Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2024, 15:39
Static task
static1
Behavioral task
behavioral1
Sample
5c92248e956852874cfb7d9c07d20780_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5c92248e956852874cfb7d9c07d20780_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5c92248e956852874cfb7d9c07d20780_JaffaCakes118.exe
-
Size
21KB
-
MD5
5c92248e956852874cfb7d9c07d20780
-
SHA1
d4a352fa8d532cc7358b7fdfad82cff6a58e23a7
-
SHA256
d5fa10d5c7143bb17dcf502c3893532630381bd1ed1132dff6906ee082ebec45
-
SHA512
e3966bc3d7deb4b2e023ab5e1fab1f8ac8e47f7418607fe72bf6730be099a7a3df019d3cb9a02e272ef0d08e152e4fd522dcdbbeba1639fbde521a02d432b712
-
SSDEEP
384:Vgtawy+cJyi34dW/83Lm5DI8pM77UJtNFI2CsZeXCn8fltC0fU/T4fZB:VgXxni34dW/83Lmd/pMfCtE2uSnGy0fZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1056 emsn.exe 2664 emsn.exe 4732 emsn.exe 1852 emsn.exe 4908 emsn.exe 3636 emsn.exe 1872 emsn.exe 1644 emsn.exe 4884 emsn.exe 2712 emsn.exe 1052 emsn.exe 3252 emsn.exe 508 emsn.exe 628 emsn.exe 2120 emsn.exe 3396 emsn.exe 2212 emsn.exe 4580 emsn.exe 4304 emsn.exe 3020 emsn.exe 4788 emsn.exe 1932 emsn.exe 2124 emsn.exe 4444 emsn.exe 3580 emsn.exe 4500 emsn.exe 2284 emsn.exe 4672 emsn.exe 3048 emsn.exe 920 emsn.exe 2276 emsn.exe 1888 emsn.exe 3080 emsn.exe 736 emsn.exe 1828 emsn.exe 776 emsn.exe 4980 emsn.exe 4600 emsn.exe 3024 emsn.exe 3500 emsn.exe 5016 emsn.exe 1096 emsn.exe 2788 emsn.exe 3104 emsn.exe 3772 emsn.exe 4516 emsn.exe 4488 emsn.exe 4636 emsn.exe 4800 emsn.exe 3260 emsn.exe 1992 emsn.exe 3116 emsn.exe 3640 emsn.exe 2692 emsn.exe 4504 emsn.exe 4956 emsn.exe 3408 emsn.exe 1808 emsn.exe 3720 emsn.exe 1340 emsn.exe 1468 emsn.exe 4524 emsn.exe 4160 emsn.exe 460 emsn.exe -
resource yara_rule behavioral2/memory/1864-1-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1864-3-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1864-4-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2664-16-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1852-23-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3636-31-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3636-32-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1644-40-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2712-47-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3252-53-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/628-61-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3396-66-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4580-72-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3020-78-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1932-86-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4444-91-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4672-103-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/920-112-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1888-119-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4500-97-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/736-126-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/776-133-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4600-140-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3500-147-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1096-152-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3104-161-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4516-168-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4636-175-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3260-179-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3116-189-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2692-196-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4956-202-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1808-209-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1340-215-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4524-221-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/460-229-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4736-232-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/888-239-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1124-243-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/404-249-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4844-254-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1596-258-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/5084-263-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2472-269-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3064-274-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3964-279-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4640-284-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4492-289-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2324-294-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3732-299-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1084-304-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1468-308-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/536-314-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3852-319-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4944-324-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3124-327-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/924-334-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2904-339-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2540-344-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2768-349-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3420-354-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1960-359-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4376-364-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/5104-368-0x0000000000400000-0x000000000044B000-memory.dmp upx -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\emsn.exe emsn.exe File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe emsn.exe File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe emsn.exe File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe emsn.exe File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe emsn.exe File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe emsn.exe File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe emsn.exe File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe emsn.exe File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe emsn.exe File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe emsn.exe File created C:\Windows\SysWOW64\emsn.exe emsn.exe File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found File created C:\Windows\SysWOW64\emsn.exe Process not Found -
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 764 set thread context of 1864 764 5c92248e956852874cfb7d9c07d20780_JaffaCakes118.exe 84 PID 1056 set thread context of 2664 1056 emsn.exe 86 PID 4732 set thread context of 1852 4732 emsn.exe 88 PID 4908 set thread context of 3636 4908 emsn.exe 90 PID 1872 set thread context of 1644 1872 emsn.exe 92 PID 4884 set thread context of 2712 4884 emsn.exe 94 PID 1052 set thread context of 3252 1052 emsn.exe 96 PID 508 set thread context of 628 508 emsn.exe 98 PID 2120 set thread context of 3396 2120 emsn.exe 100 PID 2212 set thread context of 4580 2212 emsn.exe 102 PID 4304 set thread context of 3020 4304 emsn.exe 104 PID 4788 set thread context of 1932 4788 emsn.exe 106 PID 2124 set thread context of 4444 2124 emsn.exe 108 PID 3580 set thread context of 4500 3580 emsn.exe 110 PID 2284 set thread context of 4672 2284 emsn.exe 112 PID 3048 set thread context of 920 3048 emsn.exe 114 PID 2276 set thread context of 1888 2276 emsn.exe 116 PID 3080 set thread context of 736 3080 emsn.exe 118 PID 1828 set thread context of 776 1828 emsn.exe 121 PID 4980 set thread context of 4600 4980 emsn.exe 123 PID 3024 set thread context of 3500 3024 emsn.exe 125 PID 5016 set thread context of 1096 5016 emsn.exe 127 PID 2788 set thread context of 3104 2788 emsn.exe 129 PID 3772 set thread context of 4516 3772 emsn.exe 131 PID 4488 set thread context of 4636 4488 emsn.exe 133 PID 4800 set thread context of 3260 4800 emsn.exe 135 PID 1992 set thread context of 3116 1992 emsn.exe 137 PID 3640 set thread context of 2692 3640 emsn.exe 139 PID 4504 set thread context of 4956 4504 emsn.exe 141 PID 3408 set thread context of 1808 3408 emsn.exe 143 PID 3720 set thread context of 1340 3720 emsn.exe 145 PID 1468 set thread context of 4524 1468 emsn.exe 237 PID 4160 set thread context of 460 4160 emsn.exe 150 PID 840 set thread context of 4736 840 emsn.exe 152 PID 3912 set thread context of 888 3912 emsn.exe 154 PID 4604 set thread context of 1124 4604 emsn.exe 156 PID 1940 set thread context of 404 1940 emsn.exe 158 PID 752 set thread context of 4844 752 emsn.exe 161 PID 3308 set thread context of 1596 3308 emsn.exe 163 PID 3504 set thread context of 5084 3504 emsn.exe 165 PID 844 set thread context of 2472 844 emsn.exe 167 PID 3972 set thread context of 3064 3972 emsn.exe 169 PID 1688 set thread context of 3964 1688 emsn.exe 171 PID 608 set thread context of 4640 608 emsn.exe 173 PID 2704 set thread context of 4492 2704 emsn.exe 175 PID 2660 set thread context of 2324 2660 emsn.exe 177 PID 3512 set thread context of 3732 3512 emsn.exe 179 PID 3284 set thread context of 1084 3284 emsn.exe 181 PID 4760 set thread context of 1468 4760 emsn.exe 183 PID 5096 set thread context of 536 5096 emsn.exe 185 PID 1364 set thread context of 3852 1364 emsn.exe 187 PID 4100 set thread context of 4944 4100 emsn.exe 189 PID 3652 set thread context of 3124 3652 emsn.exe 191 PID 3792 set thread context of 924 3792 emsn.exe 193 PID 2448 set thread context of 2904 2448 emsn.exe 195 PID 2876 set thread context of 2540 2876 emsn.exe 197 PID 2724 set thread context of 2768 2724 emsn.exe 199 PID 3068 set thread context of 3420 3068 emsn.exe 201 PID 4740 set thread context of 1960 4740 emsn.exe 203 PID 3684 set thread context of 4376 3684 emsn.exe 205 PID 1604 set thread context of 5104 1604 emsn.exe 207 PID 1624 set thread context of 1632 1624 emsn.exe 209 PID 5056 set thread context of 3268 5056 emsn.exe 211 PID 1776 set thread context of 4364 1776 emsn.exe 213 -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 764 wrote to memory of 1864 764 5c92248e956852874cfb7d9c07d20780_JaffaCakes118.exe 84 PID 764 wrote to memory of 1864 764 5c92248e956852874cfb7d9c07d20780_JaffaCakes118.exe 84 PID 764 wrote to memory of 1864 764 5c92248e956852874cfb7d9c07d20780_JaffaCakes118.exe 84 PID 764 wrote to memory of 1864 764 5c92248e956852874cfb7d9c07d20780_JaffaCakes118.exe 84 PID 764 wrote to memory of 1864 764 5c92248e956852874cfb7d9c07d20780_JaffaCakes118.exe 84 PID 1864 wrote to memory of 1056 1864 5c92248e956852874cfb7d9c07d20780_JaffaCakes118.exe 85 PID 1864 wrote to memory of 1056 1864 5c92248e956852874cfb7d9c07d20780_JaffaCakes118.exe 85 PID 1864 wrote to memory of 1056 1864 5c92248e956852874cfb7d9c07d20780_JaffaCakes118.exe 85 PID 1056 wrote to memory of 2664 1056 emsn.exe 86 PID 1056 wrote to memory of 2664 1056 emsn.exe 86 PID 1056 wrote to memory of 2664 1056 emsn.exe 86 PID 1056 wrote to memory of 2664 1056 emsn.exe 86 PID 1056 wrote to memory of 2664 1056 emsn.exe 86 PID 2664 wrote to memory of 4732 2664 emsn.exe 87 PID 2664 wrote to memory of 4732 2664 emsn.exe 87 PID 2664 wrote to memory of 4732 2664 emsn.exe 87 PID 4732 wrote to memory of 1852 4732 emsn.exe 88 PID 4732 wrote to memory of 1852 4732 emsn.exe 88 PID 4732 wrote to memory of 1852 4732 emsn.exe 88 PID 4732 wrote to memory of 1852 4732 emsn.exe 88 PID 4732 wrote to memory of 1852 4732 emsn.exe 88 PID 1852 wrote to memory of 4908 1852 emsn.exe 89 PID 1852 wrote to memory of 4908 1852 emsn.exe 89 PID 1852 wrote to memory of 4908 1852 emsn.exe 89 PID 4908 wrote to memory of 3636 4908 emsn.exe 90 PID 4908 wrote to memory of 3636 4908 emsn.exe 90 PID 4908 wrote to memory of 3636 4908 emsn.exe 90 PID 4908 wrote to memory of 3636 4908 emsn.exe 90 PID 4908 wrote to memory of 3636 4908 emsn.exe 90 PID 3636 wrote to memory of 1872 3636 emsn.exe 91 PID 3636 wrote to memory of 1872 3636 emsn.exe 91 PID 3636 wrote to memory of 1872 3636 emsn.exe 91 PID 1872 wrote to memory of 1644 1872 emsn.exe 92 PID 1872 wrote to memory of 1644 1872 emsn.exe 92 PID 1872 wrote to memory of 1644 1872 emsn.exe 92 PID 1872 wrote to memory of 1644 1872 emsn.exe 92 PID 1872 wrote to memory of 1644 1872 emsn.exe 92 PID 1644 wrote to memory of 4884 1644 emsn.exe 93 PID 1644 wrote to memory of 4884 1644 emsn.exe 93 PID 1644 wrote to memory of 4884 1644 emsn.exe 93 PID 4884 wrote to memory of 2712 4884 emsn.exe 94 PID 4884 wrote to memory of 2712 4884 emsn.exe 94 PID 4884 wrote to memory of 2712 4884 emsn.exe 94 PID 4884 wrote to memory of 2712 4884 emsn.exe 94 PID 4884 wrote to memory of 2712 4884 emsn.exe 94 PID 2712 wrote to memory of 1052 2712 emsn.exe 95 PID 2712 wrote to memory of 1052 2712 emsn.exe 95 PID 2712 wrote to memory of 1052 2712 emsn.exe 95 PID 1052 wrote to memory of 3252 1052 emsn.exe 96 PID 1052 wrote to memory of 3252 1052 emsn.exe 96 PID 1052 wrote to memory of 3252 1052 emsn.exe 96 PID 1052 wrote to memory of 3252 1052 emsn.exe 96 PID 1052 wrote to memory of 3252 1052 emsn.exe 96 PID 3252 wrote to memory of 508 3252 emsn.exe 97 PID 3252 wrote to memory of 508 3252 emsn.exe 97 PID 3252 wrote to memory of 508 3252 emsn.exe 97 PID 508 wrote to memory of 628 508 emsn.exe 98 PID 508 wrote to memory of 628 508 emsn.exe 98 PID 508 wrote to memory of 628 508 emsn.exe 98 PID 508 wrote to memory of 628 508 emsn.exe 98 PID 508 wrote to memory of 628 508 emsn.exe 98 PID 628 wrote to memory of 2120 628 emsn.exe 99 PID 628 wrote to memory of 2120 628 emsn.exe 99 PID 628 wrote to memory of 2120 628 emsn.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c92248e956852874cfb7d9c07d20780_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5c92248e956852874cfb7d9c07d20780_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\5c92248e956852874cfb7d9c07d20780_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\5c92248e956852874cfb7d9c07d20780_JaffaCakes118.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2120 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe18⤵
- Executes dropped EXE
PID:3396 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2212 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe20⤵
- Executes dropped EXE
PID:4580 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4304 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe22⤵
- Executes dropped EXE
PID:3020 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4788 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe24⤵
- Executes dropped EXE
PID:1932 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2124 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe26⤵
- Executes dropped EXE
PID:4444 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3580 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe28⤵
- Executes dropped EXE
PID:4500 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2284 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe30⤵
- Executes dropped EXE
PID:4672 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3048 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe32⤵
- Executes dropped EXE
PID:920 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2276 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe34⤵
- Executes dropped EXE
PID:1888 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3080 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe36⤵
- Executes dropped EXE
PID:736 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1828 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe38⤵
- Executes dropped EXE
PID:776 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4980 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe40⤵
- Executes dropped EXE
PID:4600 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3024 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe42⤵
- Executes dropped EXE
PID:3500 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5016 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe44⤵
- Executes dropped EXE
PID:1096 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2788 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe46⤵
- Executes dropped EXE
PID:3104 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3772 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe48⤵
- Executes dropped EXE
PID:4516 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4488 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe50⤵
- Executes dropped EXE
PID:4636 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4800 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe52⤵
- Executes dropped EXE
PID:3260 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1992 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe54⤵
- Executes dropped EXE
PID:3116 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3640 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe56⤵
- Executes dropped EXE
PID:2692 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4504 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe58⤵
- Executes dropped EXE
PID:4956 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3408 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe60⤵
- Executes dropped EXE
PID:1808 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3720 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe62⤵
- Executes dropped EXE
PID:1340 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"63⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1468 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe64⤵
- Executes dropped EXE
PID:4524 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"65⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4160 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe66⤵
- Executes dropped EXE
PID:460 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"67⤵
- Suspicious use of SetThreadContext
PID:840 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe68⤵PID:4736
-
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"69⤵
- Suspicious use of SetThreadContext
PID:3912 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe70⤵PID:888
-
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"71⤵
- Suspicious use of SetThreadContext
PID:4604 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe72⤵PID:1124
-
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"73⤵
- Suspicious use of SetThreadContext
PID:1940 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe74⤵PID:404
-
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"75⤵
- Suspicious use of SetThreadContext
PID:752 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe76⤵PID:4844
-
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"77⤵
- Suspicious use of SetThreadContext
PID:3308 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe78⤵PID:1596
-
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"79⤵
- Suspicious use of SetThreadContext
PID:3504 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe80⤵PID:5084
-
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"81⤵
- Suspicious use of SetThreadContext
PID:844 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe82⤵PID:2472
-
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"83⤵
- Suspicious use of SetThreadContext
PID:3972 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe84⤵PID:3064
-
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"85⤵
- Suspicious use of SetThreadContext
PID:1688 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe86⤵PID:3964
-
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"87⤵
- Suspicious use of SetThreadContext
PID:608 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe88⤵PID:4640
-
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"89⤵
- Suspicious use of SetThreadContext
PID:2704 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe90⤵PID:4492
-
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"91⤵
- Suspicious use of SetThreadContext
PID:2660 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe92⤵PID:2324
-
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"93⤵
- Suspicious use of SetThreadContext
PID:3512 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe94⤵PID:3732
-
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"95⤵
- Suspicious use of SetThreadContext
PID:3284 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe96⤵PID:1084
-
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"97⤵
- Suspicious use of SetThreadContext
PID:4760 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe98⤵PID:1468
-
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"99⤵
- Suspicious use of SetThreadContext
PID:5096 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe100⤵PID:536
-
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"101⤵
- Suspicious use of SetThreadContext
PID:1364 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe102⤵PID:3852
-
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"103⤵
- Suspicious use of SetThreadContext
PID:4100 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe104⤵PID:4944
-
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"105⤵
- Suspicious use of SetThreadContext
PID:3652 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe106⤵PID:3124
-
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"107⤵
- Suspicious use of SetThreadContext
PID:3792 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe108⤵
- Drops file in System32 directory
PID:924 -
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"109⤵
- Suspicious use of SetThreadContext
PID:2448 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe110⤵PID:2904
-
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"111⤵
- Suspicious use of SetThreadContext
PID:2876 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe112⤵PID:2540
-
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"113⤵
- Suspicious use of SetThreadContext
PID:2724 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe114⤵PID:2768
-
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"115⤵
- Suspicious use of SetThreadContext
PID:3068 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe116⤵PID:3420
-
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"117⤵
- Suspicious use of SetThreadContext
PID:4740 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe118⤵PID:1960
-
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"119⤵
- Suspicious use of SetThreadContext
PID:3684 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe120⤵PID:4376
-
C:\Windows\SysWOW64\emsn.exe"C:\Windows\system32\emsn.exe"121⤵
- Suspicious use of SetThreadContext
PID:1604 -
C:\Windows\SysWOW64\emsn.exeC:\Windows\SysWOW64\emsn.exe122⤵PID:5104
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-