Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2024, 05:31
Static task
static1
Behavioral task
behavioral1
Sample
8336c23c7f9f87368b71f651fb37de83_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8336c23c7f9f87368b71f651fb37de83_JaffaCakes118.exe
Resource
win10v2004-20240730-en
General
-
Target
8336c23c7f9f87368b71f651fb37de83_JaffaCakes118.exe
-
Size
140KB
-
MD5
8336c23c7f9f87368b71f651fb37de83
-
SHA1
bf5c5f011d033ae59b08f45ac9780a3bcad36a7a
-
SHA256
df040357e5822c2259c022d72ab90855fd777c54cd8922f8f07c00f8ac95e6b5
-
SHA512
3eef38e80df85974bf12d3c4d34c2f3e2b052e03aa09e558ad20141d6a20c2560f4a14b354129cff26f8dae0e3756c14a4fe00e24a11f47b39ae604e398f8dc2
-
SSDEEP
3072:aPnMMF3mKLyD2c5NvvH9H2r6BhraivprqU07F51I:ObRe6cXpAivpmU0n1I
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 408 gxserv23.exe 1556 gxserv23.exe 2668 gxserv23.exe 1104 gxserv23.exe 2820 gxserv23.exe 1116 gxserv23.exe 1180 gxserv23.exe 4496 gxserv23.exe 2072 gxserv23.exe 224 gxserv23.exe 840 gxserv23.exe 2176 gxserv23.exe 4180 gxserv23.exe 3004 gxserv23.exe 3140 gxserv23.exe 3760 gxserv23.exe 3556 gxserv23.exe 2640 gxserv23.exe 1916 gxserv23.exe 1684 gxserv23.exe 3736 gxserv23.exe 1136 gxserv23.exe 5008 gxserv23.exe 4648 gxserv23.exe 2824 gxserv23.exe 372 gxserv23.exe 2132 gxserv23.exe 3060 gxserv23.exe 2808 gxserv23.exe 2452 gxserv23.exe 3420 gxserv23.exe 3160 gxserv23.exe 1536 gxserv23.exe 3652 gxserv23.exe 880 gxserv23.exe 432 gxserv23.exe 936 gxserv23.exe 3364 gxserv23.exe 1524 gxserv23.exe 1732 gxserv23.exe 1080 gxserv23.exe 1652 gxserv23.exe 4388 gxserv23.exe 4988 gxserv23.exe 4512 gxserv23.exe 1220 gxserv23.exe 4284 gxserv23.exe 3056 gxserv23.exe 1816 gxserv23.exe 1644 gxserv23.exe 3308 gxserv23.exe 3856 gxserv23.exe 5000 gxserv23.exe 1248 gxserv23.exe 4208 gxserv23.exe 2672 gxserv23.exe 4344 gxserv23.exe 4328 gxserv23.exe 3220 gxserv23.exe 3192 gxserv23.exe 2272 gxserv23.exe 3444 gxserv23.exe 2424 gxserv23.exe 2704 gxserv23.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe gxserv23.exe File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe gxserv23.exe File created C:\Windows\SysWOW64\gxserv23.exe gxserv23.exe File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe gxserv23.exe File created C:\Windows\SysWOW64\gxserv23.exe gxserv23.exe File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe gxserv23.exe File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe gxserv23.exe File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe gxserv23.exe File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe gxserv23.exe File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe gxserv23.exe File created C:\Windows\SysWOW64\gxserv23.exe gxserv23.exe File created C:\Windows\SysWOW64\gxserv23.exe gxserv23.exe File created C:\Windows\SysWOW64\gxserv23.exe gxserv23.exe File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe gxserv23.exe File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe gxserv23.exe File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe gxserv23.exe File created C:\Windows\SysWOW64\gxserv23.exe gxserv23.exe File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe gxserv23.exe File created C:\Windows\SysWOW64\gxserv23.exe Process not Found File created C:\Windows\SysWOW64\gxserv23.exe Process not Found -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gxserv23.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gxserv23.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gxserv23.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gxserv23.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gxserv23.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gxserv23.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gxserv23.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gxserv23.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gxserv23.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gxserv23.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gxserv23.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gxserv23.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4660 wrote to memory of 408 4660 8336c23c7f9f87368b71f651fb37de83_JaffaCakes118.exe 83 PID 4660 wrote to memory of 408 4660 8336c23c7f9f87368b71f651fb37de83_JaffaCakes118.exe 83 PID 4660 wrote to memory of 408 4660 8336c23c7f9f87368b71f651fb37de83_JaffaCakes118.exe 83 PID 408 wrote to memory of 1556 408 gxserv23.exe 85 PID 408 wrote to memory of 1556 408 gxserv23.exe 85 PID 408 wrote to memory of 1556 408 gxserv23.exe 85 PID 1556 wrote to memory of 2668 1556 gxserv23.exe 87 PID 1556 wrote to memory of 2668 1556 gxserv23.exe 87 PID 1556 wrote to memory of 2668 1556 gxserv23.exe 87 PID 2668 wrote to memory of 1104 2668 gxserv23.exe 89 PID 2668 wrote to memory of 1104 2668 gxserv23.exe 89 PID 2668 wrote to memory of 1104 2668 gxserv23.exe 89 PID 1104 wrote to memory of 2820 1104 gxserv23.exe 90 PID 1104 wrote to memory of 2820 1104 gxserv23.exe 90 PID 1104 wrote to memory of 2820 1104 gxserv23.exe 90 PID 2820 wrote to memory of 1116 2820 gxserv23.exe 91 PID 2820 wrote to memory of 1116 2820 gxserv23.exe 91 PID 2820 wrote to memory of 1116 2820 gxserv23.exe 91 PID 1116 wrote to memory of 1180 1116 gxserv23.exe 92 PID 1116 wrote to memory of 1180 1116 gxserv23.exe 92 PID 1116 wrote to memory of 1180 1116 gxserv23.exe 92 PID 1180 wrote to memory of 4496 1180 gxserv23.exe 93 PID 1180 wrote to memory of 4496 1180 gxserv23.exe 93 PID 1180 wrote to memory of 4496 1180 gxserv23.exe 93 PID 4496 wrote to memory of 2072 4496 gxserv23.exe 94 PID 4496 wrote to memory of 2072 4496 gxserv23.exe 94 PID 4496 wrote to memory of 2072 4496 gxserv23.exe 94 PID 2072 wrote to memory of 224 2072 gxserv23.exe 95 PID 2072 wrote to memory of 224 2072 gxserv23.exe 95 PID 2072 wrote to memory of 224 2072 gxserv23.exe 95 PID 224 wrote to memory of 840 224 gxserv23.exe 96 PID 224 wrote to memory of 840 224 gxserv23.exe 96 PID 224 wrote to memory of 840 224 gxserv23.exe 96 PID 840 wrote to memory of 2176 840 gxserv23.exe 97 PID 840 wrote to memory of 2176 840 gxserv23.exe 97 PID 840 wrote to memory of 2176 840 gxserv23.exe 97 PID 2176 wrote to memory of 4180 2176 gxserv23.exe 98 PID 2176 wrote to memory of 4180 2176 gxserv23.exe 98 PID 2176 wrote to memory of 4180 2176 gxserv23.exe 98 PID 4180 wrote to memory of 3004 4180 gxserv23.exe 99 PID 4180 wrote to memory of 3004 4180 gxserv23.exe 99 PID 4180 wrote to memory of 3004 4180 gxserv23.exe 99 PID 3004 wrote to memory of 3140 3004 gxserv23.exe 100 PID 3004 wrote to memory of 3140 3004 gxserv23.exe 100 PID 3004 wrote to memory of 3140 3004 gxserv23.exe 100 PID 3140 wrote to memory of 3760 3140 gxserv23.exe 101 PID 3140 wrote to memory of 3760 3140 gxserv23.exe 101 PID 3140 wrote to memory of 3760 3140 gxserv23.exe 101 PID 3760 wrote to memory of 3556 3760 gxserv23.exe 102 PID 3760 wrote to memory of 3556 3760 gxserv23.exe 102 PID 3760 wrote to memory of 3556 3760 gxserv23.exe 102 PID 3556 wrote to memory of 2640 3556 gxserv23.exe 103 PID 3556 wrote to memory of 2640 3556 gxserv23.exe 103 PID 3556 wrote to memory of 2640 3556 gxserv23.exe 103 PID 2640 wrote to memory of 1916 2640 gxserv23.exe 104 PID 2640 wrote to memory of 1916 2640 gxserv23.exe 104 PID 2640 wrote to memory of 1916 2640 gxserv23.exe 104 PID 1916 wrote to memory of 1684 1916 gxserv23.exe 105 PID 1916 wrote to memory of 1684 1916 gxserv23.exe 105 PID 1916 wrote to memory of 1684 1916 gxserv23.exe 105 PID 1684 wrote to memory of 3736 1684 gxserv23.exe 106 PID 1684 wrote to memory of 3736 1684 gxserv23.exe 106 PID 1684 wrote to memory of 3736 1684 gxserv23.exe 106 PID 3736 wrote to memory of 1136 3736 gxserv23.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\8336c23c7f9f87368b71f651fb37de83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8336c23c7f9f87368b71f651fb37de83_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"23⤵
- Executes dropped EXE
PID:1136 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"24⤵
- Executes dropped EXE
PID:5008 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"25⤵
- Executes dropped EXE
PID:4648 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"26⤵
- Executes dropped EXE
PID:2824 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"27⤵
- Executes dropped EXE
PID:372 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"28⤵
- Executes dropped EXE
PID:2132 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"29⤵
- Executes dropped EXE
PID:3060 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"30⤵
- Executes dropped EXE
PID:2808 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"31⤵
- Executes dropped EXE
PID:2452 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"32⤵
- Executes dropped EXE
PID:3420 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"33⤵
- Executes dropped EXE
PID:3160 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"34⤵
- Executes dropped EXE
PID:1536 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"35⤵
- Executes dropped EXE
PID:3652 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"36⤵
- Executes dropped EXE
PID:880 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"37⤵
- Executes dropped EXE
PID:432 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"38⤵
- Executes dropped EXE
PID:936 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"39⤵
- Executes dropped EXE
PID:3364 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"40⤵
- Executes dropped EXE
PID:1524 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"41⤵
- Executes dropped EXE
PID:1732 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"42⤵
- Executes dropped EXE
PID:1080 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"43⤵
- Executes dropped EXE
PID:1652 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"44⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4388 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"45⤵
- Executes dropped EXE
PID:4988 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"46⤵
- Executes dropped EXE
PID:4512 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"47⤵
- Executes dropped EXE
PID:1220 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"48⤵
- Executes dropped EXE
PID:4284 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"49⤵
- Executes dropped EXE
PID:3056 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"50⤵
- Executes dropped EXE
PID:1816 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"51⤵
- Executes dropped EXE
PID:1644 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"52⤵
- Executes dropped EXE
PID:3308 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"53⤵
- Executes dropped EXE
PID:3856 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"54⤵
- Executes dropped EXE
PID:5000 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"55⤵
- Executes dropped EXE
PID:1248 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"56⤵
- Executes dropped EXE
PID:4208 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"57⤵
- Executes dropped EXE
PID:2672 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"58⤵
- Executes dropped EXE
PID:4344 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"59⤵
- Executes dropped EXE
PID:4328 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"60⤵
- Executes dropped EXE
PID:3220 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"61⤵
- Executes dropped EXE
PID:3192 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"62⤵
- Executes dropped EXE
PID:2272 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"63⤵
- Executes dropped EXE
PID:3444 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"64⤵
- Executes dropped EXE
PID:2424 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"65⤵
- Executes dropped EXE
PID:2704 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"66⤵PID:4896
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"67⤵PID:1704
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"68⤵PID:1940
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"69⤵PID:4640
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"70⤵PID:5056
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"71⤵PID:3588
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"72⤵PID:1400
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"73⤵PID:3352
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"74⤵PID:228
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"75⤵PID:3372
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"76⤵PID:2052
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"77⤵PID:2128
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"78⤵PID:1504
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"79⤵PID:3100
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"80⤵PID:3348
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"81⤵PID:5048
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"82⤵PID:3428
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"83⤵PID:3868
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"84⤵PID:4336
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"85⤵PID:3376
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"86⤵PID:728
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"87⤵PID:1684
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"88⤵PID:4728
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"89⤵PID:1984
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"90⤵PID:3632
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"91⤵PID:4644
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"92⤵PID:624
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"93⤵PID:4048
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"94⤵PID:3568
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"95⤵PID:3120
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"96⤵PID:4824
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"97⤵PID:4620
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"98⤵PID:4128
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"99⤵PID:4956
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"100⤵PID:4500
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"101⤵PID:4768
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"102⤵PID:1928
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"103⤵
- Drops file in System32 directory
PID:4380 -
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"104⤵PID:4780
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"105⤵PID:1260
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"106⤵PID:3396
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"107⤵PID:3404
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"108⤵PID:868
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"109⤵PID:1484
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"110⤵PID:1732
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"111⤵PID:4532
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"112⤵PID:4556
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"113⤵PID:4892
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"114⤵PID:3368
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"115⤵PID:4552
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"116⤵PID:3708
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"117⤵PID:3912
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"118⤵PID:1268
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"119⤵PID:2496
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"120⤵PID:1816
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"121⤵PID:3820
-
C:\Windows\SysWOW64\gxserv23.exe"C:\Windows\system32\gxserv23.exe"122⤵PID:4044
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-