Analysis
-
max time kernel
147s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 15:58
Static task
static1
Behavioral task
behavioral1
Sample
63d47c2d46ec9d5a8a1be1968acfcb5e_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
63d47c2d46ec9d5a8a1be1968acfcb5e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
63d47c2d46ec9d5a8a1be1968acfcb5e_JaffaCakes118.exe
-
Size
168KB
-
MD5
63d47c2d46ec9d5a8a1be1968acfcb5e
-
SHA1
b63e42cefa55b2544965390e10e7961a769c2cba
-
SHA256
2b553ebd0f4b37b6c715241dbabeee76112cfea8216ebb8e9705c6d2d46e6aad
-
SHA512
e9bd832fdfdecaefd6819f9f9de494cf2a78be3784135189d09a21a9a1c2d7e4b58850531cab7980388e11f98cd4873b1b6a41e9cd53fe381a11da6fbc08ebe9
-
SSDEEP
3072:2LuC9XN6Q22l61bgI3fZD5uA9vfB0q1wdNp9Txfs5Bw0/Cq:i9d6Qdl8ffv4fp9T0BzN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3024 wuauolts.exe 672 wuauolts.exe 1168 wuauolts.exe 4740 wuauolts.exe 2252 wuauolts.exe 2584 wuauolts.exe 3996 wuauolts.exe 944 wuauolts.exe 644 wuauolts.exe 920 wuauolts.exe 3680 wuauolts.exe 100 wuauolts.exe 2108 wuauolts.exe 916 wuauolts.exe 2796 wuauolts.exe 2412 wuauolts.exe 4644 wuauolts.exe 3904 wuauolts.exe 5092 wuauolts.exe 4120 wuauolts.exe 4712 wuauolts.exe 3608 wuauolts.exe 3424 wuauolts.exe 4796 wuauolts.exe 3240 wuauolts.exe 4192 wuauolts.exe 1268 wuauolts.exe 1444 wuauolts.exe 2168 wuauolts.exe 1364 wuauolts.exe 2644 wuauolts.exe 3788 wuauolts.exe 3100 wuauolts.exe 4808 wuauolts.exe 2008 wuauolts.exe 4692 wuauolts.exe 4288 wuauolts.exe 4048 wuauolts.exe 2516 wuauolts.exe 2472 wuauolts.exe 4408 wuauolts.exe 4680 wuauolts.exe 4296 wuauolts.exe 3168 wuauolts.exe 2880 wuauolts.exe 228 wuauolts.exe 3252 wuauolts.exe 2600 wuauolts.exe 3264 wuauolts.exe 1028 wuauolts.exe 1668 wuauolts.exe 1064 wuauolts.exe 2744 wuauolts.exe 3736 wuauolts.exe 1616 wuauolts.exe 4528 wuauolts.exe 3980 wuauolts.exe 4324 wuauolts.exe 2496 wuauolts.exe 2692 wuauolts.exe 2060 wuauolts.exe 2164 wuauolts.exe 4892 wuauolts.exe 1972 wuauolts.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\j: wuauolts.exe File opened (read-only) \??\i: Process not Found File opened (read-only) \??\m: Process not Found File opened (read-only) \??\e: Process not Found File opened (read-only) \??\g: Process not Found File opened (read-only) \??\y: Process not Found File opened (read-only) \??\j: wuauolts.exe File opened (read-only) \??\q: wuauolts.exe File opened (read-only) \??\t: wuauolts.exe File opened (read-only) \??\l: wuauolts.exe File opened (read-only) \??\y: Process not Found File opened (read-only) \??\e: Process not Found File opened (read-only) \??\p: Process not Found File opened (read-only) \??\i: Process not Found File opened (read-only) \??\y: Process not Found File opened (read-only) \??\n: wuauolts.exe File opened (read-only) \??\s: wuauolts.exe File opened (read-only) \??\z: wuauolts.exe File opened (read-only) \??\u: Process not Found File opened (read-only) \??\h: Process not Found File opened (read-only) \??\z: wuauolts.exe File opened (read-only) \??\g: wuauolts.exe File opened (read-only) \??\t: wuauolts.exe File opened (read-only) \??\y: Process not Found File opened (read-only) \??\w: Process not Found File opened (read-only) \??\o: Process not Found File opened (read-only) \??\l: wuauolts.exe File opened (read-only) \??\h: Process not Found File opened (read-only) \??\n: Process not Found File opened (read-only) \??\t: Process not Found File opened (read-only) \??\h: wuauolts.exe File opened (read-only) \??\t: wuauolts.exe File opened (read-only) \??\s: Process not Found File opened (read-only) \??\g: wuauolts.exe File opened (read-only) \??\o: wuauolts.exe File opened (read-only) \??\m: wuauolts.exe File opened (read-only) \??\v: Process not Found File opened (read-only) \??\e: wuauolts.exe File opened (read-only) \??\y: Process not Found File opened (read-only) \??\k: Process not Found File opened (read-only) \??\g: Process not Found File opened (read-only) \??\u: wuauolts.exe File opened (read-only) \??\j: wuauolts.exe File opened (read-only) \??\n: Process not Found File opened (read-only) \??\t: wuauolts.exe File opened (read-only) \??\n: wuauolts.exe File opened (read-only) \??\k: Process not Found File opened (read-only) \??\r: wuauolts.exe File opened (read-only) \??\r: Process not Found File opened (read-only) \??\q: Process not Found File opened (read-only) \??\l: wuauolts.exe File opened (read-only) \??\o: Process not Found File opened (read-only) \??\o: Process not Found File opened (read-only) \??\l: Process not Found File opened (read-only) \??\m: Process not Found File opened (read-only) \??\r: Process not Found File opened (read-only) \??\q: Process not Found File opened (read-only) \??\o: Process not Found File opened (read-only) \??\k: Process not Found File opened (read-only) \??\i: Process not Found File opened (read-only) \??\e: Process not Found File opened (read-only) \??\s: Process not Found File opened (read-only) \??\i: Process not Found File opened (read-only) \??\l: wuauolts.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 4992 63d47c2d46ec9d5a8a1be1968acfcb5e_JaffaCakes118.exe 3024 wuauolts.exe 672 wuauolts.exe 1168 wuauolts.exe 4740 wuauolts.exe 2252 wuauolts.exe 2584 wuauolts.exe 3996 wuauolts.exe 944 wuauolts.exe 644 wuauolts.exe 920 wuauolts.exe 3680 wuauolts.exe 100 wuauolts.exe 2108 wuauolts.exe 916 wuauolts.exe 2796 wuauolts.exe 2412 wuauolts.exe 4644 wuauolts.exe 3904 wuauolts.exe 5092 wuauolts.exe 4120 wuauolts.exe 4712 wuauolts.exe 3608 wuauolts.exe 3424 wuauolts.exe 4796 wuauolts.exe 3240 wuauolts.exe 4192 wuauolts.exe 1268 wuauolts.exe 1444 wuauolts.exe 2168 wuauolts.exe 1364 wuauolts.exe 2644 wuauolts.exe 3788 wuauolts.exe 3100 wuauolts.exe 4808 wuauolts.exe 2008 wuauolts.exe 4692 wuauolts.exe 4288 wuauolts.exe 4048 wuauolts.exe 2516 wuauolts.exe 2472 wuauolts.exe 4408 wuauolts.exe 4680 wuauolts.exe 4296 wuauolts.exe 3168 wuauolts.exe 2880 wuauolts.exe 228 wuauolts.exe 3252 wuauolts.exe 2600 wuauolts.exe 3264 wuauolts.exe 1028 wuauolts.exe 1668 wuauolts.exe 1064 wuauolts.exe 2744 wuauolts.exe 3736 wuauolts.exe 1616 wuauolts.exe 4528 wuauolts.exe 3980 wuauolts.exe 4324 wuauolts.exe 2496 wuauolts.exe 2692 wuauolts.exe 2060 wuauolts.exe 2164 wuauolts.exe 4892 wuauolts.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4992 wrote to memory of 3024 4992 63d47c2d46ec9d5a8a1be1968acfcb5e_JaffaCakes118.exe 84 PID 4992 wrote to memory of 3024 4992 63d47c2d46ec9d5a8a1be1968acfcb5e_JaffaCakes118.exe 84 PID 4992 wrote to memory of 3024 4992 63d47c2d46ec9d5a8a1be1968acfcb5e_JaffaCakes118.exe 84 PID 3024 wrote to memory of 672 3024 wuauolts.exe 85 PID 3024 wrote to memory of 672 3024 wuauolts.exe 85 PID 3024 wrote to memory of 672 3024 wuauolts.exe 85 PID 672 wrote to memory of 1168 672 wuauolts.exe 86 PID 672 wrote to memory of 1168 672 wuauolts.exe 86 PID 672 wrote to memory of 1168 672 wuauolts.exe 86 PID 1168 wrote to memory of 4740 1168 wuauolts.exe 87 PID 1168 wrote to memory of 4740 1168 wuauolts.exe 87 PID 1168 wrote to memory of 4740 1168 wuauolts.exe 87 PID 4740 wrote to memory of 2252 4740 wuauolts.exe 88 PID 4740 wrote to memory of 2252 4740 wuauolts.exe 88 PID 4740 wrote to memory of 2252 4740 wuauolts.exe 88 PID 2252 wrote to memory of 2584 2252 wuauolts.exe 89 PID 2252 wrote to memory of 2584 2252 wuauolts.exe 89 PID 2252 wrote to memory of 2584 2252 wuauolts.exe 89 PID 2584 wrote to memory of 3996 2584 wuauolts.exe 90 PID 2584 wrote to memory of 3996 2584 wuauolts.exe 90 PID 2584 wrote to memory of 3996 2584 wuauolts.exe 90 PID 3996 wrote to memory of 944 3996 wuauolts.exe 91 PID 3996 wrote to memory of 944 3996 wuauolts.exe 91 PID 3996 wrote to memory of 944 3996 wuauolts.exe 91 PID 944 wrote to memory of 644 944 wuauolts.exe 92 PID 944 wrote to memory of 644 944 wuauolts.exe 92 PID 944 wrote to memory of 644 944 wuauolts.exe 92 PID 644 wrote to memory of 920 644 wuauolts.exe 93 PID 644 wrote to memory of 920 644 wuauolts.exe 93 PID 644 wrote to memory of 920 644 wuauolts.exe 93 PID 920 wrote to memory of 3680 920 wuauolts.exe 94 PID 920 wrote to memory of 3680 920 wuauolts.exe 94 PID 920 wrote to memory of 3680 920 wuauolts.exe 94 PID 3680 wrote to memory of 100 3680 wuauolts.exe 95 PID 3680 wrote to memory of 100 3680 wuauolts.exe 95 PID 3680 wrote to memory of 100 3680 wuauolts.exe 95 PID 100 wrote to memory of 2108 100 wuauolts.exe 96 PID 100 wrote to memory of 2108 100 wuauolts.exe 96 PID 100 wrote to memory of 2108 100 wuauolts.exe 96 PID 2108 wrote to memory of 916 2108 wuauolts.exe 97 PID 2108 wrote to memory of 916 2108 wuauolts.exe 97 PID 2108 wrote to memory of 916 2108 wuauolts.exe 97 PID 916 wrote to memory of 2796 916 wuauolts.exe 98 PID 916 wrote to memory of 2796 916 wuauolts.exe 98 PID 916 wrote to memory of 2796 916 wuauolts.exe 98 PID 2796 wrote to memory of 2412 2796 wuauolts.exe 100 PID 2796 wrote to memory of 2412 2796 wuauolts.exe 100 PID 2796 wrote to memory of 2412 2796 wuauolts.exe 100 PID 2412 wrote to memory of 4644 2412 wuauolts.exe 102 PID 2412 wrote to memory of 4644 2412 wuauolts.exe 102 PID 2412 wrote to memory of 4644 2412 wuauolts.exe 102 PID 4644 wrote to memory of 3904 4644 wuauolts.exe 103 PID 4644 wrote to memory of 3904 4644 wuauolts.exe 103 PID 4644 wrote to memory of 3904 4644 wuauolts.exe 103 PID 3904 wrote to memory of 5092 3904 wuauolts.exe 104 PID 3904 wrote to memory of 5092 3904 wuauolts.exe 104 PID 3904 wrote to memory of 5092 3904 wuauolts.exe 104 PID 5092 wrote to memory of 4120 5092 wuauolts.exe 105 PID 5092 wrote to memory of 4120 5092 wuauolts.exe 105 PID 5092 wrote to memory of 4120 5092 wuauolts.exe 105 PID 4120 wrote to memory of 4712 4120 wuauolts.exe 106 PID 4120 wrote to memory of 4712 4120 wuauolts.exe 106 PID 4120 wrote to memory of 4712 4120 wuauolts.exe 106 PID 4712 wrote to memory of 3608 4712 wuauolts.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\63d47c2d46ec9d5a8a1be1968acfcb5e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\63d47c2d46ec9d5a8a1be1968acfcb5e_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe7⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe8⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe9⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe10⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe11⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe12⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe13⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:100 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe14⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe15⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe16⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe17⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe18⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe19⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe20⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe21⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe22⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe23⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3608 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe24⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3424 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe25⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4796 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe26⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3240 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe27⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4192 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe28⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1268 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe29⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1444 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe30⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2168 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe31⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1364 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe32⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2644 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe33⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3788 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe34⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3100 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe35⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4808 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe36⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2008 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe37⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4692 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe38⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4288 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe39⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4048 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe40⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2516 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe41⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2472 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe42⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4408 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe43⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4680 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe44⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4296 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe45⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3168 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe46⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2880 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe47⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:228 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe48⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3252 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2600 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe50⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3264 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe51⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1028 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe52⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1668 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe53⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1064 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe54⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2744 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe55⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3736 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe56⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1616 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe57⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4528 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe58⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3980 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe59⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4324 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe60⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2496 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe61⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2692 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe62⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2060 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe63⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2164 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe64⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4892 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe65⤵
- Executes dropped EXE
PID:1972 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe66⤵PID:2120
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe67⤵PID:4792
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe68⤵PID:2740
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe69⤵PID:1608
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe70⤵PID:3716
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe71⤵PID:2680
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe72⤵PID:2404
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe73⤵PID:3364
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe74⤵PID:3760
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe75⤵PID:4232
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe76⤵PID:5140
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe77⤵PID:5168
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe78⤵PID:5200
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe79⤵PID:5228
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe80⤵PID:5272
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe81⤵PID:5304
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe82⤵PID:5356
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe83⤵PID:5400
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe84⤵PID:5444
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe85⤵PID:5480
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe86⤵PID:5576
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe87⤵PID:5608
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe88⤵PID:5640
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe89⤵PID:5668
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe90⤵PID:5700
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe91⤵PID:5748
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe92⤵PID:5788
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe93⤵PID:5816
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe94⤵PID:5844
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe95⤵PID:5876
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe96⤵PID:5904
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe97⤵PID:5932
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe98⤵PID:5960
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe99⤵PID:5988
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe100⤵PID:6016
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe101⤵PID:6044
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe102⤵PID:6072
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe103⤵PID:6104
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe104⤵PID:6132
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe105⤵PID:5160
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe106⤵PID:5292
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe107⤵
- Drops file in System32 directory
PID:5372 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe108⤵PID:5600
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe109⤵
- Enumerates connected drives
PID:5656 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe110⤵PID:5780
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe111⤵
- Drops file in System32 directory
PID:5884 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe112⤵PID:5980
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe113⤵PID:6092
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe114⤵PID:5264
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe115⤵PID:5736
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe116⤵PID:6008
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe117⤵PID:5916
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe118⤵PID:6160
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe119⤵PID:6188
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe120⤵PID:6216
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe121⤵PID:6248
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe122⤵PID:6276
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-