Analysis

  • max time kernel
    149s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    24/07/2024, 06:42

General

  • Target

    6a9c6979794cb76418468436863d9c0a_JaffaCakes118.exe

  • Size

    13.1MB

  • MD5

    6a9c6979794cb76418468436863d9c0a

  • SHA1

    45827af07a21ad6ce9625e229e2b99f6c81f9a39

  • SHA256

    7d5d3ada6092553b21d75c4fe407a4692c63bd0548cb9d0a1675de61f1946c9c

  • SHA512

    58475f6c34bf8252f823ee234a3950c5e89f2dac29697578643d3de8f9fdb47b1528bbf71b9280855ee279d385fde7e5d0522339830f67dd9814fb6f4082d681

  • SSDEEP

    49152:ArilWvdYEbdDYCJ6TRBsDL9A9TK4FfpV3203HCnBTaXMdYrkTcH:AriSkBcF4Fhl2gUBTaXMmrg

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6a9c6979794cb76418468436863d9c0a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6a9c6979794cb76418468436863d9c0a_JaffaCakes118.exe"
    1⤵
    • UAC bypass
    • Loads dropped DLL
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1412
    • C:\Users\Admin\AppData\Local\Builder.exe
      C:\Users\Admin\AppData\Local\Builder.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2072
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2060
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2172
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:320
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2080
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2736
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2868
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2896
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3024
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2892
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2472
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2920
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2988
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2744
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2648
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2604
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2624
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2676
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2224
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2476
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1940
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:272
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1748
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1372
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:652
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:268
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2428
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1892
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1620
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1952
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1876
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2004
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2816
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2860
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1960
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2948
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2924
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2824
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2508
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2468
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2200
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2236
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:288
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:804
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:444
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2588
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1968
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1944
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1608
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1228
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1324
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1728
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:976
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1948
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2980
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1664
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1364
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:780
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2304
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3052
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2968
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2336
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1484
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:304
      • C:\Users\Admin\AppData\Local\avguix.exe
        C:\Users\Admin\AppData\Local\avguix.exe
        3⤵
          PID:1288
        • C:\Users\Admin\AppData\Local\avguix.exe
          C:\Users\Admin\AppData\Local\avguix.exe
          3⤵
            PID:1988
          • C:\Users\Admin\AppData\Local\avguix.exe
            C:\Users\Admin\AppData\Local\avguix.exe
            3⤵
              PID:1972
            • C:\Users\Admin\AppData\Local\avguix.exe
              C:\Users\Admin\AppData\Local\avguix.exe
              3⤵
                PID:2464
              • C:\Users\Admin\AppData\Local\avguix.exe
                C:\Users\Admin\AppData\Local\avguix.exe
                3⤵
                • System Location Discovery: System Language Discovery
                PID:1588
              • C:\Users\Admin\AppData\Local\avguix.exe
                C:\Users\Admin\AppData\Local\avguix.exe
                3⤵
                  PID:1684
                • C:\Users\Admin\AppData\Local\avguix.exe
                  C:\Users\Admin\AppData\Local\avguix.exe
                  3⤵
                    PID:1596
                  • C:\Users\Admin\AppData\Local\avguix.exe
                    C:\Users\Admin\AppData\Local\avguix.exe
                    3⤵
                      PID:2412
                    • C:\Users\Admin\AppData\Local\avguix.exe
                      C:\Users\Admin\AppData\Local\avguix.exe
                      3⤵
                        PID:2568
                      • C:\Users\Admin\AppData\Local\avguix.exe
                        C:\Users\Admin\AppData\Local\avguix.exe
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:2152
                      • C:\Users\Admin\AppData\Local\avguix.exe
                        C:\Users\Admin\AppData\Local\avguix.exe
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:2548
                      • C:\Users\Admin\AppData\Local\avguix.exe
                        C:\Users\Admin\AppData\Local\avguix.exe
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:2172
                      • C:\Users\Admin\AppData\Local\avguix.exe
                        C:\Users\Admin\AppData\Local\avguix.exe
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:2080
                      • C:\Users\Admin\AppData\Local\avguix.exe
                        C:\Users\Admin\AppData\Local\avguix.exe
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:2736
                      • C:\Users\Admin\AppData\Local\avguix.exe
                        C:\Users\Admin\AppData\Local\avguix.exe
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:2792
                      • C:\Users\Admin\AppData\Local\avguix.exe
                        C:\Users\Admin\AppData\Local\avguix.exe
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:2880
                      • C:\Users\Admin\AppData\Local\avguix.exe
                        C:\Users\Admin\AppData\Local\avguix.exe
                        3⤵
                          PID:2088
                        • C:\Users\Admin\AppData\Local\avguix.exe
                          C:\Users\Admin\AppData\Local\avguix.exe
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:2044
                        • C:\Users\Admin\AppData\Local\avguix.exe
                          C:\Users\Admin\AppData\Local\avguix.exe
                          3⤵
                            PID:2768
                          • C:\Users\Admin\AppData\Local\avguix.exe
                            C:\Users\Admin\AppData\Local\avguix.exe
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:2884
                          • C:\Users\Admin\AppData\Local\avguix.exe
                            C:\Users\Admin\AppData\Local\avguix.exe
                            3⤵
                              PID:2744
                            • C:\Users\Admin\AppData\Local\avguix.exe
                              C:\Users\Admin\AppData\Local\avguix.exe
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:1632
                            • C:\Users\Admin\AppData\Local\avguix.exe
                              C:\Users\Admin\AppData\Local\avguix.exe
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:1864
                            • C:\Users\Admin\AppData\Local\avguix.exe
                              C:\Users\Admin\AppData\Local\avguix.exe
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:2620
                            • C:\Users\Admin\AppData\Local\avguix.exe
                              C:\Users\Admin\AppData\Local\avguix.exe
                              3⤵
                                PID:2804
                              • C:\Users\Admin\AppData\Local\avguix.exe
                                C:\Users\Admin\AppData\Local\avguix.exe
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:2320
                              • C:\Users\Admin\AppData\Local\avguix.exe
                                C:\Users\Admin\AppData\Local\avguix.exe
                                3⤵
                                  PID:2476
                                • C:\Users\Admin\AppData\Local\avguix.exe
                                  C:\Users\Admin\AppData\Local\avguix.exe
                                  3⤵
                                    PID:2348
                                  • C:\Users\Admin\AppData\Local\avguix.exe
                                    C:\Users\Admin\AppData\Local\avguix.exe
                                    3⤵
                                      PID:2872
                                    • C:\Users\Admin\AppData\Local\avguix.exe
                                      C:\Users\Admin\AppData\Local\avguix.exe
                                      3⤵
                                        PID:272
                                      • C:\Users\Admin\AppData\Local\avguix.exe
                                        C:\Users\Admin\AppData\Local\avguix.exe
                                        3⤵
                                          PID:1816
                                        • C:\Users\Admin\AppData\Local\avguix.exe
                                          C:\Users\Admin\AppData\Local\avguix.exe
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:2632
                                        • C:\Users\Admin\AppData\Local\avguix.exe
                                          C:\Users\Admin\AppData\Local\avguix.exe
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1704
                                        • C:\Users\Admin\AppData\Local\avguix.exe
                                          C:\Users\Admin\AppData\Local\avguix.exe
                                          3⤵
                                            PID:2672
                                          • C:\Users\Admin\AppData\Local\avguix.exe
                                            C:\Users\Admin\AppData\Local\avguix.exe
                                            3⤵
                                              PID:2852
                                            • C:\Users\Admin\AppData\Local\avguix.exe
                                              C:\Users\Admin\AppData\Local\avguix.exe
                                              3⤵
                                                PID:2912
                                              • C:\Users\Admin\AppData\Local\avguix.exe
                                                C:\Users\Admin\AppData\Local\avguix.exe
                                                3⤵
                                                  PID:628
                                                • C:\Users\Admin\AppData\Local\avguix.exe
                                                  C:\Users\Admin\AppData\Local\avguix.exe
                                                  3⤵
                                                    PID:1384
                                                  • C:\Users\Admin\AppData\Local\avguix.exe
                                                    C:\Users\Admin\AppData\Local\avguix.exe
                                                    3⤵
                                                      PID:1720
                                                    • C:\Users\Admin\AppData\Local\avguix.exe
                                                      C:\Users\Admin\AppData\Local\avguix.exe
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2616
                                                    • C:\Users\Admin\AppData\Local\avguix.exe
                                                      C:\Users\Admin\AppData\Local\avguix.exe
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2004
                                                    • C:\Users\Admin\AppData\Local\avguix.exe
                                                      C:\Users\Admin\AppData\Local\avguix.exe
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2600
                                                    • C:\Users\Admin\AppData\Local\avguix.exe
                                                      C:\Users\Admin\AppData\Local\avguix.exe
                                                      3⤵
                                                        PID:1072
                                                      • C:\Users\Admin\AppData\Local\avguix.exe
                                                        C:\Users\Admin\AppData\Local\avguix.exe
                                                        3⤵
                                                          PID:1960
                                                        • C:\Users\Admin\AppData\Local\avguix.exe
                                                          C:\Users\Admin\AppData\Local\avguix.exe
                                                          3⤵
                                                            PID:2952
                                                          • C:\Users\Admin\AppData\Local\avguix.exe
                                                            C:\Users\Admin\AppData\Local\avguix.exe
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2924
                                                          • C:\Users\Admin\AppData\Local\avguix.exe
                                                            C:\Users\Admin\AppData\Local\avguix.exe
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2220
                                                          • C:\Users\Admin\AppData\Local\avguix.exe
                                                            C:\Users\Admin\AppData\Local\avguix.exe
                                                            3⤵
                                                              PID:2180
                                                            • C:\Users\Admin\AppData\Local\avguix.exe
                                                              C:\Users\Admin\AppData\Local\avguix.exe
                                                              3⤵
                                                                PID:2728
                                                              • C:\Users\Admin\AppData\Local\avguix.exe
                                                                C:\Users\Admin\AppData\Local\avguix.exe
                                                                3⤵
                                                                  PID:484
                                                                • C:\Users\Admin\AppData\Local\avguix.exe
                                                                  C:\Users\Admin\AppData\Local\avguix.exe
                                                                  3⤵
                                                                    PID:2992
                                                                  • C:\Users\Admin\AppData\Local\avguix.exe
                                                                    C:\Users\Admin\AppData\Local\avguix.exe
                                                                    3⤵
                                                                      PID:2928
                                                                    • C:\Users\Admin\AppData\Local\avguix.exe
                                                                      C:\Users\Admin\AppData\Local\avguix.exe
                                                                      3⤵
                                                                        PID:804
                                                                      • C:\Users\Admin\AppData\Local\avguix.exe
                                                                        C:\Users\Admin\AppData\Local\avguix.exe
                                                                        3⤵
                                                                          PID:3032
                                                                        • C:\Users\Admin\AppData\Local\avguix.exe
                                                                          C:\Users\Admin\AppData\Local\avguix.exe
                                                                          3⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:2588
                                                                        • C:\Users\Admin\AppData\Local\avguix.exe
                                                                          C:\Users\Admin\AppData\Local\avguix.exe
                                                                          3⤵
                                                                            PID:1956
                                                                          • C:\Users\Admin\AppData\Local\avguix.exe
                                                                            C:\Users\Admin\AppData\Local\avguix.exe
                                                                            3⤵
                                                                              PID:1292
                                                                            • C:\Users\Admin\AppData\Local\avguix.exe
                                                                              C:\Users\Admin\AppData\Local\avguix.exe
                                                                              3⤵
                                                                                PID:1228
                                                                              • C:\Users\Admin\AppData\Local\avguix.exe
                                                                                C:\Users\Admin\AppData\Local\avguix.exe
                                                                                3⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:2300
                                                                              • C:\Users\Admin\AppData\Local\avguix.exe
                                                                                C:\Users\Admin\AppData\Local\avguix.exe
                                                                                3⤵
                                                                                  PID:1512
                                                                                • C:\Users\Admin\AppData\Local\avguix.exe
                                                                                  C:\Users\Admin\AppData\Local\avguix.exe
                                                                                  3⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:976
                                                                                • C:\Users\Admin\AppData\Local\avguix.exe
                                                                                  C:\Users\Admin\AppData\Local\avguix.exe
                                                                                  3⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:1948
                                                                                • C:\Users\Admin\AppData\Local\avguix.exe
                                                                                  C:\Users\Admin\AppData\Local\avguix.exe
                                                                                  3⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:2372
                                                                                • C:\Users\Admin\AppData\Local\avguix.exe
                                                                                  C:\Users\Admin\AppData\Local\avguix.exe
                                                                                  3⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:1664
                                                                                • C:\Users\Admin\AppData\Local\avguix.exe
                                                                                  C:\Users\Admin\AppData\Local\avguix.exe
                                                                                  3⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:1408
                                                                                • C:\Users\Admin\AppData\Local\avguix.exe
                                                                                  C:\Users\Admin\AppData\Local\avguix.exe
                                                                                  3⤵
                                                                                    PID:780
                                                                                  • C:\Users\Admin\AppData\Local\avguix.exe
                                                                                    C:\Users\Admin\AppData\Local\avguix.exe
                                                                                    3⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:296
                                                                                  • C:\Users\Admin\AppData\Local\avguix.exe
                                                                                    C:\Users\Admin\AppData\Local\avguix.exe
                                                                                    3⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:1492
                                                                                  • C:\Users\Admin\AppData\Local\avguix.exe
                                                                                    C:\Users\Admin\AppData\Local\avguix.exe
                                                                                    3⤵
                                                                                      PID:2208
                                                                                    • C:\Users\Admin\AppData\Local\avguix.exe
                                                                                      C:\Users\Admin\AppData\Local\avguix.exe
                                                                                      3⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:1668
                                                                                    • C:\Users\Admin\AppData\Local\avguix.exe
                                                                                      C:\Users\Admin\AppData\Local\avguix.exe
                                                                                      3⤵
                                                                                        PID:708
                                                                                      • C:\Users\Admin\AppData\Local\avguix.exe
                                                                                        C:\Users\Admin\AppData\Local\avguix.exe
                                                                                        3⤵
                                                                                          PID:2692
                                                                                        • C:\Users\Admin\AppData\Local\avguix.exe
                                                                                          C:\Users\Admin\AppData\Local\avguix.exe
                                                                                          3⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:2336
                                                                                        • C:\Users\Admin\AppData\Local\avguix.exe
                                                                                          C:\Users\Admin\AppData\Local\avguix.exe
                                                                                          3⤵
                                                                                            PID:2496
                                                                                          • C:\Users\Admin\AppData\Local\avguix.exe
                                                                                            C:\Users\Admin\AppData\Local\avguix.exe
                                                                                            3⤵
                                                                                              PID:1536
                                                                                            • C:\Users\Admin\AppData\Local\avguix.exe
                                                                                              C:\Users\Admin\AppData\Local\avguix.exe
                                                                                              3⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:2448
                                                                                            • C:\Users\Admin\AppData\Local\avguix.exe
                                                                                              C:\Users\Admin\AppData\Local\avguix.exe
                                                                                              3⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:1860
                                                                                            • C:\Users\Admin\AppData\Local\avguix.exe
                                                                                              C:\Users\Admin\AppData\Local\avguix.exe
                                                                                              3⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:468
                                                                                            • C:\Users\Admin\AppData\Local\avguix.exe
                                                                                              C:\Users\Admin\AppData\Local\avguix.exe
                                                                                              3⤵
                                                                                                PID:2104
                                                                                              • C:\Users\Admin\AppData\Local\avguix.exe
                                                                                                C:\Users\Admin\AppData\Local\avguix.exe
                                                                                                3⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:2312
                                                                                              • C:\Users\Admin\AppData\Local\avguix.exe
                                                                                                C:\Users\Admin\AppData\Local\avguix.exe
                                                                                                3⤵
                                                                                                  PID:1972
                                                                                                • C:\Users\Admin\AppData\Local\avguix.exe
                                                                                                  C:\Users\Admin\AppData\Local\avguix.exe
                                                                                                  3⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:1976
                                                                                                • C:\Users\Admin\AppData\Local\avguix.exe
                                                                                                  C:\Users\Admin\AppData\Local\avguix.exe
                                                                                                  3⤵
                                                                                                    PID:940
                                                                                                  • C:\Users\Admin\AppData\Local\avguix.exe
                                                                                                    C:\Users\Admin\AppData\Local\avguix.exe
                                                                                                    3⤵
                                                                                                      PID:2340

                                                                                                Network

                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                Replay Monitor

                                                                                                Loading Replay Monitor...

                                                                                                Downloads

                                                                                                • \Users\Admin\AppData\Local\Builder.exe

                                                                                                  Filesize

                                                                                                  444KB

                                                                                                  MD5

                                                                                                  5e31e7bf5871b8698ab9ab744ee06470

                                                                                                  SHA1

                                                                                                  89ff5acbd648f081b44ad80a5979dcb3f20c803a

                                                                                                  SHA256

                                                                                                  93c706af57ea44405ebfcc7beea6ac47836224938b363cbc3148fd3f20604f96

                                                                                                  SHA512

                                                                                                  653d01db57feb647898ee15d09f55e8efffcab0c3f29a12a0d50782d0ad87bf0a4503037b0a497681e26e9bd2ed50ffe10ab9529eca8b7db4f610165f842ce63

                                                                                                • \Users\Admin\AppData\Local\avguix.exe

                                                                                                  Filesize

                                                                                                  13.1MB

                                                                                                  MD5

                                                                                                  6a9c6979794cb76418468436863d9c0a

                                                                                                  SHA1

                                                                                                  45827af07a21ad6ce9625e229e2b99f6c81f9a39

                                                                                                  SHA256

                                                                                                  7d5d3ada6092553b21d75c4fe407a4692c63bd0548cb9d0a1675de61f1946c9c

                                                                                                  SHA512

                                                                                                  58475f6c34bf8252f823ee234a3950c5e89f2dac29697578643d3de8f9fdb47b1528bbf71b9280855ee279d385fde7e5d0522339830f67dd9814fb6f4082d681

                                                                                                • memory/268-71-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/272-63-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/288-109-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/320-22-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/444-113-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/652-69-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/804-111-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/976-131-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/1228-123-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/1324-125-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/1372-67-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/1412-59-0x0000000000230000-0x0000000000231000-memory.dmp

                                                                                                  Filesize

                                                                                                  4KB

                                                                                                • memory/1412-0-0x0000000000230000-0x0000000000231000-memory.dmp

                                                                                                  Filesize

                                                                                                  4KB

                                                                                                • memory/1412-37-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/1608-121-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/1620-77-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/1728-129-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/1748-65-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/1876-82-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/1892-75-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/1940-61-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/1944-119-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/1948-133-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/1952-79-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/1960-91-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/1968-117-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2004-84-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2060-17-0x0000000000230000-0x0000000000231000-memory.dmp

                                                                                                  Filesize

                                                                                                  4KB

                                                                                                • memory/2060-18-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2072-38-0x0000000000400000-0x0000000000475000-memory.dmp

                                                                                                  Filesize

                                                                                                  468KB

                                                                                                • memory/2072-10-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                                                                  Filesize

                                                                                                  4KB

                                                                                                • memory/2080-24-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2172-20-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2200-103-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2224-54-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2236-107-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2428-73-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2468-101-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2472-36-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2476-56-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2508-99-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2588-115-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2604-48-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2624-50-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2648-46-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2676-52-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2736-26-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2744-44-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2816-87-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2824-97-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2860-89-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2868-28-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2892-34-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2896-30-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2920-40-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2924-95-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2948-93-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2980-135-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/2988-42-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB

                                                                                                • memory/3024-32-0x0000000000400000-0x0000000001128000-memory.dmp

                                                                                                  Filesize

                                                                                                  13.2MB