2f6642aa38f7e67db36a681f8c57b3f707c649265f43c6d16d186b48f2366341

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 23:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4bec172378979fc11eacb4d19136ce61_JaffaCakes118.exe
Size

72KB
MD5

4bec172378979fc11eacb4d19136ce61
SHA1

33a57acd5114cf20d3eec10b20b45412941bbba2
SHA256

2f6642aa38f7e67db36a681f8c57b3f707c649265f43c6d16d186b48f2366341
SHA512

744844defb670ec95c3a571eebc8f3c3950a12abf594c92f904bfcea7fa320930ff7f3f8c0bc0819321bb02ff3adc794c02bdecd87d58920742e1e84c8bb6181
SSDEEP

768:zSfZ6FdI9zT/EJ2EreVgPMRsQzOFrRvaz6:eh6Pk5yZaz

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2416	kerne1132.exe
2292	kerne1132.exe
2120	kerne1132.exe
2100	kerne1132.exe
2320	kerne1132.exe
2732	kerne1132.exe
2756	kerne1132.exe
2728	kerne1132.exe
2860	kerne1132.exe
2812	kerne1132.exe
2628	kerne1132.exe
2776	kerne1132.exe
2604	kerne1132.exe
2636	kerne1132.exe
276	kerne1132.exe
2136	kerne1132.exe
1652	kerne1132.exe
2592	kerne1132.exe
2920	kerne1132.exe
1324	kerne1132.exe
616	kerne1132.exe
840	kerne1132.exe
2032	kerne1132.exe
2428	kerne1132.exe
492	kerne1132.exe
1864	kerne1132.exe
1476	kerne1132.exe
2088	kerne1132.exe
1724	kerne1132.exe
1684	kerne1132.exe
548	kerne1132.exe
2940	kerne1132.exe
3048	kerne1132.exe
2964	kerne1132.exe
2908	kerne1132.exe
2268	kerne1132.exe
2244	kerne1132.exe
2644	kerne1132.exe
2240	kerne1132.exe
2256	kerne1132.exe
2480	kerne1132.exe
2540	kerne1132.exe
3060	kerne1132.exe
1904	kerne1132.exe
1920	kerne1132.exe
1132	kerne1132.exe
1896	kerne1132.exe
2236	kerne1132.exe
1296	kerne1132.exe
1376	kerne1132.exe
1080	kerne1132.exe
2568	kerne1132.exe
900	kerne1132.exe
2432	kerne1132.exe
1088	kerne1132.exe
2152	kerne1132.exe
2476	kerne1132.exe
1732	kerne1132.exe
1352	kerne1132.exe
1520	kerne1132.exe
2336	kerne1132.exe
2156	kerne1132.exe
964	kerne1132.exe
1860	kerne1132.exe

Loads dropped DLL 64 IoCs

pid	Process
2580	4bec172378979fc11eacb4d19136ce61_JaffaCakes118.exe
2580	4bec172378979fc11eacb4d19136ce61_JaffaCakes118.exe
2416	kerne1132.exe
2416	kerne1132.exe
2292	kerne1132.exe
2292	kerne1132.exe
2120	kerne1132.exe
2120	kerne1132.exe
2100	kerne1132.exe
2100	kerne1132.exe
2320	kerne1132.exe
2320	kerne1132.exe
2732	kerne1132.exe
2732	kerne1132.exe
2756	kerne1132.exe
2756	kerne1132.exe
2728	kerne1132.exe
2728	kerne1132.exe
2860	kerne1132.exe
2860	kerne1132.exe
2812	kerne1132.exe
2812	kerne1132.exe
2628	kerne1132.exe
2628	kerne1132.exe
2776	kerne1132.exe
2776	kerne1132.exe
2604	kerne1132.exe
2604	kerne1132.exe
2636	kerne1132.exe
2636	kerne1132.exe
276	kerne1132.exe
276	kerne1132.exe
2136	kerne1132.exe
2136	kerne1132.exe
1652	kerne1132.exe
1652	kerne1132.exe
2592	kerne1132.exe
2592	kerne1132.exe
2920	kerne1132.exe
2920	kerne1132.exe
1324	kerne1132.exe
1324	kerne1132.exe
616	kerne1132.exe
616	kerne1132.exe
840	kerne1132.exe
840	kerne1132.exe
2032	kerne1132.exe
2032	kerne1132.exe
2428	kerne1132.exe
2428	kerne1132.exe
492	kerne1132.exe
492	kerne1132.exe
1864	kerne1132.exe
1864	kerne1132.exe
1476	kerne1132.exe
1476	kerne1132.exe
2088	kerne1132.exe
2088	kerne1132.exe
1724	kerne1132.exe
1724	kerne1132.exe
1684	kerne1132.exe
1684	kerne1132.exe
548	kerne1132.exe
548	kerne1132.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File opened for modification	C:\Windows\SysWOW64\kerne1132.exe	4bec172378979fc11eacb4d19136ce61_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe
File created	C:\Windows\SysWOW64\kerne1132.exe	kerne1132.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2416	2580	4bec172378979fc11eacb4d19136ce61_JaffaCakes118.exe	30
PID 2580 wrote to memory of 2416	2580	4bec172378979fc11eacb4d19136ce61_JaffaCakes118.exe	30
PID 2580 wrote to memory of 2416	2580	4bec172378979fc11eacb4d19136ce61_JaffaCakes118.exe	30
PID 2580 wrote to memory of 2416	2580	4bec172378979fc11eacb4d19136ce61_JaffaCakes118.exe	30
PID 2416 wrote to memory of 2292	2416	kerne1132.exe	31
PID 2416 wrote to memory of 2292	2416	kerne1132.exe	31
PID 2416 wrote to memory of 2292	2416	kerne1132.exe	31
PID 2416 wrote to memory of 2292	2416	kerne1132.exe	31
PID 2292 wrote to memory of 2120	2292	kerne1132.exe	32
PID 2292 wrote to memory of 2120	2292	kerne1132.exe	32
PID 2292 wrote to memory of 2120	2292	kerne1132.exe	32
PID 2292 wrote to memory of 2120	2292	kerne1132.exe	32
PID 2120 wrote to memory of 2100	2120	kerne1132.exe	33
PID 2120 wrote to memory of 2100	2120	kerne1132.exe	33
PID 2120 wrote to memory of 2100	2120	kerne1132.exe	33
PID 2120 wrote to memory of 2100	2120	kerne1132.exe	33
PID 2100 wrote to memory of 2320	2100	kerne1132.exe	34
PID 2100 wrote to memory of 2320	2100	kerne1132.exe	34
PID 2100 wrote to memory of 2320	2100	kerne1132.exe	34
PID 2100 wrote to memory of 2320	2100	kerne1132.exe	34
PID 2320 wrote to memory of 2732	2320	kerne1132.exe	35
PID 2320 wrote to memory of 2732	2320	kerne1132.exe	35
PID 2320 wrote to memory of 2732	2320	kerne1132.exe	35
PID 2320 wrote to memory of 2732	2320	kerne1132.exe	35
PID 2732 wrote to memory of 2756	2732	kerne1132.exe	37
PID 2732 wrote to memory of 2756	2732	kerne1132.exe	37
PID 2732 wrote to memory of 2756	2732	kerne1132.exe	37
PID 2732 wrote to memory of 2756	2732	kerne1132.exe	37
PID 2756 wrote to memory of 2728	2756	kerne1132.exe	38
PID 2756 wrote to memory of 2728	2756	kerne1132.exe	38
PID 2756 wrote to memory of 2728	2756	kerne1132.exe	38
PID 2756 wrote to memory of 2728	2756	kerne1132.exe	38
PID 2728 wrote to memory of 2860	2728	kerne1132.exe	39
PID 2728 wrote to memory of 2860	2728	kerne1132.exe	39
PID 2728 wrote to memory of 2860	2728	kerne1132.exe	39
PID 2728 wrote to memory of 2860	2728	kerne1132.exe	39
PID 2860 wrote to memory of 2812	2860	kerne1132.exe	40
PID 2860 wrote to memory of 2812	2860	kerne1132.exe	40
PID 2860 wrote to memory of 2812	2860	kerne1132.exe	40
PID 2860 wrote to memory of 2812	2860	kerne1132.exe	40
PID 2812 wrote to memory of 2628	2812	kerne1132.exe	41
PID 2812 wrote to memory of 2628	2812	kerne1132.exe	41
PID 2812 wrote to memory of 2628	2812	kerne1132.exe	41
PID 2812 wrote to memory of 2628	2812	kerne1132.exe	41
PID 2628 wrote to memory of 2776	2628	kerne1132.exe	42
PID 2628 wrote to memory of 2776	2628	kerne1132.exe	42
PID 2628 wrote to memory of 2776	2628	kerne1132.exe	42
PID 2628 wrote to memory of 2776	2628	kerne1132.exe	42
PID 2776 wrote to memory of 2604	2776	kerne1132.exe	43
PID 2776 wrote to memory of 2604	2776	kerne1132.exe	43
PID 2776 wrote to memory of 2604	2776	kerne1132.exe	43
PID 2776 wrote to memory of 2604	2776	kerne1132.exe	43
PID 2604 wrote to memory of 2636	2604	kerne1132.exe	44
PID 2604 wrote to memory of 2636	2604	kerne1132.exe	44
PID 2604 wrote to memory of 2636	2604	kerne1132.exe	44
PID 2604 wrote to memory of 2636	2604	kerne1132.exe	44
PID 2636 wrote to memory of 276	2636	kerne1132.exe	45
PID 2636 wrote to memory of 276	2636	kerne1132.exe	45
PID 2636 wrote to memory of 276	2636	kerne1132.exe	45
PID 2636 wrote to memory of 276	2636	kerne1132.exe	45
PID 276 wrote to memory of 2136	276	kerne1132.exe	46
PID 276 wrote to memory of 2136	276	kerne1132.exe	46
PID 276 wrote to memory of 2136	276	kerne1132.exe	46
PID 276 wrote to memory of 2136	276	kerne1132.exe	46

C:\Users\Admin\AppData\Local\Temp\4bec172378979fc11eacb4d19136ce61_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4bec172378979fc11eacb4d19136ce61_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\SysWOW64\kerne1132.exe
  C:\Windows\system32\kerne1132.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\SysWOW64\kerne1132.exe
    C:\Windows\system32\kerne1132.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2292
  - - C:\Windows\SysWOW64\kerne1132.exe
      C:\Windows\system32\kerne1132.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2120
    - - C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2100
      - C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2320
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2732
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2756
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2728
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2860
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2812
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2628
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2604
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2636
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:276
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2136
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1652
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        19⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2592
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2920
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1324
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        22⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:616
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        23⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:840
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        24⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2032
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        25⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2428
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        26⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:492
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        27⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1864
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        28⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1476
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        29⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2088
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        30⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1724
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        31⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1684
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        32⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:548
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2940
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3048
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2964
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2908
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2268
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        38⤵
        Executes dropped EXE
        
        PID:2244
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2644
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2240
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2256
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2480
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        43⤵
        Executes dropped EXE
        
        PID:2540
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        44⤵
        Executes dropped EXE
        
        PID:3060
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1904
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        46⤵
        Executes dropped EXE
        
        PID:1920
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        47⤵
        Executes dropped EXE
        
        PID:1132
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        48⤵
        Executes dropped EXE
        
        PID:1896
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2236
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        50⤵
        Executes dropped EXE
        
        PID:1296
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1376
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        52⤵
        Executes dropped EXE
        
        PID:1080
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2568
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        54⤵
        Executes dropped EXE
        
        PID:900
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        55⤵
        Executes dropped EXE
        
        PID:2432
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1088
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        57⤵
        Executes dropped EXE
        
        PID:2152
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2476
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        59⤵
        Executes dropped EXE
        
        PID:1732
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1352
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1520
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        62⤵
        Executes dropped EXE
        
        PID:2336
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2156
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        64⤵
        Executes dropped EXE
        
        PID:964
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        65⤵
        Executes dropped EXE
        
        PID:1860
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        66⤵
        
        PID:988
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        67⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        68⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        69⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        70⤵
        
        PID:2228
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        71⤵
        
        PID:696
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        72⤵
        Drops file in System32 directory
        
        PID:2448
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        73⤵
        Drops file in System32 directory
        
        PID:2016
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        74⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        75⤵
        Drops file in System32 directory
        
        PID:1784
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        76⤵
        Drops file in System32 directory
        
        PID:476
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        77⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        78⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        79⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        80⤵
        Drops file in System32 directory
        
        PID:2372
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        81⤵
        Drops file in System32 directory
        
        PID:2184
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        82⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        83⤵
        Drops file in System32 directory
        
        PID:3040
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        84⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        85⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        86⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        87⤵
        Drops file in System32 directory
        
        PID:2108
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        88⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        89⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        90⤵
        Drops file in System32 directory
        
        PID:2320
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        91⤵
        Drops file in System32 directory
        
        PID:532
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        92⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        93⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        94⤵
        Drops file in System32 directory
        
        PID:2736
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        95⤵
        Drops file in System32 directory
        
        PID:2980
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        96⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        97⤵
        
        PID:2860
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        98⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        99⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        100⤵
        
        PID:2632
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        101⤵
        Drops file in System32 directory
        
        PID:1668
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        102⤵
        Drops file in System32 directory
        
        PID:2772
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        103⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        104⤵
        Drops file in System32 directory
        
        PID:2624
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        105⤵
        Drops file in System32 directory
        
        PID:2676
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        106⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        107⤵
        
        PID:872
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        108⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        109⤵
        Drops file in System32 directory
        
        PID:2832
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        110⤵
        Drops file in System32 directory
        
        PID:2824
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        111⤵
        Drops file in System32 directory
        
        PID:760
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        112⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        113⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        114⤵
        Drops file in System32 directory
        
        PID:1652
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        115⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        116⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        117⤵
        Drops file in System32 directory
        
        PID:1644
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        118⤵
        
        PID:860
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        119⤵
        
        PID:652
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        120⤵
        Drops file in System32 directory
        
        PID:1700
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        121⤵
        Drops file in System32 directory
        
        PID:2888
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        122⤵
        Drops file in System32 directory
        
        PID:1120
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        123⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        124⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        125⤵
        Drops file in System32 directory
        
        PID:492
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        126⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        127⤵
        Drops file in System32 directory
        
        PID:1840
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        128⤵
        Drops file in System32 directory
        
        PID:2088
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        129⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        130⤵
        Drops file in System32 directory
        
        PID:2928
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        131⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        132⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        133⤵
        
        PID:3048
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        134⤵
        Drops file in System32 directory
        
        PID:2964
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        135⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        136⤵
        Drops file in System32 directory
        
        PID:2232
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        137⤵
        
        PID:1188
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        138⤵
        Drops file in System32 directory
        
        PID:1776
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        139⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        140⤵
        Drops file in System32 directory
        
        PID:2256
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        141⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        142⤵
        Drops file in System32 directory
        
        PID:3068
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        143⤵
        
        PID:624
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        144⤵
        Drops file in System32 directory
        
        PID:748
        
        C:\Windows\SysWOW64\kerne1132.exe
        
        C:\Windows\system32\kerne1132.exe
        145⤵
        
        PID:1920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\kerne1132.exe

Filesize
72KB

MD5
4bec172378979fc11eacb4d19136ce61

SHA1
33a57acd5114cf20d3eec10b20b45412941bbba2

SHA256
2f6642aa38f7e67db36a681f8c57b3f707c649265f43c6d16d186b48f2366341

SHA512
744844defb670ec95c3a571eebc8f3c3950a12abf594c92f904bfcea7fa320930ff7f3f8c0bc0819321bb02ff3adc794c02bdecd87d58920742e1e84c8bb6181

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads