Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14/07/2024, 02:04
Static task
static1
Behavioral task
behavioral1
Sample
43dcf05478833250d15ba492cf1ca381_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
43dcf05478833250d15ba492cf1ca381_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
43dcf05478833250d15ba492cf1ca381_JaffaCakes118.exe
-
Size
80KB
-
MD5
43dcf05478833250d15ba492cf1ca381
-
SHA1
51a7df050834c19d7814a128d1b78ee133ce3e7f
-
SHA256
ffec80e33ca050c78c5af49a23b4943b68872b9bef75bbe75f4bf277fddec3f7
-
SHA512
14c81606af972ea7187efdecc3bc8dd1e299e41245f95134c3f522c6569b7f0292e862c986e956377db157f554c8943df82870fb3435aa7eddab186f07d38cae
-
SSDEEP
1536:C0FBV3gTCVEmMOet6HQHYnu3PpQ3aRhdsRxO4z:CWVe8EhO24nGPS3ajL4z
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\userinit.exe" userinit.exe -
Executes dropped EXE 64 IoCs
pid Process 2460 userinit.exe 2128 system.exe 2696 system.exe 2952 system.exe 2708 system.exe 2564 system.exe 2168 system.exe 2360 system.exe 1964 system.exe 1184 system.exe 1448 system.exe 2908 system.exe 2084 system.exe 2372 system.exe 408 system.exe 328 system.exe 1720 system.exe 924 system.exe 1864 system.exe 1572 system.exe 560 system.exe 2448 system.exe 1828 system.exe 2184 system.exe 2468 system.exe 784 system.exe 2672 system.exe 2752 system.exe 2844 system.exe 2712 system.exe 2608 system.exe 2832 system.exe 2168 system.exe 2368 system.exe 2104 system.exe 1964 system.exe 1240 system.exe 1624 system.exe 2932 system.exe 2400 system.exe 2248 system.exe 1144 system.exe 1008 system.exe 328 system.exe 1720 system.exe 2216 system.exe 1864 system.exe 2992 system.exe 2388 system.exe 552 system.exe 2200 system.exe 2624 system.exe 2900 system.exe 1604 system.exe 2804 system.exe 2740 system.exe 2584 system.exe 2744 system.exe 2576 system.exe 2000 system.exe 1508 system.exe 2852 system.exe 2364 system.exe 2724 system.exe -
Loads dropped DLL 64 IoCs
pid Process 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe 2460 userinit.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\system.exe userinit.exe File opened for modification C:\Windows\SysWOW64\system.exe userinit.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\userinit.exe 43dcf05478833250d15ba492cf1ca381_JaffaCakes118.exe File created C:\Windows\kdcoms.dll userinit.exe File created C:\Windows\userinit.exe 43dcf05478833250d15ba492cf1ca381_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 784 43dcf05478833250d15ba492cf1ca381_JaffaCakes118.exe 2460 userinit.exe 2460 userinit.exe 2128 system.exe 2460 userinit.exe 2696 system.exe 2460 userinit.exe 2952 system.exe 2460 userinit.exe 2708 system.exe 2460 userinit.exe 2564 system.exe 2460 userinit.exe 2168 system.exe 2460 userinit.exe 2360 system.exe 2460 userinit.exe 1964 system.exe 2460 userinit.exe 1184 system.exe 2460 userinit.exe 1448 system.exe 2460 userinit.exe 2908 system.exe 2460 userinit.exe 2084 system.exe 2460 userinit.exe 2372 system.exe 2460 userinit.exe 408 system.exe 2460 userinit.exe 328 system.exe 2460 userinit.exe 1720 system.exe 2460 userinit.exe 924 system.exe 2460 userinit.exe 1864 system.exe 2460 userinit.exe 1572 system.exe 2460 userinit.exe 560 system.exe 2460 userinit.exe 2448 system.exe 2460 userinit.exe 1828 system.exe 2460 userinit.exe 2184 system.exe 2460 userinit.exe 2468 system.exe 2460 userinit.exe 784 system.exe 2460 userinit.exe 2672 system.exe 2460 userinit.exe 2752 system.exe 2460 userinit.exe 2844 system.exe 2460 userinit.exe 2712 system.exe 2460 userinit.exe 2608 system.exe 2460 userinit.exe 2832 system.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2460 userinit.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 784 43dcf05478833250d15ba492cf1ca381_JaffaCakes118.exe 784 43dcf05478833250d15ba492cf1ca381_JaffaCakes118.exe 2460 userinit.exe 2460 userinit.exe 2128 system.exe 2128 system.exe 2696 system.exe 2696 system.exe 2952 system.exe 2952 system.exe 2708 system.exe 2708 system.exe 2564 system.exe 2564 system.exe 2168 system.exe 2168 system.exe 2360 system.exe 2360 system.exe 1964 system.exe 1964 system.exe 1184 system.exe 1184 system.exe 1448 system.exe 1448 system.exe 2908 system.exe 2908 system.exe 2084 system.exe 2084 system.exe 2372 system.exe 2372 system.exe 408 system.exe 408 system.exe 328 system.exe 328 system.exe 1720 system.exe 1720 system.exe 924 system.exe 924 system.exe 1864 system.exe 1864 system.exe 1572 system.exe 1572 system.exe 560 system.exe 560 system.exe 2448 system.exe 2448 system.exe 1828 system.exe 1828 system.exe 2184 system.exe 2184 system.exe 2468 system.exe 2468 system.exe 784 system.exe 784 system.exe 2672 system.exe 2672 system.exe 2752 system.exe 2752 system.exe 2844 system.exe 2844 system.exe 2712 system.exe 2712 system.exe 2608 system.exe 2608 system.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 784 wrote to memory of 2460 784 43dcf05478833250d15ba492cf1ca381_JaffaCakes118.exe 31 PID 784 wrote to memory of 2460 784 43dcf05478833250d15ba492cf1ca381_JaffaCakes118.exe 31 PID 784 wrote to memory of 2460 784 43dcf05478833250d15ba492cf1ca381_JaffaCakes118.exe 31 PID 784 wrote to memory of 2460 784 43dcf05478833250d15ba492cf1ca381_JaffaCakes118.exe 31 PID 2460 wrote to memory of 2128 2460 userinit.exe 32 PID 2460 wrote to memory of 2128 2460 userinit.exe 32 PID 2460 wrote to memory of 2128 2460 userinit.exe 32 PID 2460 wrote to memory of 2128 2460 userinit.exe 32 PID 2460 wrote to memory of 2696 2460 userinit.exe 33 PID 2460 wrote to memory of 2696 2460 userinit.exe 33 PID 2460 wrote to memory of 2696 2460 userinit.exe 33 PID 2460 wrote to memory of 2696 2460 userinit.exe 33 PID 2460 wrote to memory of 2952 2460 userinit.exe 34 PID 2460 wrote to memory of 2952 2460 userinit.exe 34 PID 2460 wrote to memory of 2952 2460 userinit.exe 34 PID 2460 wrote to memory of 2952 2460 userinit.exe 34 PID 2460 wrote to memory of 2708 2460 userinit.exe 35 PID 2460 wrote to memory of 2708 2460 userinit.exe 35 PID 2460 wrote to memory of 2708 2460 userinit.exe 35 PID 2460 wrote to memory of 2708 2460 userinit.exe 35 PID 2460 wrote to memory of 2564 2460 userinit.exe 36 PID 2460 wrote to memory of 2564 2460 userinit.exe 36 PID 2460 wrote to memory of 2564 2460 userinit.exe 36 PID 2460 wrote to memory of 2564 2460 userinit.exe 36 PID 2460 wrote to memory of 2168 2460 userinit.exe 37 PID 2460 wrote to memory of 2168 2460 userinit.exe 37 PID 2460 wrote to memory of 2168 2460 userinit.exe 37 PID 2460 wrote to memory of 2168 2460 userinit.exe 37 PID 2460 wrote to memory of 2360 2460 userinit.exe 38 PID 2460 wrote to memory of 2360 2460 userinit.exe 38 PID 2460 wrote to memory of 2360 2460 userinit.exe 38 PID 2460 wrote to memory of 2360 2460 userinit.exe 38 PID 2460 wrote to memory of 1964 2460 userinit.exe 39 PID 2460 wrote to memory of 1964 2460 userinit.exe 39 PID 2460 wrote to memory of 1964 2460 userinit.exe 39 PID 2460 wrote to memory of 1964 2460 userinit.exe 39 PID 2460 wrote to memory of 1184 2460 userinit.exe 40 PID 2460 wrote to memory of 1184 2460 userinit.exe 40 PID 2460 wrote to memory of 1184 2460 userinit.exe 40 PID 2460 wrote to memory of 1184 2460 userinit.exe 40 PID 2460 wrote to memory of 1448 2460 userinit.exe 41 PID 2460 wrote to memory of 1448 2460 userinit.exe 41 PID 2460 wrote to memory of 1448 2460 userinit.exe 41 PID 2460 wrote to memory of 1448 2460 userinit.exe 41 PID 2460 wrote to memory of 2908 2460 userinit.exe 42 PID 2460 wrote to memory of 2908 2460 userinit.exe 42 PID 2460 wrote to memory of 2908 2460 userinit.exe 42 PID 2460 wrote to memory of 2908 2460 userinit.exe 42 PID 2460 wrote to memory of 2084 2460 userinit.exe 43 PID 2460 wrote to memory of 2084 2460 userinit.exe 43 PID 2460 wrote to memory of 2084 2460 userinit.exe 43 PID 2460 wrote to memory of 2084 2460 userinit.exe 43 PID 2460 wrote to memory of 2372 2460 userinit.exe 44 PID 2460 wrote to memory of 2372 2460 userinit.exe 44 PID 2460 wrote to memory of 2372 2460 userinit.exe 44 PID 2460 wrote to memory of 2372 2460 userinit.exe 44 PID 2460 wrote to memory of 408 2460 userinit.exe 45 PID 2460 wrote to memory of 408 2460 userinit.exe 45 PID 2460 wrote to memory of 408 2460 userinit.exe 45 PID 2460 wrote to memory of 408 2460 userinit.exe 45 PID 2460 wrote to memory of 328 2460 userinit.exe 46 PID 2460 wrote to memory of 328 2460 userinit.exe 46 PID 2460 wrote to memory of 328 2460 userinit.exe 46 PID 2460 wrote to memory of 328 2460 userinit.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\43dcf05478833250d15ba492cf1ca381_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\43dcf05478833250d15ba492cf1ca381_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Windows\userinit.exeC:\Windows\userinit.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2128
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2696
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2952
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2708
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2564
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2168
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2360
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1964
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1184
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1448
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2908
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2084
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2372
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:408
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:328
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1720
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:924
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1864
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1572
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:560
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2448
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1828
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2184
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2468
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:784
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2672
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2752
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2844
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2712
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2608
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2832
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2168
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2368
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2104
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1964
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1240
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1624
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2932
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2400
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2248
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1144
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1008
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:328
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1720
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2216
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1864
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2992
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2388
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:552
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2200
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2624
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2900
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1604
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2804
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2740
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2584
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2744
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2576
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2000
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:1508
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2852
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2364
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
PID:2724
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1500
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:852
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2020
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2088
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2116
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1672
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:448
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:840
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:568
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:924
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2120
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1156
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1852
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1800
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2292
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:608
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2192
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:784
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2676
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2108
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2844
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2820
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:292
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2596
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1972
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2000
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1508
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1216
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2044
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:876
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1184
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:844
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1624
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2224
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2316
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2148
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1112
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:868
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1400
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:328
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1984
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1804
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1784
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2520
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2268
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2388
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:552
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2200
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1712
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2276
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2672
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2632
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1668
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1532
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2024
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2860
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1708
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:548
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1656
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1824
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2452
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2916
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2924
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2720
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:3040
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:964
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1980
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2976
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:892
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:3000
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2948
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2268
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2944
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:1580
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2516
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2648
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2812
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2700
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2656
-
-
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵PID:2568
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD543dcf05478833250d15ba492cf1ca381
SHA151a7df050834c19d7814a128d1b78ee133ce3e7f
SHA256ffec80e33ca050c78c5af49a23b4943b68872b9bef75bbe75f4bf277fddec3f7
SHA51214c81606af972ea7187efdecc3bc8dd1e299e41245f95134c3f522c6569b7f0292e862c986e956377db157f554c8943df82870fb3435aa7eddab186f07d38cae