Analysis
-
max time kernel
42s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 03:46
Behavioral task
behavioral1
Sample
4012045460206ff1153ee15c957874e5_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
4012045460206ff1153ee15c957874e5_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
4012045460206ff1153ee15c957874e5_JaffaCakes118.exe
-
Size
149KB
-
MD5
4012045460206ff1153ee15c957874e5
-
SHA1
e5ce8eb6ffd88418e52e9ba6c781939dc6760838
-
SHA256
5facb6ab81515930978b8aca1a70ff2c9a899b82b078f0a56108a64a37ea58e7
-
SHA512
18d28132d6a4017b260d9e6b6d2a2f22488eb767e577763fcbaa245b3cb748a8711ef32488584bf12fabf91c51b5094aea3ea8090fc6582718e878001420245a
-
SSDEEP
3072:vzYoutPgyj8gRXYhOLdhulE5Vuvy0VYZSagWM3ZP:bYoSPgQX1LSlQuvy0VYZkL
Score
8/10
Malware Config
Signatures
-
Disables use of System Restore points 1 TTPs
-
Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe File opened for modification C:\Windows\system32\drivers\etc\hosts mcvsvr.exe -
Deletes itself 1 IoCs
pid Process 2804 cmd.exe -
Executes dropped EXE 64 IoCs
pid Process 2732 mcvsvr.exe 1520 mcvsvr.exe 2200 mcvsvr.exe 1744 mcvsvr.exe 2996 mcvsvr.exe 2316 mcvsvr.exe 1636 mcvsvr.exe 2156 mcvsvr.exe 3020 mcvsvr.exe 2552 mcvsvr.exe 2364 mcvsvr.exe 2908 mcvsvr.exe 1524 mcvsvr.exe 2280 mcvsvr.exe 1596 mcvsvr.exe 1728 mcvsvr.exe 1520 mcvsvr.exe 2908 mcvsvr.exe 2448 mcvsvr.exe 1760 mcvsvr.exe 2896 mcvsvr.exe 1368 mcvsvr.exe 1988 mcvsvr.exe 2808 mcvsvr.exe 2536 mcvsvr.exe 1628 mcvsvr.exe 1572 mcvsvr.exe 3016 mcvsvr.exe 3060 mcvsvr.exe 2116 mcvsvr.exe 2652 mcvsvr.exe 2924 mcvsvr.exe 1384 mcvsvr.exe 3016 mcvsvr.exe 3060 mcvsvr.exe 2688 mcvsvr.exe 2452 mcvsvr.exe 2924 mcvsvr.exe 2332 mcvsvr.exe 2392 mcvsvr.exe 2932 mcvsvr.exe 900 mcvsvr.exe 1392 mcvsvr.exe 2848 mcvsvr.exe 1868 mcvsvr.exe 2828 mcvsvr.exe 932 mcvsvr.exe 2584 mcvsvr.exe 2140 mcvsvr.exe 1604 mcvsvr.exe 2600 mcvsvr.exe 2644 mcvsvr.exe 1988 mcvsvr.exe 2648 mcvsvr.exe 2160 mcvsvr.exe 1796 mcvsvr.exe 2600 mcvsvr.exe 668 mcvsvr.exe 2112 mcvsvr.exe 3048 mcvsvr.exe 2160 mcvsvr.exe 2928 mcvsvr.exe 2600 mcvsvr.exe 2060 mcvsvr.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe -
Loads dropped DLL 64 IoCs
pid Process 2968 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe 2968 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe 2732 mcvsvr.exe 2732 mcvsvr.exe 1520 mcvsvr.exe 1520 mcvsvr.exe 2200 mcvsvr.exe 2200 mcvsvr.exe 1744 mcvsvr.exe 1744 mcvsvr.exe 2996 mcvsvr.exe 2996 mcvsvr.exe 2316 mcvsvr.exe 2316 mcvsvr.exe 1636 mcvsvr.exe 1636 mcvsvr.exe 2156 mcvsvr.exe 2156 mcvsvr.exe 3020 mcvsvr.exe 3020 mcvsvr.exe 2552 mcvsvr.exe 2552 mcvsvr.exe 2364 mcvsvr.exe 2364 mcvsvr.exe 2908 mcvsvr.exe 2908 mcvsvr.exe 1524 mcvsvr.exe 1524 mcvsvr.exe 2280 mcvsvr.exe 2280 mcvsvr.exe 1596 mcvsvr.exe 1596 mcvsvr.exe 1728 mcvsvr.exe 1728 mcvsvr.exe 1520 mcvsvr.exe 1520 mcvsvr.exe 2908 mcvsvr.exe 2908 mcvsvr.exe 2448 mcvsvr.exe 2448 mcvsvr.exe 1760 mcvsvr.exe 1760 mcvsvr.exe 2896 mcvsvr.exe 2896 mcvsvr.exe 1368 mcvsvr.exe 1368 mcvsvr.exe 1988 mcvsvr.exe 1988 mcvsvr.exe 2808 mcvsvr.exe 2808 mcvsvr.exe 2536 mcvsvr.exe 2536 mcvsvr.exe 1628 mcvsvr.exe 1628 mcvsvr.exe 1572 mcvsvr.exe 1572 mcvsvr.exe 3016 mcvsvr.exe 3016 mcvsvr.exe 3060 mcvsvr.exe 3060 mcvsvr.exe 2116 mcvsvr.exe 2116 mcvsvr.exe 2652 mcvsvr.exe 2652 mcvsvr.exe -
resource yara_rule behavioral1/memory/2968-0-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/files/0x0007000000012119-5.dat upx behavioral1/memory/2968-11-0x0000000003100000-0x0000000003152000-memory.dmp upx behavioral1/memory/2732-16-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2968-17-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2732-29-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/1520-27-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/1520-39-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2200-40-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/1744-49-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2200-51-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/1744-60-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2996-61-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2996-71-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2316-69-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2316-79-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/1636-89-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2156-88-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2156-97-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/3020-98-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/3020-109-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2552-107-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2552-117-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2364-118-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2908-127-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2364-129-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/1524-136-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2908-138-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2280-147-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/1524-149-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/1596-153-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2280-154-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/1596-159-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/1728-164-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/1520-167-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2908-173-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2448-178-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/1760-182-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2896-183-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2896-189-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/1368-187-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/1368-194-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/1988-195-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/1988-201-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2808-200-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2808-207-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/1628-212-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2536-214-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/1628-218-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/1572-219-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/1572-225-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/3016-229-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/3060-230-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/3060-237-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2116-235-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2652-242-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2116-241-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2652-248-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/1384-255-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/2924-254-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/1384-262-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/3016-260-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/3016-268-0x0000000000010000-0x0000000000062000-memory.dmp upx behavioral1/memory/3060-266-0x0000000000010000-0x0000000000062000-memory.dmp upx -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\McAfee Internet Security = "mcvsvr.exe" mcvsvr.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File created C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe File opened for modification C:\Windows\SysWOW64\mcvsvr.exe mcvsvr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2968 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2732 mcvsvr.exe Token: SeIncBasePriorityPrivilege 1520 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2200 mcvsvr.exe Token: SeIncBasePriorityPrivilege 1744 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2996 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2316 mcvsvr.exe Token: SeIncBasePriorityPrivilege 1636 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2156 mcvsvr.exe Token: SeIncBasePriorityPrivilege 3020 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2552 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2364 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2908 mcvsvr.exe Token: SeIncBasePriorityPrivilege 1524 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2280 mcvsvr.exe Token: SeIncBasePriorityPrivilege 1596 mcvsvr.exe Token: SeIncBasePriorityPrivilege 1728 mcvsvr.exe Token: SeIncBasePriorityPrivilege 1520 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2908 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2448 mcvsvr.exe Token: SeIncBasePriorityPrivilege 1760 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2896 mcvsvr.exe Token: SeIncBasePriorityPrivilege 1368 mcvsvr.exe Token: SeIncBasePriorityPrivilege 1988 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2808 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2536 mcvsvr.exe Token: SeIncBasePriorityPrivilege 1628 mcvsvr.exe Token: SeIncBasePriorityPrivilege 1572 mcvsvr.exe Token: SeIncBasePriorityPrivilege 3016 mcvsvr.exe Token: SeIncBasePriorityPrivilege 3060 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2116 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2652 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2924 mcvsvr.exe Token: SeIncBasePriorityPrivilege 1384 mcvsvr.exe Token: SeIncBasePriorityPrivilege 3016 mcvsvr.exe Token: SeIncBasePriorityPrivilege 3060 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2688 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2452 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2924 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2332 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2392 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2932 mcvsvr.exe Token: SeIncBasePriorityPrivilege 900 mcvsvr.exe Token: SeIncBasePriorityPrivilege 1392 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2848 mcvsvr.exe Token: SeIncBasePriorityPrivilege 1868 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2828 mcvsvr.exe Token: SeIncBasePriorityPrivilege 932 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2584 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2140 mcvsvr.exe Token: SeIncBasePriorityPrivilege 1604 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2600 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2644 mcvsvr.exe Token: SeIncBasePriorityPrivilege 1988 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2648 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2160 mcvsvr.exe Token: SeIncBasePriorityPrivilege 1796 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2600 mcvsvr.exe Token: SeIncBasePriorityPrivilege 668 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2112 mcvsvr.exe Token: SeIncBasePriorityPrivilege 3048 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2160 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2928 mcvsvr.exe Token: SeIncBasePriorityPrivilege 2600 mcvsvr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2968 wrote to memory of 2732 2968 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe 30 PID 2968 wrote to memory of 2732 2968 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe 30 PID 2968 wrote to memory of 2732 2968 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe 30 PID 2968 wrote to memory of 2732 2968 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe 30 PID 2968 wrote to memory of 2836 2968 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe 31 PID 2968 wrote to memory of 2836 2968 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe 31 PID 2968 wrote to memory of 2836 2968 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe 31 PID 2968 wrote to memory of 2836 2968 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe 31 PID 2968 wrote to memory of 2744 2968 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe 32 PID 2968 wrote to memory of 2744 2968 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe 32 PID 2968 wrote to memory of 2744 2968 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe 32 PID 2968 wrote to memory of 2744 2968 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe 32 PID 2968 wrote to memory of 2728 2968 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe 33 PID 2968 wrote to memory of 2728 2968 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe 33 PID 2968 wrote to memory of 2728 2968 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe 33 PID 2968 wrote to memory of 2728 2968 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe 33 PID 2968 wrote to memory of 2488 2968 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe 34 PID 2968 wrote to memory of 2488 2968 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe 34 PID 2968 wrote to memory of 2488 2968 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe 34 PID 2968 wrote to memory of 2488 2968 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe 34 PID 2968 wrote to memory of 2804 2968 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe 35 PID 2968 wrote to memory of 2804 2968 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe 35 PID 2968 wrote to memory of 2804 2968 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe 35 PID 2968 wrote to memory of 2804 2968 4012045460206ff1153ee15c957874e5_JaffaCakes118.exe 35 PID 2732 wrote to memory of 1520 2732 mcvsvr.exe 41 PID 2732 wrote to memory of 1520 2732 mcvsvr.exe 41 PID 2732 wrote to memory of 1520 2732 mcvsvr.exe 41 PID 2732 wrote to memory of 1520 2732 mcvsvr.exe 41 PID 2732 wrote to memory of 2064 2732 mcvsvr.exe 42 PID 2732 wrote to memory of 2064 2732 mcvsvr.exe 42 PID 2732 wrote to memory of 2064 2732 mcvsvr.exe 42 PID 2732 wrote to memory of 2064 2732 mcvsvr.exe 42 PID 2732 wrote to memory of 328 2732 mcvsvr.exe 98 PID 2732 wrote to memory of 328 2732 mcvsvr.exe 98 PID 2732 wrote to memory of 328 2732 mcvsvr.exe 98 PID 2732 wrote to memory of 328 2732 mcvsvr.exe 98 PID 2732 wrote to memory of 1080 2732 mcvsvr.exe 44 PID 2732 wrote to memory of 1080 2732 mcvsvr.exe 44 PID 2732 wrote to memory of 1080 2732 mcvsvr.exe 44 PID 2732 wrote to memory of 1080 2732 mcvsvr.exe 44 PID 2732 wrote to memory of 1704 2732 mcvsvr.exe 45 PID 2732 wrote to memory of 1704 2732 mcvsvr.exe 45 PID 2732 wrote to memory of 1704 2732 mcvsvr.exe 45 PID 2732 wrote to memory of 1704 2732 mcvsvr.exe 45 PID 2732 wrote to memory of 2004 2732 mcvsvr.exe 47 PID 2732 wrote to memory of 2004 2732 mcvsvr.exe 47 PID 2732 wrote to memory of 2004 2732 mcvsvr.exe 47 PID 2732 wrote to memory of 2004 2732 mcvsvr.exe 47 PID 1520 wrote to memory of 2200 1520 mcvsvr.exe 52 PID 1520 wrote to memory of 2200 1520 mcvsvr.exe 52 PID 1520 wrote to memory of 2200 1520 mcvsvr.exe 52 PID 1520 wrote to memory of 2200 1520 mcvsvr.exe 52 PID 1520 wrote to memory of 2156 1520 mcvsvr.exe 107 PID 1520 wrote to memory of 2156 1520 mcvsvr.exe 107 PID 1520 wrote to memory of 2156 1520 mcvsvr.exe 107 PID 1520 wrote to memory of 2156 1520 mcvsvr.exe 107 PID 1520 wrote to memory of 1648 1520 mcvsvr.exe 113 PID 1520 wrote to memory of 1648 1520 mcvsvr.exe 113 PID 1520 wrote to memory of 1648 1520 mcvsvr.exe 113 PID 1520 wrote to memory of 1648 1520 mcvsvr.exe 113 PID 1520 wrote to memory of 1656 1520 mcvsvr.exe 111 PID 1520 wrote to memory of 1656 1520 mcvsvr.exe 111 PID 1520 wrote to memory of 1656 1520 mcvsvr.exe 111 PID 1520 wrote to memory of 1656 1520 mcvsvr.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\4012045460206ff1153ee15c957874e5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4012045460206ff1153ee15c957874e5_JaffaCakes118.exe"1⤵
- Impair Defenses: Safe Mode Boot
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2200 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1744 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2996 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"7⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2316 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1636 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2156 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"10⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:3020 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2552 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"12⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2364 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2908 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"14⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1524 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2280 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1596 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1728 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1520 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"19⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2908 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"20⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2448 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1760 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"22⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2896 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"23⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1368 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"24⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1988 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"25⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2808 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"26⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2536 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1628 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1572 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"29⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:3016 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"30⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3060 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"31⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2116 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"32⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2652 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2924 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"34⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1384 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3016 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"36⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3060 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"37⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2688 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2452 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2924 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"40⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2332 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2392 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"42⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2932 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:900 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"44⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1392 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"45⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2848 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"46⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1868 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"47⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2828 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"48⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:932 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2584 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"50⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2140 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"51⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1604 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2600 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2644 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"54⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1988 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2648 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"56⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2160 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"57⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1796 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"58⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2600 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:668 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"60⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2112 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3048 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2160 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"63⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2928 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2600 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"65⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
PID:2060 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"66⤵
- Adds Run key to start application
PID:3000 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"67⤵
- Drops file in Drivers directory
- Adds Run key to start application
PID:2708 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"68⤵
- Drops file in System32 directory
PID:804 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"69⤵
- Adds Run key to start application
PID:332 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"70⤵
- Drops file in Drivers directory
- Adds Run key to start application
PID:576 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"71⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:2060 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"72⤵PID:1696
-
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"73⤵
- Drops file in System32 directory
PID:1472 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"74⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
PID:1512 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"75⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
PID:2028 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"76⤵
- Drops file in Drivers directory
PID:576 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"77⤵
- Drops file in System32 directory
PID:2580 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"78⤵
- Drops file in System32 directory
PID:3068 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"79⤵
- Drops file in Drivers directory
PID:1864 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"80⤵
- Drops file in Drivers directory
- Adds Run key to start application
PID:1592 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"81⤵PID:1596
-
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"82⤵PID:576
-
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"83⤵PID:2364
-
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"84⤵
- Adds Run key to start application
PID:992 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"85⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:2408 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"86⤵
- Drops file in System32 directory
PID:2116 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"87⤵PID:2492
-
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"88⤵
- Drops file in Drivers directory
PID:576 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"89⤵
- Drops file in Drivers directory
PID:2840 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"90⤵
- Drops file in Drivers directory
PID:808 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"91⤵
- Drops file in Drivers directory
PID:3036 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"92⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:680 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"93⤵
- Drops file in Drivers directory
- Adds Run key to start application
PID:1536 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"94⤵
- Drops file in Drivers directory
PID:2928 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"95⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:2904 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"96⤵
- Adds Run key to start application
PID:1508 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"97⤵PID:1920
-
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"98⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
PID:2952 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"99⤵
- Drops file in Drivers directory
PID:1104 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"100⤵
- Drops file in Drivers directory
- Adds Run key to start application
PID:2864 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"101⤵PID:2316
-
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"102⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
PID:2888 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"103⤵
- Drops file in Drivers directory
PID:1920 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"104⤵
- Drops file in System32 directory
PID:2072 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"105⤵
- Drops file in System32 directory
PID:1620 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"106⤵
- Drops file in Drivers directory
- Drops file in System32 directory
PID:580 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"107⤵PID:3052
-
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"108⤵PID:1804
-
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"109⤵
- Adds Run key to start application
PID:1536 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"110⤵
- Drops file in Drivers directory
PID:2928 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"111⤵
- Drops file in Drivers directory
PID:1640 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"112⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:2760 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"113⤵
- Drops file in Drivers directory
PID:1808 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"114⤵
- Drops file in Drivers directory
- Drops file in System32 directory
PID:880 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"115⤵
- Drops file in Drivers directory
- Drops file in System32 directory
PID:2860 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"116⤵
- Drops file in Drivers directory
PID:1172 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"117⤵
- Drops file in System32 directory
PID:2920 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"118⤵PID:1112
-
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"119⤵
- Drops file in System32 directory
PID:1408 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"120⤵
- Drops file in Drivers directory
PID:2636 -
C:\Windows\SysWOW64\mcvsvr.exe"C:\Windows\system32\mcvsvr.exe"121⤵
- Drops file in Drivers directory
- Adds Run key to start application
PID:1816
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-