exe 164 PID 2132 set thread context of 4936 2132 infocard.exe 166 PID 3076 set thread context of 2204 3076 infocard.exe 168 PID 3124 set thread context of 3140 3124 infocard.exe 170 PID 4740 set thread context of 4188 4740 infocard.exe 172 PID 528 set thread context of 4056 528 infocard.exe 174 PID 548 set thread context of 1308 548 infocard.exe 176 PID 4180 set thread context of 4172 4180 infocard.exe 178 PID 3608 set thread context of 1744 3608 infocard.exe 180 PID 4328 set thread context of 2124 4328 infocard.exe 182 PID 4200 set thread context of 1284 4200 infocard.exe 184 PID 4112 set thread context of 2560 4112 infocard.exe 186 PID 4776 set thread context of 2256 4776 infocard.exe 188 PID 3468 set thread context of 2632 3468 infocard.exe 190 PID 2580 set thread context of 684 2580 infocard.exe 192 PID 2192 set thread context of 4980 2192 infocard.exe 194 PID 3108 set thread context of 8 3108 infocard.exe 196 PID 680 set thread context of 4124 680 infocard.exe 198 PID 3016 set thread context of 4700 3016 infocard.exe 200 PID 4572 set thread context of 1036 4572 infocard.exe 202 PID 4360 set thread context of 3452 4360 infocard.exe 204 PID 4272 set thread context of 212 4272 infocard.exe 206 PID 4488 set thread context of 3924 4488 infocard.exe 208 -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4892 wrote to memory of 2972 4892 24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe 81 PID 4892 wrote to memory of 2972 4892 24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe 81 PID 4892 wrote to memory of 2972 4892 24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe 81 PID 4892 wrote to memory of 2972 4892 24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe 81 PID 4892 wrote to memory of 2972 4892 24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe 81 PID 2972 wrote to memory of 3456 2972 24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe 82 PID 2972 wrote to memory of 3456 2972 24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe 82 PID 2972 wrote to memory of 3456 2972 24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe 82 PID 3456 wrote to memory of 2860 3456 infocard.exe 83 PID 3456 wrote to memory of 2860 3456 infocard.exe 83 PID 3456 wrote to memory of 2860 3456 infocard.exe 83 PID 3456 wrote to memory of 2860 3456 infocard.exe 83 PID 3456 wrote to memory of 2860 3456 infocard.exe 83 PID 2860 wrote to memory of 4972 2860 infocard.exe 84 PID 2860 wrote to memory of 4972 2860 infocard.exe 84 PID 2860 wrote to memory of 4972 2860 infocard.exe 84 PID 4972 wrote to memory of 3408 4972 infocard.exe 85 PID 4972 wrote to memory of 3408 4972 infocard.exe 85 PID 4972 wrote to memory of 3408 4972 infocard.exe 85 PID 4972 wrote to memory of 3408 4972 infocard.exe 85 PID 4972 wrote to memory of 3408 4972 infocard.exe 85 PID 3408 wrote to memory of 628 3408 infocard.exe 86 PID 3408 wrote to memory of 628 3408 infocard.exe 86 PID 3408 wrote to memory of 628 3408 infocard.exe 86 PID 628 wrote to memory of 2940 628 infocard.exe 87 PID 628 wrote to memory of 2940 628 infocard.exe 87 PID 628 wrote to memory of 2940 628 infocard.exe 87 PID 628 wrote to memory of 2940 628 infocard.exe 87 PID 628 wrote to memory of 2940 628 infocard.exe 87 PID 2940 wrote to memory of 3400 2940 infocard.exe 88 PID 2940 wrote to memory of 3400 2940 infocard.exe 88 PID 2940 wrote to memory of 3400 2940 infocard.exe 88 PID 3400 wrote to memory of 1752 3400 infocard.exe 89 PID 3400 wrote to memory of 1752 3400 infocard.exe 89 PID 3400 wrote to memory of 1752 3400 infocard.exe 89 PID 3400 wrote to memory of 1752 3400 infocard.exe 89 PID 3400 wrote to memory of 1752 3400 infocard.exe 89 PID 1752 wrote to memory of 3572 1752 infocard.exe 90 PID 1752 wrote to memory of 3572 1752 infocard.exe 90 PID 1752 wrote to memory of 3572 1752 infocard.exe 90 PID 3572 wrote to memory of 1984 3572 infocard.exe 91 PID 3572 wrote to memory of 1984 3572 infocard.exe 91 PID 3572 wrote to memory of 1984 3572 infocard.exe 91 PID 3572 wrote to memory of 1984 3572 infocard.exe 91 PID 3572 wrote to memory of 1984 3572 infocard.exe 91 PID 1984 wrote to memory of 4224 1984 infocard.exe 92 PID 1984 wrote to memory of 4224 1984 infocard.exe 92 PID 1984 wrote to memory of 4224 1984 infocard.exe 92 PID 4224 wrote to memory of 3348 4224 infocard.exe 93 PID 4224 wrote to memory of 3348 4224 infocard.exe 93 PID 4224 wrote to memory of 3348 4224 infocard.exe 93 PID 4224 wrote to memory of 3348 4224 infocard.exe 93 PID 4224 wrote to memory of 3348 4224 infocard.exe 93 PID 3348 wrote to memory of 2328 3348 infocard.exe 94 PID 3348 wrote to memory of 2328 3348 infocard.exe 94 PID 3348 wrote to memory of 2328 3348 infocard.exe 94 PID 2328 wrote to memory of 932 2328 infocard.exe 95 PID 2328 wrote to memory of 932 2328 infocard.exe 95 PID 2328 wrote to memory of 932 2328 infocard.exe 95 PID 2328 wrote to memory of 932 2328 infocard.exe 95 PID 2328 wrote to memory of 932 2328 infocard.exe 95 PID 932 wrote to memory of 1204 932 infocard.exe 96 PID 932 wrote to memory of 1204 932 infocard.exe 96 PID 932 wrote to memory of 1204 932 infocard.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\24ed9ee01ba3c03fc913deee79b6be7e_JaffaCakes118.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1204 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe18⤵
- Executes dropped EXE
PID:1996 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4552 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe20⤵
- Executes dropped EXE
PID:2744 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3576 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe22⤵
- Executes dropped EXE
PID:2140 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4960 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe24⤵
- Executes dropped EXE
PID:2768 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3228 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe26⤵
- Executes dropped EXE
PID:940 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2084 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe28⤵
- Executes dropped EXE
PID:3136 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4692 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe30⤵
- Executes dropped EXE
PID:5088 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4500 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe32⤵
- Executes dropped EXE
PID:3184 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1688 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe34⤵
- Executes dropped EXE
PID:4564 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1172 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe36⤵
- Executes dropped EXE
PID:1884 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4328 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe38⤵
- Executes dropped EXE
PID:392 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4388 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe40⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5044 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4112 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe42⤵
- Executes dropped EXE
PID:4084 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1288 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe44⤵
- Executes dropped EXE
PID:3528 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:848 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe46⤵
- Executes dropped EXE
PID:3968 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3708 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe48⤵
- Executes dropped EXE
PID:740 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2300 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe50⤵
- Executes dropped EXE
PID:924 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4164 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe52⤵
- Executes dropped EXE
PID:3384 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2820 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe54⤵
- Executes dropped EXE
PID:4880 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2384 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe56⤵
- Executes dropped EXE
PID:1892 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:388 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe58⤵
- Executes dropped EXE
PID:2680 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4832 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe60⤵
- Executes dropped EXE
PID:2208 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:212 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe62⤵
- Executes dropped EXE
PID:4288 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"63⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5116 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe64⤵
- Executes dropped EXE
PID:2068 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"65⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1304 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe66⤵
- Executes dropped EXE
PID:3324 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"67⤵
- Suspicious use of SetThreadContext
PID:3948 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe68⤵PID:4972
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"69⤵
- Suspicious use of SetThreadContext
PID:4748 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe70⤵PID:3680
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"71⤵
- Suspicious use of SetThreadContext
PID:3204 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe72⤵PID:4528
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"73⤵
- Suspicious use of SetThreadContext
PID:4688 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe74⤵PID:1900
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"75⤵
- Suspicious use of SetThreadContext
PID:4852 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe76⤵
- Drops file in System32 directory
PID:1832 -
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"77⤵
- Suspicious use of SetThreadContext
PID:5024 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe78⤵PID:4580
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"79⤵
- Suspicious use of SetThreadContext
PID:2328 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe80⤵PID:1076
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"81⤵
- Suspicious use of SetThreadContext
PID:3880 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe82⤵PID:908
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"83⤵
- Suspicious use of SetThreadContext
PID:1880 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe84⤵PID:1472
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"85⤵
- Suspicious use of SetThreadContext
PID:2132 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe86⤵PID:4936
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"87⤵
- Suspicious use of SetThreadContext
PID:3076 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe88⤵PID:2204
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"89⤵
- Suspicious use of SetThreadContext
PID:3124 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe90⤵PID:3140
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"91⤵
- Suspicious use of SetThreadContext
PID:4740 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe92⤵PID:4188
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"93⤵
- Suspicious use of SetThreadContext
PID:528 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe94⤵PID:4056
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"95⤵
- Suspicious use of SetThreadContext
PID:548 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe96⤵PID:1308
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"97⤵
- Suspicious use of SetThreadContext
PID:4180 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe98⤵PID:4172
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"99⤵
- Suspicious use of SetThreadContext
PID:3608 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe100⤵PID:1744
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"101⤵
- Suspicious use of SetThreadContext
PID:4328 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe102⤵PID:2124
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"103⤵
- Suspicious use of SetThreadContext
PID:4200 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe104⤵PID:1284
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"105⤵
- Suspicious use of SetThreadContext
PID:4112 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe106⤵PID:2560
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"107⤵
- Suspicious use of SetThreadContext
PID:4776 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe108⤵PID:2256
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"109⤵
- Suspicious use of SetThreadContext
PID:3468 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe110⤵PID:2632
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"111⤵
- Suspicious use of SetThreadContext
PID:2580 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe112⤵PID:684
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"113⤵
- Suspicious use of SetThreadContext
PID:2192 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe114⤵PID:4980
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"115⤵
- Suspicious use of SetThreadContext
PID:3108 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe116⤵PID:8
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"117⤵
- Suspicious use of SetThreadContext
PID:680 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe118⤵PID:4124
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"119⤵
- Suspicious use of SetThreadContext
PID:3016 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe120⤵PID:4700
-
C:\Windows\SysWOW64\infocard.exe"C:\Windows\system32\infocard.exe"121⤵
- Suspicious use of SetThreadContext
PID:4572 -
C:\Windows\SysWOW64\infocard.exeC:\Windows\SysWOW64\infocard.exe122⤵PID:1036
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-