Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
12-07-2024 05:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3c2a0e83750ce5f730fc5d68bb22d93f_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
3c2a0e83750ce5f730fc5d68bb22d93f_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
3c2a0e83750ce5f730fc5d68bb22d93f_JaffaCakes118.exe
-
Size
22KB
-
MD5
3c2a0e83750ce5f730fc5d68bb22d93f
-
SHA1
525be3e7e672cea78e070f1480e3521da9694bdd
-
SHA256
78cb48d4f58ead0a1d6b9e20bccfd164c53a541f4476b3007b41087dea5f269b
-
SHA512
98c9ea640f0970902528be640d4ae0fcdde70a9dba5e47e63981be580cfbe47f3543c68cfd03d14b492f5dc35ce1b4c880357002b3f9b49dabb3143079d92549
-
SSDEEP
384:ypsSpg11+XCEuQ+M31f1AVe2NUwznHPPbMcYmszuK/UActaaKnhLIgL:aps8Cqxf1j2NUOoXzXTZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3140 mdm.exe 4792 mdm.exe 4260 mdm.exe 1332 mdm.exe 3856 mdm.exe 2432 mdm.exe 3388 mdm.exe 3960 mdm.exe 4516 mdm.exe 4332 mdm.exe 1656 mdm.exe 3252 mdm.exe 908 mdm.exe 4196 mdm.exe 2596 mdm.exe 2600 mdm.exe 1968 mdm.exe 4036 mdm.exe 2872 mdm.exe 812 mdm.exe 1912 mdm.exe 4536 mdm.exe 1516 mdm.exe 4212 mdm.exe 4068 mdm.exe 1436 mdm.exe 5088 mdm.exe 1812 mdm.exe 1040 mdm.exe 4828 mdm.exe 2256 mdm.exe 4752 mdm.exe 920 mdm.exe 1088 mdm.exe 3576 mdm.exe 4488 mdm.exe 2208 mdm.exe 1700 mdm.exe 2412 mdm.exe 2760 mdm.exe 440 mdm.exe 912 mdm.exe 2152 mdm.exe 1236 mdm.exe 1828 mdm.exe 1616 mdm.exe 1284 mdm.exe 372 mdm.exe 864 mdm.exe 3420 mdm.exe 4308 mdm.exe 2316 mdm.exe 2284 mdm.exe 380 mdm.exe 1232 mdm.exe 3528 mdm.exe 2864 mdm.exe 1652 mdm.exe 4200 mdm.exe 3340 mdm.exe 2188 mdm.exe 2640 mdm.exe 4444 mdm.exe 4072 mdm.exe -
resource yara_rule behavioral2/memory/2260-1-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2260-3-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2260-5-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4792-18-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1332-26-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2432-33-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3960-41-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4332-46-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3252-52-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4196-60-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2600-65-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4036-74-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/812-80-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4536-85-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4212-91-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1436-100-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1812-106-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4828-114-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1088-127-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4488-134-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1700-142-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4752-126-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2760-149-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/912-155-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1236-163-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1616-170-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/372-177-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3420-184-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2316-191-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/380-198-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3528-205-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1652-212-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3340-219-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2640-227-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4072-231-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1640-236-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4836-241-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1664-246-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/64-251-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1040-255-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/384-261-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1684-264-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2544-271-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2212-276-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1096-280-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1592-285-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3616-291-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4460-297-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/452-302-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3356-307-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4988-313-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2404-318-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3884-323-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3916-328-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1900-333-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4184-338-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/5068-343-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/5104-348-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1832-353-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3920-358-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4544-363-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/5028-368-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/368-371-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4308-378-0x0000000000400000-0x000000000044B000-memory.dmp upx -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\mdm.exe mdm.exe File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe mdm.exe File created C:\Windows\SysWOW64\mdm.exe mdm.exe File created C:\Windows\SysWOW64\mdm.exe mdm.exe File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe mdm.exe File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe mdm.exe File created C:\Windows\SysWOW64\mdm.exe mdm.exe File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe mdm.exe File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe mdm.exe File created C:\Windows\SysWOW64\mdm.exe mdm.exe File created C:\Windows\SysWOW64\mdm.exe mdm.exe File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe Process not Found File created C:\Windows\SysWOW64\mdm.exe mdm.exe File created C:\Windows\SysWOW64\mdm.exe Process not Found -
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 2316 set thread context of 2260 2316 3c2a0e83750ce5f730fc5d68bb22d93f_JaffaCakes118.exe 84 PID 3140 set thread context of 4792 3140 mdm.exe 87 PID 4260 set thread context of 1332 4260 mdm.exe 89 PID 3856 set thread context of 2432 3856 mdm.exe 91 PID 3388 set thread context of 3960 3388 mdm.exe 93 PID 4516 set thread context of 4332 4516 mdm.exe 95 PID 1656 set thread context of 3252 1656 mdm.exe 97 PID 908 set thread context of 4196 908 mdm.exe 99 PID 2596 set thread context of 2600 2596 mdm.exe 101 PID 1968 set thread context of 4036 1968 mdm.exe 103 PID 2872 set thread context of 812 2872 mdm.exe 105 PID 1912 set thread context of 4536 1912 mdm.exe 108 PID 1516 set thread context of 4212 1516 mdm.exe 110 PID 4068 set thread context of 1436 4068 mdm.exe 112 PID 5088 set thread context of 1812 5088 mdm.exe 114 PID 1040 set thread context of 4828 1040 mdm.exe 116 PID 2256 set thread context of 4752 2256 mdm.exe 118 PID 920 set thread context of 1088 920 mdm.exe 120 PID 3576 set thread context of 4488 3576 mdm.exe 122 PID 2208 set thread context of 1700 2208 mdm.exe 124 PID 2412 set thread context of 2760 2412 mdm.exe 126 PID 440 set thread context of 912 440 mdm.exe 128 PID 2152 set thread context of 1236 2152 mdm.exe 130 PID 1828 set thread context of 1616 1828 mdm.exe 132 PID 1284 set thread context of 372 1284 mdm.exe 134 PID 864 set thread context of 3420 864 mdm.exe 136 PID 4308 set thread context of 2316 4308 mdm.exe 138 PID 2284 set thread context of 380 2284 mdm.exe 140 PID 1232 set thread context of 3528 1232 mdm.exe 142 PID 2864 set thread context of 1652 2864 mdm.exe 144 PID 4200 set thread context of 3340 4200 mdm.exe 146 PID 2188 set thread context of 2640 2188 mdm.exe 148 PID 4444 set thread context of 4072 4444 mdm.exe 150 PID 4292 set thread context of 1640 4292 mdm.exe 152 PID 3392 set thread context of 4836 3392 mdm.exe 154 PID 4368 set thread context of 1664 4368 mdm.exe 156 PID 3472 set thread context of 64 3472 mdm.exe 158 PID 4688 set thread context of 1040 4688 mdm.exe 160 PID 1372 set thread context of 384 1372 mdm.exe 162 PID 1472 set thread context of 1684 1472 mdm.exe 164 PID 2768 set thread context of 2544 2768 mdm.exe 166 PID 4560 set thread context of 2212 4560 mdm.exe 168 PID 4948 set thread context of 1096 4948 mdm.exe 170 PID 3704 set thread context of 1592 3704 mdm.exe 172 PID 3052 set thread context of 3616 3052 mdm.exe 174 PID 3236 set thread context of 4460 3236 mdm.exe 176 PID 3256 set thread context of 452 3256 mdm.exe 178 PID 2428 set thread context of 3356 2428 mdm.exe 180 PID 3808 set thread context of 4988 3808 mdm.exe 182 PID 2000 set thread context of 2404 2000 mdm.exe 184 PID 1008 set thread context of 3884 1008 mdm.exe 186 PID 1484 set thread context of 3916 1484 mdm.exe 188 PID 2736 set thread context of 1900 2736 mdm.exe 190 PID 3232 set thread context of 4184 3232 mdm.exe 192 PID 5100 set thread context of 5068 5100 mdm.exe 194 PID 1456 set thread context of 5104 1456 mdm.exe 196 PID 4712 set thread context of 1832 4712 mdm.exe 198 PID 4520 set thread context of 3920 4520 mdm.exe 200 PID 444 set thread context of 4544 444 mdm.exe 202 PID 4344 set thread context of 5028 4344 mdm.exe 204 PID 2216 set thread context of 368 2216 mdm.exe 206 PID 4312 set thread context of 4308 4312 mdm.exe 208 PID 3204 set thread context of 5040 3204 mdm.exe 210 PID 5004 set thread context of 2308 5004 mdm.exe 212 -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2260 2316 3c2a0e83750ce5f730fc5d68bb22d93f_JaffaCakes118.exe 84 PID 2316 wrote to memory of 2260 2316 3c2a0e83750ce5f730fc5d68bb22d93f_JaffaCakes118.exe 84 PID 2316 wrote to memory of 2260 2316 3c2a0e83750ce5f730fc5d68bb22d93f_JaffaCakes118.exe 84 PID 2316 wrote to memory of 2260 2316 3c2a0e83750ce5f730fc5d68bb22d93f_JaffaCakes118.exe 84 PID 2316 wrote to memory of 2260 2316 3c2a0e83750ce5f730fc5d68bb22d93f_JaffaCakes118.exe 84 PID 2260 wrote to memory of 3140 2260 3c2a0e83750ce5f730fc5d68bb22d93f_JaffaCakes118.exe 86 PID 2260 wrote to memory of 3140 2260 3c2a0e83750ce5f730fc5d68bb22d93f_JaffaCakes118.exe 86 PID 2260 wrote to memory of 3140 2260 3c2a0e83750ce5f730fc5d68bb22d93f_JaffaCakes118.exe 86 PID 3140 wrote to memory of 4792 3140 mdm.exe 87 PID 3140 wrote to memory of 4792 3140 mdm.exe 87 PID 3140 wrote to memory of 4792 3140 mdm.exe 87 PID 3140 wrote to memory of 4792 3140 mdm.exe 87 PID 3140 wrote to memory of 4792 3140 mdm.exe 87 PID 4792 wrote to memory of 4260 4792 mdm.exe 88 PID 4792 wrote to memory of 4260 4792 mdm.exe 88 PID 4792 wrote to memory of 4260 4792 mdm.exe 88 PID 4260 wrote to memory of 1332 4260 mdm.exe 89 PID 4260 wrote to memory of 1332 4260 mdm.exe 89 PID 4260 wrote to memory of 1332 4260 mdm.exe 89 PID 4260 wrote to memory of 1332 4260 mdm.exe 89 PID 4260 wrote to memory of 1332 4260 mdm.exe 89 PID 1332 wrote to memory of 3856 1332 mdm.exe 90 PID 1332 wrote to memory of 3856 1332 mdm.exe 90 PID 1332 wrote to memory of 3856 1332 mdm.exe 90 PID 3856 wrote to memory of 2432 3856 mdm.exe 91 PID 3856 wrote to memory of 2432 3856 mdm.exe 91 PID 3856 wrote to memory of 2432 3856 mdm.exe 91 PID 3856 wrote to memory of 2432 3856 mdm.exe 91 PID 3856 wrote to memory of 2432 3856 mdm.exe 91 PID 2432 wrote to memory of 3388 2432 mdm.exe 92 PID 2432 wrote to memory of 3388 2432 mdm.exe 92 PID 2432 wrote to memory of 3388 2432 mdm.exe 92 PID 3388 wrote to memory of 3960 3388 mdm.exe 93 PID 3388 wrote to memory of 3960 3388 mdm.exe 93 PID 3388 wrote to memory of 3960 3388 mdm.exe 93 PID 3388 wrote to memory of 3960 3388 mdm.exe 93 PID 3388 wrote to memory of 3960 3388 mdm.exe 93 PID 3960 wrote to memory of 4516 3960 mdm.exe 94 PID 3960 wrote to memory of 4516 3960 mdm.exe 94 PID 3960 wrote to memory of 4516 3960 mdm.exe 94 PID 4516 wrote to memory of 4332 4516 mdm.exe 95 PID 4516 wrote to memory of 4332 4516 mdm.exe 95 PID 4516 wrote to memory of 4332 4516 mdm.exe 95 PID 4516 wrote to memory of 4332 4516 mdm.exe 95 PID 4516 wrote to memory of 4332 4516 mdm.exe 95 PID 4332 wrote to memory of 1656 4332 mdm.exe 96 PID 4332 wrote to memory of 1656 4332 mdm.exe 96 PID 4332 wrote to memory of 1656 4332 mdm.exe 96 PID 1656 wrote to memory of 3252 1656 mdm.exe 97 PID 1656 wrote to memory of 3252 1656 mdm.exe 97 PID 1656 wrote to memory of 3252 1656 mdm.exe 97 PID 1656 wrote to memory of 3252 1656 mdm.exe 97 PID 1656 wrote to memory of 3252 1656 mdm.exe 97 PID 3252 wrote to memory of 908 3252 mdm.exe 98 PID 3252 wrote to memory of 908 3252 mdm.exe 98 PID 3252 wrote to memory of 908 3252 mdm.exe 98 PID 908 wrote to memory of 4196 908 mdm.exe 99 PID 908 wrote to memory of 4196 908 mdm.exe 99 PID 908 wrote to memory of 4196 908 mdm.exe 99 PID 908 wrote to memory of 4196 908 mdm.exe 99 PID 908 wrote to memory of 4196 908 mdm.exe 99 PID 4196 wrote to memory of 2596 4196 mdm.exe 100 PID 4196 wrote to memory of 2596 4196 mdm.exe 100 PID 4196 wrote to memory of 2596 4196 mdm.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c2a0e83750ce5f730fc5d68bb22d93f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c2a0e83750ce5f730fc5d68bb22d93f_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\3c2a0e83750ce5f730fc5d68bb22d93f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3c2a0e83750ce5f730fc5d68bb22d93f_JaffaCakes118.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2596 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe18⤵
- Executes dropped EXE
PID:2600 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1968 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe20⤵
- Executes dropped EXE
PID:4036 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2872 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe22⤵
- Executes dropped EXE
PID:812 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1912 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe24⤵
- Executes dropped EXE
PID:4536 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1516 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe26⤵
- Executes dropped EXE
PID:4212 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4068 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe28⤵
- Executes dropped EXE
PID:1436 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5088 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe30⤵
- Executes dropped EXE
PID:1812 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1040 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe32⤵
- Executes dropped EXE
PID:4828 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2256 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe34⤵
- Executes dropped EXE
PID:4752 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:920 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe36⤵
- Executes dropped EXE
PID:1088 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3576 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe38⤵
- Executes dropped EXE
PID:4488 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2208 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe40⤵
- Executes dropped EXE
PID:1700 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2412 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe42⤵
- Executes dropped EXE
PID:2760 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:440 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:912 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2152 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe46⤵
- Executes dropped EXE
PID:1236 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1828 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe48⤵
- Executes dropped EXE
PID:1616 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1284 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe50⤵
- Executes dropped EXE
PID:372 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:864 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe52⤵
- Executes dropped EXE
PID:3420 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4308 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe54⤵
- Executes dropped EXE
PID:2316 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2284 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe56⤵
- Executes dropped EXE
PID:380 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1232 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe58⤵
- Executes dropped EXE
PID:3528 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2864 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe60⤵
- Executes dropped EXE
PID:1652 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4200 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe62⤵
- Executes dropped EXE
PID:3340 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"63⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2188 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe64⤵
- Executes dropped EXE
PID:2640 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"65⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4444 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe66⤵
- Executes dropped EXE
PID:4072 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"67⤵
- Suspicious use of SetThreadContext
PID:4292 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe68⤵PID:1640
-
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"69⤵
- Suspicious use of SetThreadContext
PID:3392 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe70⤵PID:4836
-
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"71⤵
- Suspicious use of SetThreadContext
PID:4368 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe72⤵PID:1664
-
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"73⤵
- Suspicious use of SetThreadContext
PID:3472 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe74⤵PID:64
-
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"75⤵
- Suspicious use of SetThreadContext
PID:4688 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe76⤵PID:1040
-
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"77⤵
- Suspicious use of SetThreadContext
PID:1372 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe78⤵PID:384
-
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"79⤵
- Suspicious use of SetThreadContext
PID:1472 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe80⤵PID:1684
-
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"81⤵
- Suspicious use of SetThreadContext
PID:2768 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe82⤵PID:2544
-
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"83⤵
- Suspicious use of SetThreadContext
PID:4560 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe84⤵PID:2212
-
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"85⤵
- Suspicious use of SetThreadContext
PID:4948 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe86⤵PID:1096
-
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"87⤵
- Suspicious use of SetThreadContext
PID:3704 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe88⤵PID:1592
-
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"89⤵
- Suspicious use of SetThreadContext
PID:3052 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe90⤵PID:3616
-
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"91⤵
- Suspicious use of SetThreadContext
PID:3236 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe92⤵PID:4460
-
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"93⤵
- Suspicious use of SetThreadContext
PID:3256 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe94⤵PID:452
-
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"95⤵
- Suspicious use of SetThreadContext
PID:2428 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe96⤵PID:3356
-
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"97⤵
- Suspicious use of SetThreadContext
PID:3808 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe98⤵
- Drops file in System32 directory
PID:4988 -
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"99⤵
- Suspicious use of SetThreadContext
PID:2000 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe100⤵PID:2404
-
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"101⤵
- Suspicious use of SetThreadContext
PID:1008 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe102⤵PID:3884
-
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"103⤵
- Suspicious use of SetThreadContext
PID:1484 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe104⤵PID:3916
-
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"105⤵
- Suspicious use of SetThreadContext
PID:2736 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe106⤵PID:1900
-
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"107⤵
- Suspicious use of SetThreadContext
PID:3232 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe108⤵PID:4184
-
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"109⤵
- Suspicious use of SetThreadContext
PID:5100 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe110⤵PID:5068
-
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"111⤵
- Suspicious use of SetThreadContext
PID:1456 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe112⤵PID:5104
-
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"113⤵
- Suspicious use of SetThreadContext
PID:4712 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe114⤵PID:1832
-
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"115⤵
- Suspicious use of SetThreadContext
PID:4520 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe116⤵PID:3920
-
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"117⤵
- Suspicious use of SetThreadContext
PID:444 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe118⤵PID:4544
-
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"119⤵
- Suspicious use of SetThreadContext
PID:4344 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe120⤵PID:5028
-
C:\Windows\SysWOW64\mdm.exe"C:\Windows\system32\mdm.exe"121⤵
- Suspicious use of SetThreadContext
PID:2216 -
C:\Windows\SysWOW64\mdm.exeC:\Windows\SysWOW64\mdm.exe122⤵PID:368
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-