Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
14/07/2024, 16:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
46a0b724e29afa9aec3b6f68aa634cd0_JaffaCakes118.exe
Resource
win7-20240704-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
46a0b724e29afa9aec3b6f68aa634cd0_JaffaCakes118.exe
Resource
win10v2004-20240709-en
5 signatures
150 seconds
General
-
Target
46a0b724e29afa9aec3b6f68aa634cd0_JaffaCakes118.exe
-
Size
48KB
-
MD5
46a0b724e29afa9aec3b6f68aa634cd0
-
SHA1
eda78ed5e70f1555ee93a8f1f5034daf71738231
-
SHA256
35bd0dc4d8499b161761c8e21c317be00c10c659546721d66cafdd3bd2211dc7
-
SHA512
a99a216a58aad307057276276658813dbe94c9bd004d9ab7fdfa46d2ddcce43fb1b52c733d783215bd8aa488fa9ea022ea5e97f4975d36dac81bfb093588b211
-
SSDEEP
768:V98vr9CUFScrAY1Ak02Ztpk/rkoZdKikBPw8lMO90tYbJfY02UXNORE:V909icrN1AkZZtpfofK1PlhxbZY02m7
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1704 46a0b724e29afa9aec3b6f68aa634cd0_JaffaCakes118.exe 3060 msn32.exe 2060 msn32.exe 3672 msn32.exe 464 msn32.exe 408 msn32.exe 4964 msn32.exe 3696 msn32.exe 4612 msn32.exe 1744 msn32.exe 2988 msn32.exe 920 msn32.exe 3392 msn32.exe 2272 msn32.exe 4952 msn32.exe 1096 msn32.exe 2368 msn32.exe 2212 msn32.exe 3052 msn32.exe 2180 msn32.exe 5008 msn32.exe 3020 msn32.exe 1496 msn32.exe 2104 msn32.exe 4300 msn32.exe 916 msn32.exe 3124 msn32.exe 3080 msn32.exe 4552 msn32.exe 2188 msn32.exe 2500 msn32.exe 4456 msn32.exe 1900 msn32.exe 692 msn32.exe 2692 msn32.exe 1464 msn32.exe 1628 msn32.exe 944 msn32.exe 3016 msn32.exe 1384 msn32.exe 3716 msn32.exe 3256 msn32.exe 2208 msn32.exe 1832 msn32.exe 3688 msn32.exe 460 msn32.exe 760 msn32.exe 4076 msn32.exe 4608 msn32.exe 3796 msn32.exe 2148 msn32.exe 392 msn32.exe 2496 msn32.exe 5084 msn32.exe 4492 msn32.exe 448 msn32.exe 2204 msn32.exe 4956 msn32.exe 888 msn32.exe 2840 msn32.exe 2860 msn32.exe 4780 msn32.exe 2932 msn32.exe 3924 msn32.exe -
resource yara_rule behavioral2/memory/1704-2-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1704-3-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1704-4-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1704-6-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2060-17-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/464-26-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4964-37-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4612-44-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2988-53-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3392-62-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4952-70-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2368-76-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3052-83-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/5008-90-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1496-98-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4300-106-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3124-116-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2500-131-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4552-124-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1900-140-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2692-148-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1628-154-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3016-162-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3716-172-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2208-180-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3688-188-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/760-195-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4608-201-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2148-212-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2496-220-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4492-228-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2204-235-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/888-243-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2860-251-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2932-259-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2704-265-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1260-271-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1028-277-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2228-283-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4884-289-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2680-295-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3092-299-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4996-312-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3144-318-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2188-330-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3996-325-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2012-336-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3456-342-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/748-346-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4372-353-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4728-360-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4980-362-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3888-367-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/368-373-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3548-378-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1800-385-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4812-391-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2636-397-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4464-403-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2572-409-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3060-415-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4144-420-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4744-427-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4396-433-0x0000000000400000-0x000000000044B000-memory.dmp upx -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\msn32.exe Process not Found File created C:\Windows\SysWOW64\msn32.exe Process not Found File opened for modification C:\Windows\SysWOW64\msn32.exe Process not Found File opened for modification C:\Windows\SysWOW64\msn32.exe Process not Found File created C:\Windows\SysWOW64\msn32.exe Process not Found File opened for modification C:\Windows\SysWOW64\msn32.exe Process not Found File created C:\Windows\SysWOW64\msn32.exe msn32.exe File created C:\Windows\SysWOW64\msn32.exe msn32.exe File created C:\Windows\SysWOW64\msn32.exe msn32.exe File created C:\Windows\SysWOW64\msn32.exe Process not Found File created C:\Windows\SysWOW64\msn32.exe Process not Found File created C:\Windows\SysWOW64\msn32.exe msn32.exe File created C:\Windows\SysWOW64\msn32.exe Process not Found File opened for modification C:\Windows\SysWOW64\msn32.exe Process not Found File opened for modification C:\Windows\SysWOW64\msn32.exe msn32.exe File opened for modification C:\Windows\SysWOW64\msn32.exe Process not Found File opened for modification C:\Windows\SysWOW64\msn32.exe Process not Found File created C:\Windows\SysWOW64\msn32.exe Process not Found File created C:\Windows\SysWOW64\msn32.exe Process not Found File opened for modification C:\Windows\SysWOW64\msn32.exe Process not Found File opened for modification C:\Windows\SysWOW64\msn32.exe Process not Found File opened for modification C:\Windows\SysWOW64\msn32.exe Process not Found File created C:\Windows\SysWOW64\msn32.exe Process not Found File created C:\Windows\SysWOW64\msn32.exe msn32.exe File opened for modification C:\Windows\SysWOW64\msn32.exe msn32.exe File created C:\Windows\SysWOW64\msn32.exe Process not Found File created C:\Windows\SysWOW64\msn32.exe Process not Found File opened for modification C:\Windows\SysWOW64\msn32.exe Process not Found File created C:\Windows\SysWOW64\msn32.exe msn32.exe File created C:\Windows\SysWOW64\msn32.exe Process not Found File created C:\Windows\SysWOW64\msn32.exe Process not Found File opened for modification C:\Windows\SysWOW64\msn32.exe Process not Found File opened for modification C:\Windows\SysWOW64\msn32.exe Process not Found File opened for modification C:\Windows\SysWOW64\msn32.exe Process not Found File created C:\Windows\SysWOW64\msn32.exe Process not Found File created C:\Windows\SysWOW64\msn32.exe Process not Found File created C:\Windows\SysWOW64\msn32.exe Process not Found File created C:\Windows\SysWOW64\msn32.exe Process not Found File created C:\Windows\SysWOW64\msn32.exe Process not Found File opened for modification C:\Windows\SysWOW64\msn32.exe Process not Found File opened for modification C:\Windows\SysWOW64\msn32.exe Process not Found File created C:\Windows\SysWOW64\msn32.exe Process not Found File created C:\Windows\SysWOW64\msn32.exe Process not Found File opened for modification C:\Windows\SysWOW64\msn32.exe msn32.exe File opened for modification C:\Windows\SysWOW64\msn32.exe Process not Found File opened for modification C:\Windows\SysWOW64\msn32.exe Process not Found File created C:\Windows\SysWOW64\msn32.exe Process not Found File opened for modification C:\Windows\SysWOW64\msn32.exe Process not Found File opened for modification C:\Windows\SysWOW64\msn32.exe msn32.exe File created C:\Windows\SysWOW64\msn32.exe Process not Found File created C:\Windows\SysWOW64\msn32.exe Process not Found File created C:\Windows\SysWOW64\msn32.exe Process not Found File opened for modification C:\Windows\SysWOW64\msn32.exe msn32.exe File created C:\Windows\SysWOW64\msn32.exe Process not Found File opened for modification C:\Windows\SysWOW64\msn32.exe Process not Found File opened for modification C:\Windows\SysWOW64\msn32.exe Process not Found File created C:\Windows\SysWOW64\msn32.exe Process not Found File created C:\Windows\SysWOW64\msn32.exe Process not Found File created C:\Windows\SysWOW64\msn32.exe Process not Found File opened for modification C:\Windows\SysWOW64\msn32.exe msn32.exe File created C:\Windows\SysWOW64\msn32.exe Process not Found File created C:\Windows\SysWOW64\msn32.exe Process not Found File created C:\Windows\SysWOW64\msn32.exe Process not Found File opened for modification C:\Windows\SysWOW64\msn32.exe Process not Found -
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 3008 set thread context of 1704 3008 46a0b724e29afa9aec3b6f68aa634cd0_JaffaCakes118.exe 83 PID 3060 set thread context of 2060 3060 msn32.exe 85 PID 3672 set thread context of 464 3672 msn32.exe 87 PID 408 set thread context of 4964 408 msn32.exe 89 PID 3696 set thread context of 4612 3696 msn32.exe 91 PID 1744 set thread context of 2988 1744 msn32.exe 93 PID 920 set thread context of 3392 920 msn32.exe 95 PID 2272 set thread context of 4952 2272 msn32.exe 97 PID 1096 set thread context of 2368 1096 msn32.exe 100 PID 2212 set thread context of 3052 2212 msn32.exe 102 PID 2180 set thread context of 5008 2180 msn32.exe 104 PID 3020 set thread context of 1496 3020 msn32.exe 106 PID 2104 set thread context of 4300 2104 msn32.exe 108 PID 916 set thread context of 3124 916 msn32.exe 110 PID 3080 set thread context of 4552 3080 msn32.exe 112 PID 2188 set thread context of 2500 2188 msn32.exe 115 PID 4456 set thread context of 1900 4456 msn32.exe 117 PID 692 set thread context of 2692 692 msn32.exe 119 PID 1464 set thread context of 1628 1464 msn32.exe 121 PID 944 set thread context of 3016 944 msn32.exe 123 PID 1384 set thread context of 3716 1384 msn32.exe 125 PID 3256 set thread context of 2208 3256 msn32.exe 127 PID 1832 set thread context of 3688 1832 msn32.exe 130 PID 460 set thread context of 760 460 msn32.exe 132 PID 4076 set thread context of 4608 4076 msn32.exe 134 PID 3796 set thread context of 2148 3796 msn32.exe 136 PID 392 set thread context of 2496 392 msn32.exe 138 PID 5084 set thread context of 4492 5084 msn32.exe 140 PID 448 set thread context of 2204 448 msn32.exe 142 PID 4956 set thread context of 888 4956 msn32.exe 144 PID 2840 set thread context of 2860 2840 msn32.exe 146 PID 4780 set thread context of 2932 4780 msn32.exe 148 PID 3924 set thread context of 2704 3924 msn32.exe 150 PID 4416 set thread context of 1260 4416 msn32.exe 152 PID 4696 set thread context of 1028 4696 msn32.exe 154 PID 4712 set thread context of 2228 4712 msn32.exe 156 PID 864 set thread context of 4884 864 msn32.exe 158 PID 636 set thread context of 2680 636 msn32.exe 160 PID 2360 set thread context of 3092 2360 msn32.exe 162 PID 2264 set thread context of 4980 2264 msn32.exe 164 PID 4520 set thread context of 4996 4520 msn32.exe 166 PID 2384 set thread context of 3144 2384 msn32.exe 168 PID 524 set thread context of 3996 524 msn32.exe 170 PID 4116 set thread context of 2188 4116 msn32.exe 172 PID 2196 set thread context of 2012 2196 msn32.exe 174 PID 5112 set thread context of 3456 5112 msn32.exe 176 PID 4104 set thread context of 748 4104 msn32.exe 178 PID 4036 set thread context of 4372 4036 msn32.exe 180 PID 832 set thread context of 4728 832 msn32.exe 182 PID 1136 set thread context of 3888 1136 msn32.exe 184 PID 1188 set thread context of 368 1188 msn32.exe 186 PID 4588 set thread context of 3548 4588 msn32.exe 188 PID 2780 set thread context of 1800 2780 msn32.exe 190 PID 3000 set thread context of 4812 3000 msn32.exe 192 PID 1580 set thread context of 2636 1580 msn32.exe 194 PID 392 set thread context of 4464 392 msn32.exe 196 PID 4468 set thread context of 2572 4468 msn32.exe 198 PID 3380 set thread context of 3060 3380 msn32.exe 200 PID 2640 set thread context of 4144 2640 msn32.exe 202 PID 4640 set thread context of 4744 4640 msn32.exe 204 PID 3352 set thread context of 4396 3352 msn32.exe 206 PID 4788 set thread context of 1156 4788 msn32.exe 208 PID 2088 set thread context of 1376 2088 msn32.exe 210 PID 2468 set thread context of 1096 2468 msn32.exe 212 -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3008 wrote to memory of 1704 3008 46a0b724e29afa9aec3b6f68aa634cd0_JaffaCakes118.exe 83 PID 3008 wrote to memory of 1704 3008 46a0b724e29afa9aec3b6f68aa634cd0_JaffaCakes118.exe 83 PID 3008 wrote to memory of 1704 3008 46a0b724e29afa9aec3b6f68aa634cd0_JaffaCakes118.exe 83 PID 3008 wrote to memory of 1704 3008 46a0b724e29afa9aec3b6f68aa634cd0_JaffaCakes118.exe 83 PID 3008 wrote to memory of 1704 3008 46a0b724e29afa9aec3b6f68aa634cd0_JaffaCakes118.exe 83 PID 1704 wrote to memory of 3060 1704 46a0b724e29afa9aec3b6f68aa634cd0_JaffaCakes118.exe 84 PID 1704 wrote to memory of 3060 1704 46a0b724e29afa9aec3b6f68aa634cd0_JaffaCakes118.exe 84 PID 1704 wrote to memory of 3060 1704 46a0b724e29afa9aec3b6f68aa634cd0_JaffaCakes118.exe 84 PID 3060 wrote to memory of 2060 3060 msn32.exe 85 PID 3060 wrote to memory of 2060 3060 msn32.exe 85 PID 3060 wrote to memory of 2060 3060 msn32.exe 85 PID 3060 wrote to memory of 2060 3060 msn32.exe 85 PID 3060 wrote to memory of 2060 3060 msn32.exe 85 PID 2060 wrote to memory of 3672 2060 msn32.exe 86 PID 2060 wrote to memory of 3672 2060 msn32.exe 86 PID 2060 wrote to memory of 3672 2060 msn32.exe 86 PID 3672 wrote to memory of 464 3672 msn32.exe 87 PID 3672 wrote to memory of 464 3672 msn32.exe 87 PID 3672 wrote to memory of 464 3672 msn32.exe 87 PID 3672 wrote to memory of 464 3672 msn32.exe 87 PID 3672 wrote to memory of 464 3672 msn32.exe 87 PID 464 wrote to memory of 408 464 msn32.exe 88 PID 464 wrote to memory of 408 464 msn32.exe 88 PID 464 wrote to memory of 408 464 msn32.exe 88 PID 408 wrote to memory of 4964 408 msn32.exe 89 PID 408 wrote to memory of 4964 408 msn32.exe 89 PID 408 wrote to memory of 4964 408 msn32.exe 89 PID 408 wrote to memory of 4964 408 msn32.exe 89 PID 408 wrote to memory of 4964 408 msn32.exe 89 PID 4964 wrote to memory of 3696 4964 msn32.exe 90 PID 4964 wrote to memory of 3696 4964 msn32.exe 90 PID 4964 wrote to memory of 3696 4964 msn32.exe 90 PID 3696 wrote to memory of 4612 3696 msn32.exe 91 PID 3696 wrote to memory of 4612 3696 msn32.exe 91 PID 3696 wrote to memory of 4612 3696 msn32.exe 91 PID 3696 wrote to memory of 4612 3696 msn32.exe 91 PID 3696 wrote to memory of 4612 3696 msn32.exe 91 PID 4612 wrote to memory of 1744 4612 msn32.exe 92 PID 4612 wrote to memory of 1744 4612 msn32.exe 92 PID 4612 wrote to memory of 1744 4612 msn32.exe 92 PID 1744 wrote to memory of 2988 1744 msn32.exe 93 PID 1744 wrote to memory of 2988 1744 msn32.exe 93 PID 1744 wrote to memory of 2988 1744 msn32.exe 93 PID 1744 wrote to memory of 2988 1744 msn32.exe 93 PID 1744 wrote to memory of 2988 1744 msn32.exe 93 PID 2988 wrote to memory of 920 2988 msn32.exe 94 PID 2988 wrote to memory of 920 2988 msn32.exe 94 PID 2988 wrote to memory of 920 2988 msn32.exe 94 PID 920 wrote to memory of 3392 920 msn32.exe 95 PID 920 wrote to memory of 3392 920 msn32.exe 95 PID 920 wrote to memory of 3392 920 msn32.exe 95 PID 920 wrote to memory of 3392 920 msn32.exe 95 PID 920 wrote to memory of 3392 920 msn32.exe 95 PID 3392 wrote to memory of 2272 3392 msn32.exe 96 PID 3392 wrote to memory of 2272 3392 msn32.exe 96 PID 3392 wrote to memory of 2272 3392 msn32.exe 96 PID 2272 wrote to memory of 4952 2272 msn32.exe 97 PID 2272 wrote to memory of 4952 2272 msn32.exe 97 PID 2272 wrote to memory of 4952 2272 msn32.exe 97 PID 2272 wrote to memory of 4952 2272 msn32.exe 97 PID 2272 wrote to memory of 4952 2272 msn32.exe 97 PID 4952 wrote to memory of 1096 4952 msn32.exe 98 PID 4952 wrote to memory of 1096 4952 msn32.exe 98 PID 4952 wrote to memory of 1096 4952 msn32.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\46a0b724e29afa9aec3b6f68aa634cd0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\46a0b724e29afa9aec3b6f68aa634cd0_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\46a0b724e29afa9aec3b6f68aa634cd0_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\46a0b724e29afa9aec3b6f68aa634cd0_JaffaCakes118.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1096 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe18⤵
- Executes dropped EXE
PID:2368 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2212 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe20⤵
- Executes dropped EXE
PID:3052 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2180 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe22⤵
- Executes dropped EXE
PID:5008 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3020 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe24⤵
- Executes dropped EXE
PID:1496 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2104 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe26⤵
- Executes dropped EXE
PID:4300 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:916 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe28⤵
- Executes dropped EXE
PID:3124 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3080 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe30⤵
- Executes dropped EXE
PID:4552 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2188 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe32⤵
- Executes dropped EXE
PID:2500 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4456 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe34⤵
- Executes dropped EXE
PID:1900 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:692 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe36⤵
- Executes dropped EXE
PID:2692 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1464 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe38⤵
- Executes dropped EXE
PID:1628 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:944 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe40⤵
- Executes dropped EXE
PID:3016 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1384 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe42⤵
- Executes dropped EXE
PID:3716 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3256 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe44⤵
- Executes dropped EXE
PID:2208 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1832 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe46⤵
- Executes dropped EXE
PID:3688 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:460 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe48⤵
- Executes dropped EXE
PID:760 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4076 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe50⤵
- Executes dropped EXE
PID:4608 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3796 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe52⤵
- Executes dropped EXE
PID:2148 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:392 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe54⤵
- Executes dropped EXE
PID:2496 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5084 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe56⤵
- Executes dropped EXE
PID:4492 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:448 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe58⤵
- Executes dropped EXE
PID:2204 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4956 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe60⤵
- Executes dropped EXE
PID:888 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2840 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe62⤵
- Executes dropped EXE
PID:2860 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"63⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4780 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe64⤵
- Executes dropped EXE
PID:2932 -
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"65⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3924 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe66⤵PID:2704
-
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"67⤵
- Suspicious use of SetThreadContext
PID:4416 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe68⤵PID:1260
-
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"69⤵
- Suspicious use of SetThreadContext
PID:4696 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe70⤵PID:1028
-
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"71⤵
- Suspicious use of SetThreadContext
PID:4712 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe72⤵PID:2228
-
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"73⤵
- Suspicious use of SetThreadContext
PID:864 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe74⤵PID:4884
-
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"75⤵
- Suspicious use of SetThreadContext
PID:636 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe76⤵PID:2680
-
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"77⤵
- Suspicious use of SetThreadContext
PID:2360 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe78⤵PID:3092
-
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"79⤵
- Suspicious use of SetThreadContext
PID:2264 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe80⤵PID:4980
-
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"81⤵
- Suspicious use of SetThreadContext
PID:4520 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe82⤵PID:4996
-
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"83⤵
- Suspicious use of SetThreadContext
PID:2384 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe84⤵PID:3144
-
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"85⤵
- Suspicious use of SetThreadContext
PID:524 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe86⤵PID:3996
-
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"87⤵
- Suspicious use of SetThreadContext
PID:4116 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe88⤵PID:2188
-
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"89⤵
- Suspicious use of SetThreadContext
PID:2196 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe90⤵PID:2012
-
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"91⤵
- Suspicious use of SetThreadContext
PID:5112 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe92⤵PID:3456
-
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"93⤵
- Suspicious use of SetThreadContext
PID:4104 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe94⤵PID:748
-
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"95⤵
- Suspicious use of SetThreadContext
PID:4036 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe96⤵PID:4372
-
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"97⤵
- Suspicious use of SetThreadContext
PID:832 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe98⤵PID:4728
-
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"99⤵
- Suspicious use of SetThreadContext
PID:1136 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe100⤵PID:3888
-
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"101⤵
- Suspicious use of SetThreadContext
PID:1188 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe102⤵PID:368
-
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"103⤵
- Suspicious use of SetThreadContext
PID:4588 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe104⤵PID:3548
-
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"105⤵
- Suspicious use of SetThreadContext
PID:2780 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe106⤵PID:1800
-
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"107⤵
- Suspicious use of SetThreadContext
PID:3000 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe108⤵PID:4812
-
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"109⤵
- Suspicious use of SetThreadContext
PID:1580 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe110⤵PID:2636
-
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"111⤵
- Suspicious use of SetThreadContext
PID:392 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe112⤵PID:4464
-
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"113⤵
- Suspicious use of SetThreadContext
PID:4468 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe114⤵PID:2572
-
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"115⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
PID:3380 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe116⤵PID:3060
-
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"117⤵
- Suspicious use of SetThreadContext
PID:2640 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe118⤵PID:4144
-
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"119⤵
- Suspicious use of SetThreadContext
PID:4640 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe120⤵PID:4744
-
C:\Windows\SysWOW64\msn32.exe"C:\Windows\system32\msn32.exe"121⤵
- Suspicious use of SetThreadContext
PID:3352 -
C:\Windows\SysWOW64\msn32.exeC:\Windows\SysWOW64\msn32.exe122⤵PID:4396
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-