Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10/08/2024, 07:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
854626d709144553dab9046034cd3a1b_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
854626d709144553dab9046034cd3a1b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
854626d709144553dab9046034cd3a1b_JaffaCakes118.exe
-
Size
525KB
-
MD5
854626d709144553dab9046034cd3a1b
-
SHA1
440be677ebba973b7dd272dea27437d6f6d96935
-
SHA256
4dd67b9a84d5e26ca7ce9827ee61c5841e7687772594e3557712b1719a0dcd7f
-
SHA512
670586fb4732f26ba1113dce580502953f2b6b1b77d9d09e04a03433e4da6e7e700c9bfe1b446158b77722470b0926d06c585b29a93a5e4c1cb90be1fd1e1c14
-
SSDEEP
12288:UJGUTkC1HqOW4SdF3Z4mxxhDqVTVOC/zRm4E3DMx:UoAkC5qORSdQmXoVTz/tEzO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4352 clipaed.exe 2584 clipaed.exe 1552 clipaed.exe 1408 clipaed.exe 1216 clipaed.exe 4692 clipaed.exe 2276 clipaed.exe 4568 clipaed.exe 2160 clipaed.exe 4940 clipaed.exe 3968 clipaed.exe 4768 clipaed.exe 3036 clipaed.exe 2200 clipaed.exe 3812 clipaed.exe 3592 clipaed.exe 1964 clipaed.exe 3956 clipaed.exe 2544 clipaed.exe 2320 clipaed.exe 1956 clipaed.exe 2776 clipaed.exe 1940 clipaed.exe 5108 clipaed.exe 4280 clipaed.exe 4372 clipaed.exe 4716 clipaed.exe 2532 clipaed.exe 1168 clipaed.exe 3664 clipaed.exe 4856 clipaed.exe 2688 clipaed.exe 1036 clipaed.exe 3864 clipaed.exe 2616 clipaed.exe 3092 clipaed.exe 3068 clipaed.exe 3764 clipaed.exe 4384 clipaed.exe 2600 clipaed.exe 2864 clipaed.exe 8 clipaed.exe 1628 clipaed.exe 3168 clipaed.exe 1776 clipaed.exe 3756 clipaed.exe 1364 clipaed.exe 4072 clipaed.exe 1012 clipaed.exe 4340 clipaed.exe 2324 clipaed.exe 1556 clipaed.exe 2500 clipaed.exe 4156 clipaed.exe 4548 clipaed.exe 3052 clipaed.exe 2360 clipaed.exe 5156 clipaed.exe 5200 clipaed.exe 5244 clipaed.exe 5288 clipaed.exe 5336 clipaed.exe 5376 clipaed.exe 5424 clipaed.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Library Update = "C:\\Windows\\System32\\clipaed.exe" clipaed.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\clipaed.exe clipaed.exe File created C:\Windows\SysWOW64\clipaed.exe clipaed.exe File created C:\Windows\SysWOW64\clipaed.exe clipaed.exe File opened for modification C:\Windows\SysWOW64\clipaed.exe Process not Found File created C:\Windows\SysWOW64\clipaed.exe clipaed.exe File created C:\Windows\SysWOW64\clipaed.exe clipaed.exe File opened for modification C:\Windows\SysWOW64\clipaed.exe Process not Found File created C:\Windows\SysWOW64\clipaed.exe clipaed.exe File created C:\Windows\SysWOW64\clipaed.exe clipaed.exe File created C:\Windows\SysWOW64\clipaed.exe Process not Found File created C:\Windows\SysWOW64\clipaed.exe clipaed.exe File opened for modification C:\Windows\SysWOW64\clipaed.exe clipaed.exe File opened for modification C:\Windows\SysWOW64\clipaed.exe clipaed.exe File opened for modification C:\Windows\SysWOW64\clipaed.exe Process not Found File created C:\Windows\SysWOW64\clipaed.exe clipaed.exe File opened for modification C:\Windows\SysWOW64\clipaed.exe clipaed.exe File created C:\Windows\SysWOW64\clipaed.exe clipaed.exe File opened for modification C:\Windows\SysWOW64\clipaed.exe clipaed.exe File opened for modification C:\Windows\SysWOW64\clipaed.exe clipaed.exe File opened for modification C:\Windows\SysWOW64\clipaed.exe clipaed.exe File opened for modification C:\Windows\SysWOW64\clipaed.exe Process not Found File opened for modification C:\Windows\SysWOW64\clipaed.exe clipaed.exe File opened for modification C:\Windows\SysWOW64\clipaed.exe clipaed.exe File opened for modification C:\Windows\SysWOW64\clipaed.exe Process not Found File created C:\Windows\SysWOW64\clipaed.exe clipaed.exe File created C:\Windows\SysWOW64\clipaed.exe clipaed.exe File created C:\Windows\SysWOW64\clipaed.exe Process not Found File created C:\Windows\SysWOW64\clipaed.exe clipaed.exe File opened for modification C:\Windows\SysWOW64\clipaed.exe clipaed.exe File opened for modification C:\Windows\SysWOW64\clipaed.exe clipaed.exe File created C:\Windows\SysWOW64\clipaed.exe clipaed.exe File created C:\Windows\SysWOW64\clipaed.exe clipaed.exe File opened for modification C:\Windows\SysWOW64\clipaed.exe clipaed.exe File opened for modification C:\Windows\SysWOW64\clipaed.exe Process not Found File created C:\Windows\SysWOW64\clipaed.exe clipaed.exe File created C:\Windows\SysWOW64\clipaed.exe clipaed.exe File created C:\Windows\SysWOW64\clipaed.exe clipaed.exe File created C:\Windows\SysWOW64\clipaed.exe clipaed.exe File opened for modification C:\Windows\SysWOW64\clipaed.exe clipaed.exe File created C:\Windows\SysWOW64\clipaed.exe Process not Found File opened for modification C:\Windows\SysWOW64\clipaed.exe clipaed.exe File created C:\Windows\SysWOW64\clipaed.exe clipaed.exe File opened for modification C:\Windows\SysWOW64\clipaed.exe clipaed.exe File opened for modification C:\Windows\SysWOW64\clipaed.exe clipaed.exe File opened for modification C:\Windows\SysWOW64\clipaed.exe clipaed.exe File created C:\Windows\SysWOW64\clipaed.exe Process not Found File created C:\Windows\SysWOW64\clipaed.exe clipaed.exe File created C:\Windows\SysWOW64\clipaed.exe clipaed.exe File created C:\Windows\SysWOW64\clipaed.exe clipaed.exe File opened for modification C:\Windows\SysWOW64\clipaed.exe Process not Found File created C:\Windows\SysWOW64\clipaed.exe Process not Found File opened for modification C:\Windows\SysWOW64\clipaed.exe Process not Found File created C:\Windows\SysWOW64\clipaed.exe Process not Found File created C:\Windows\SysWOW64\clipaed.exe Process not Found File opened for modification C:\Windows\SysWOW64\clipaed.exe Process not Found File opened for modification C:\Windows\SysWOW64\clipaed.exe Process not Found File created C:\Windows\SysWOW64\clipaed.exe Process not Found File opened for modification C:\Windows\SysWOW64\clipaed.exe Process not Found File created C:\Windows\SysWOW64\clipaed.exe Process not Found File opened for modification C:\Windows\SysWOW64\clipaed.exe clipaed.exe File opened for modification C:\Windows\SysWOW64\clipaed.exe clipaed.exe File opened for modification C:\Windows\SysWOW64\clipaed.exe clipaed.exe File created C:\Windows\SysWOW64\clipaed.exe clipaed.exe File opened for modification C:\Windows\SysWOW64\clipaed.exe clipaed.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clipaed.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4988 854626d709144553dab9046034cd3a1b_JaffaCakes118.exe 4988 854626d709144553dab9046034cd3a1b_JaffaCakes118.exe 4352 clipaed.exe 4352 clipaed.exe 2584 clipaed.exe 2584 clipaed.exe 1552 clipaed.exe 1552 clipaed.exe 1408 clipaed.exe 1408 clipaed.exe 1216 clipaed.exe 1216 clipaed.exe 4692 clipaed.exe 4692 clipaed.exe 2276 clipaed.exe 2276 clipaed.exe 4568 clipaed.exe 4568 clipaed.exe 2160 clipaed.exe 2160 clipaed.exe 4940 clipaed.exe 4940 clipaed.exe 3968 clipaed.exe 3968 clipaed.exe 4768 clipaed.exe 4768 clipaed.exe 3036 clipaed.exe 3036 clipaed.exe 2200 clipaed.exe 2200 clipaed.exe 3812 clipaed.exe 3812 clipaed.exe 3592 clipaed.exe 3592 clipaed.exe 1964 clipaed.exe 1964 clipaed.exe 3956 clipaed.exe 3956 clipaed.exe 2544 clipaed.exe 2544 clipaed.exe 2320 clipaed.exe 2320 clipaed.exe 1956 clipaed.exe 1956 clipaed.exe 2776 clipaed.exe 2776 clipaed.exe 1940 clipaed.exe 1940 clipaed.exe 5108 clipaed.exe 5108 clipaed.exe 4280 clipaed.exe 4280 clipaed.exe 4372 clipaed.exe 4372 clipaed.exe 4716 clipaed.exe 4716 clipaed.exe 2532 clipaed.exe 2532 clipaed.exe 1168 clipaed.exe 1168 clipaed.exe 3664 clipaed.exe 3664 clipaed.exe 4856 clipaed.exe 4856 clipaed.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4988 854626d709144553dab9046034cd3a1b_JaffaCakes118.exe 4352 clipaed.exe 2584 clipaed.exe 1552 clipaed.exe 1408 clipaed.exe 1216 clipaed.exe 4692 clipaed.exe 2276 clipaed.exe 4568 clipaed.exe 2160 clipaed.exe 4940 clipaed.exe 3968 clipaed.exe 4768 clipaed.exe 3036 clipaed.exe 2200 clipaed.exe 3812 clipaed.exe 3592 clipaed.exe 1964 clipaed.exe 3956 clipaed.exe 2544 clipaed.exe 2320 clipaed.exe 1956 clipaed.exe 2776 clipaed.exe 1940 clipaed.exe 5108 clipaed.exe 4280 clipaed.exe 4372 clipaed.exe 4716 clipaed.exe 2532 clipaed.exe 1168 clipaed.exe 3664 clipaed.exe 4856 clipaed.exe 2688 clipaed.exe 1036 clipaed.exe 3864 clipaed.exe 2616 clipaed.exe 3092 clipaed.exe 3068 clipaed.exe 3764 clipaed.exe 4384 clipaed.exe 2600 clipaed.exe 2864 clipaed.exe 8 clipaed.exe 1628 clipaed.exe 3168 clipaed.exe 1776 clipaed.exe 3756 clipaed.exe 1364 clipaed.exe 4072 clipaed.exe 1012 clipaed.exe 4340 clipaed.exe 2324 clipaed.exe 1556 clipaed.exe 2500 clipaed.exe 4156 clipaed.exe 4548 clipaed.exe 3052 clipaed.exe 2360 clipaed.exe 5156 clipaed.exe 5200 clipaed.exe 5244 clipaed.exe 5288 clipaed.exe 5336 clipaed.exe 5376 clipaed.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4988 wrote to memory of 4352 4988 854626d709144553dab9046034cd3a1b_JaffaCakes118.exe 84 PID 4988 wrote to memory of 4352 4988 854626d709144553dab9046034cd3a1b_JaffaCakes118.exe 84 PID 4988 wrote to memory of 4352 4988 854626d709144553dab9046034cd3a1b_JaffaCakes118.exe 84 PID 4352 wrote to memory of 2584 4352 clipaed.exe 86 PID 4352 wrote to memory of 2584 4352 clipaed.exe 86 PID 4352 wrote to memory of 2584 4352 clipaed.exe 86 PID 2584 wrote to memory of 1552 2584 clipaed.exe 87 PID 2584 wrote to memory of 1552 2584 clipaed.exe 87 PID 2584 wrote to memory of 1552 2584 clipaed.exe 87 PID 1552 wrote to memory of 1408 1552 clipaed.exe 88 PID 1552 wrote to memory of 1408 1552 clipaed.exe 88 PID 1552 wrote to memory of 1408 1552 clipaed.exe 88 PID 1408 wrote to memory of 1216 1408 clipaed.exe 90 PID 1408 wrote to memory of 1216 1408 clipaed.exe 90 PID 1408 wrote to memory of 1216 1408 clipaed.exe 90 PID 1216 wrote to memory of 4692 1216 clipaed.exe 92 PID 1216 wrote to memory of 4692 1216 clipaed.exe 92 PID 1216 wrote to memory of 4692 1216 clipaed.exe 92 PID 4692 wrote to memory of 2276 4692 clipaed.exe 93 PID 4692 wrote to memory of 2276 4692 clipaed.exe 93 PID 4692 wrote to memory of 2276 4692 clipaed.exe 93 PID 2276 wrote to memory of 4568 2276 clipaed.exe 95 PID 2276 wrote to memory of 4568 2276 clipaed.exe 95 PID 2276 wrote to memory of 4568 2276 clipaed.exe 95 PID 4568 wrote to memory of 2160 4568 clipaed.exe 96 PID 4568 wrote to memory of 2160 4568 clipaed.exe 96 PID 4568 wrote to memory of 2160 4568 clipaed.exe 96 PID 2160 wrote to memory of 4940 2160 clipaed.exe 97 PID 2160 wrote to memory of 4940 2160 clipaed.exe 97 PID 2160 wrote to memory of 4940 2160 clipaed.exe 97 PID 4940 wrote to memory of 3968 4940 clipaed.exe 98 PID 4940 wrote to memory of 3968 4940 clipaed.exe 98 PID 4940 wrote to memory of 3968 4940 clipaed.exe 98 PID 3968 wrote to memory of 4768 3968 clipaed.exe 99 PID 3968 wrote to memory of 4768 3968 clipaed.exe 99 PID 3968 wrote to memory of 4768 3968 clipaed.exe 99 PID 4768 wrote to memory of 3036 4768 clipaed.exe 100 PID 4768 wrote to memory of 3036 4768 clipaed.exe 100 PID 4768 wrote to memory of 3036 4768 clipaed.exe 100 PID 3036 wrote to memory of 2200 3036 clipaed.exe 101 PID 3036 wrote to memory of 2200 3036 clipaed.exe 101 PID 3036 wrote to memory of 2200 3036 clipaed.exe 101 PID 2200 wrote to memory of 3812 2200 clipaed.exe 102 PID 2200 wrote to memory of 3812 2200 clipaed.exe 102 PID 2200 wrote to memory of 3812 2200 clipaed.exe 102 PID 3812 wrote to memory of 3592 3812 clipaed.exe 103 PID 3812 wrote to memory of 3592 3812 clipaed.exe 103 PID 3812 wrote to memory of 3592 3812 clipaed.exe 103 PID 3592 wrote to memory of 1964 3592 clipaed.exe 104 PID 3592 wrote to memory of 1964 3592 clipaed.exe 104 PID 3592 wrote to memory of 1964 3592 clipaed.exe 104 PID 1964 wrote to memory of 3956 1964 clipaed.exe 105 PID 1964 wrote to memory of 3956 1964 clipaed.exe 105 PID 1964 wrote to memory of 3956 1964 clipaed.exe 105 PID 3956 wrote to memory of 2544 3956 clipaed.exe 106 PID 3956 wrote to memory of 2544 3956 clipaed.exe 106 PID 3956 wrote to memory of 2544 3956 clipaed.exe 106 PID 2544 wrote to memory of 2320 2544 clipaed.exe 107 PID 2544 wrote to memory of 2320 2544 clipaed.exe 107 PID 2544 wrote to memory of 2320 2544 clipaed.exe 107 PID 2320 wrote to memory of 1956 2320 clipaed.exe 108 PID 2320 wrote to memory of 1956 2320 clipaed.exe 108 PID 2320 wrote to memory of 1956 2320 clipaed.exe 108 PID 1956 wrote to memory of 2776 1956 clipaed.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\854626d709144553dab9046034cd3a1b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\854626d709144553dab9046034cd3a1b_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install10⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install12⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install14⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install16⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install18⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install20⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install22⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2776 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install24⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1940 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5108 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install26⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4280 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4372 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install28⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4716 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2532 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install30⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1168 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3664 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install32⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4856 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2688 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install34⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1036 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install35⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3864 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install36⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2616 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install37⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:3092 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install38⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3068 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install39⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3764 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install40⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4384 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install41⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2600 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install42⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2864 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install43⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:8 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install44⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1628 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install45⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3168 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install46⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1776 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install47⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3756 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install48⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1364 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4072 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install50⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1012 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install51⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4340 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install52⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2324 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install53⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1556 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install54⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2500 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install55⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4156 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install56⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4548 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install57⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3052 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install58⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2360 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install59⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5156 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install60⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5200 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install61⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5244 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install62⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5288 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install63⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5336 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install64⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5376 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install65⤵
- Executes dropped EXE
PID:5424 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install66⤵PID:5468
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install67⤵PID:5508
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install68⤵PID:5548
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install69⤵PID:5584
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install70⤵PID:5620
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install71⤵PID:5660
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install72⤵PID:5692
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install73⤵PID:5724
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install74⤵PID:5756
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install75⤵PID:5788
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install76⤵PID:5820
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install77⤵
- Drops file in System32 directory
PID:5856 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install78⤵PID:5888
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install79⤵
- Drops file in System32 directory
PID:5920 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install80⤵PID:5952
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install81⤵PID:5984
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install82⤵PID:6020
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install83⤵PID:6052
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install84⤵PID:6084
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install85⤵PID:6116
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install86⤵PID:5124
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install87⤵PID:5220
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install88⤵PID:984
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install89⤵PID:5360
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install90⤵PID:5452
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install91⤵PID:5536
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install92⤵PID:5640
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install93⤵PID:5744
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install94⤵PID:5904
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install95⤵PID:6100
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install96⤵PID:5324
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install97⤵PID:5840
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install98⤵PID:6040
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install99⤵PID:5252
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install100⤵PID:4360
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install101⤵
- Drops file in System32 directory
PID:2632 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install102⤵PID:2524
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install103⤵PID:3064
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install104⤵PID:4936
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install105⤵PID:3564
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install106⤵PID:1016
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install107⤵PID:4076
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install108⤵PID:4568
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install109⤵PID:3800
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install110⤵PID:3488
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install111⤵PID:3968
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install112⤵PID:2168
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install113⤵PID:3420
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install114⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4896 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install115⤵PID:5600
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install116⤵PID:2160
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install117⤵PID:2252
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install118⤵
- Drops file in System32 directory
PID:2760 -
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install119⤵PID:4000
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install120⤵PID:4684
-
C:\Windows\SysWOW64\clipaed.exeC:\Windows\System32\clipaed.exe after_install121⤵PID:4624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-