Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2024, 07:44
Static task
static1
Behavioral task
behavioral1
Sample
b2a38561450e0c3b850c3ba28a784b67_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b2a38561450e0c3b850c3ba28a784b67_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b2a38561450e0c3b850c3ba28a784b67_JaffaCakes118.exe
-
Size
5KB
-
MD5
b2a38561450e0c3b850c3ba28a784b67
-
SHA1
647e331570834dd065c99a04e411e151323866d6
-
SHA256
be86117905bbc21d612207bf3f062ed218ecc43cdac6c1d2f357684af2ec7817
-
SHA512
c262b23df92a400c0e6848235b2da0c5fd2e76f36b4c9f95b0077ba7a5ed50fd1759fc91600a4708fc57e5693e1f609d0c9d8adfea5fbdb0636bbe8a99f5dd34
-
SSDEEP
96:+HFqcvkA9f9bHY4LoEPEmAeZqtdn6GrCr:+HkccA99iO4e0tdnvQ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 208 z.exe 4836 z.exe 212 z.exe 2372 z.exe 4592 z.exe 1328 z.exe 1484 z.exe 2816 z.exe 1860 z.exe 4300 z.exe 3064 z.exe 3092 z.exe 5024 z.exe 4236 z.exe 3784 z.exe 996 z.exe 1276 z.exe 740 z.exe 436 z.exe 1372 z.exe 3480 z.exe 3248 z.exe 4432 z.exe 3820 z.exe 3980 z.exe 3368 z.exe 3516 z.exe 2088 z.exe 1448 z.exe 4004 z.exe 4900 z.exe 1168 z.exe 2044 z.exe 2928 z.exe 5096 z.exe 2464 z.exe 2336 z.exe 3540 z.exe 3644 z.exe 4632 z.exe 3464 z.exe 548 z.exe 1736 z.exe 4740 z.exe 3928 z.exe 60 z.exe 2624 z.exe 4184 z.exe 4160 z.exe 880 z.exe 3268 z.exe 4196 z.exe 4312 z.exe 1656 z.exe 1968 z.exe 400 z.exe 388 z.exe 4244 z.exe 3456 z.exe 4140 z.exe 972 z.exe 4284 z.exe 4720 z.exe 4784 z.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created \??\c:\windows\SysWOW64\z.exe z.exe File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe z.exe File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe z.exe File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe z.exe File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe z.exe File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe z.exe File created \??\c:\windows\SysWOW64\z.exe z.exe File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe z.exe File created \??\c:\windows\SysWOW64\z.exe z.exe File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe z.exe File created \??\c:\windows\SysWOW64\z.exe z.exe File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe z.exe File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe z.exe File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe z.exe File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found File created \??\c:\windows\SysWOW64\z.exe Process not Found -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3132 wrote to memory of 208 3132 b2a38561450e0c3b850c3ba28a784b67_JaffaCakes118.exe 84 PID 3132 wrote to memory of 208 3132 b2a38561450e0c3b850c3ba28a784b67_JaffaCakes118.exe 84 PID 3132 wrote to memory of 208 3132 b2a38561450e0c3b850c3ba28a784b67_JaffaCakes118.exe 84 PID 208 wrote to memory of 4836 208 z.exe 85 PID 208 wrote to memory of 4836 208 z.exe 85 PID 208 wrote to memory of 4836 208 z.exe 85 PID 4836 wrote to memory of 212 4836 z.exe 86 PID 4836 wrote to memory of 212 4836 z.exe 86 PID 4836 wrote to memory of 212 4836 z.exe 86 PID 212 wrote to memory of 2372 212 z.exe 87 PID 212 wrote to memory of 2372 212 z.exe 87 PID 212 wrote to memory of 2372 212 z.exe 87 PID 2372 wrote to memory of 4592 2372 z.exe 88 PID 2372 wrote to memory of 4592 2372 z.exe 88 PID 2372 wrote to memory of 4592 2372 z.exe 88 PID 4592 wrote to memory of 1328 4592 z.exe 89 PID 4592 wrote to memory of 1328 4592 z.exe 89 PID 4592 wrote to memory of 1328 4592 z.exe 89 PID 1328 wrote to memory of 1484 1328 z.exe 90 PID 1328 wrote to memory of 1484 1328 z.exe 90 PID 1328 wrote to memory of 1484 1328 z.exe 90 PID 1484 wrote to memory of 2816 1484 z.exe 91 PID 1484 wrote to memory of 2816 1484 z.exe 91 PID 1484 wrote to memory of 2816 1484 z.exe 91 PID 2816 wrote to memory of 1860 2816 z.exe 92 PID 2816 wrote to memory of 1860 2816 z.exe 92 PID 2816 wrote to memory of 1860 2816 z.exe 92 PID 1860 wrote to memory of 4300 1860 z.exe 93 PID 1860 wrote to memory of 4300 1860 z.exe 93 PID 1860 wrote to memory of 4300 1860 z.exe 93 PID 4300 wrote to memory of 3064 4300 z.exe 94 PID 4300 wrote to memory of 3064 4300 z.exe 94 PID 4300 wrote to memory of 3064 4300 z.exe 94 PID 3064 wrote to memory of 3092 3064 z.exe 95 PID 3064 wrote to memory of 3092 3064 z.exe 95 PID 3064 wrote to memory of 3092 3064 z.exe 95 PID 3092 wrote to memory of 5024 3092 z.exe 96 PID 3092 wrote to memory of 5024 3092 z.exe 96 PID 3092 wrote to memory of 5024 3092 z.exe 96 PID 5024 wrote to memory of 4236 5024 z.exe 97 PID 5024 wrote to memory of 4236 5024 z.exe 97 PID 5024 wrote to memory of 4236 5024 z.exe 97 PID 4236 wrote to memory of 3784 4236 z.exe 98 PID 4236 wrote to memory of 3784 4236 z.exe 98 PID 4236 wrote to memory of 3784 4236 z.exe 98 PID 3784 wrote to memory of 996 3784 z.exe 99 PID 3784 wrote to memory of 996 3784 z.exe 99 PID 3784 wrote to memory of 996 3784 z.exe 99 PID 996 wrote to memory of 1276 996 z.exe 100 PID 996 wrote to memory of 1276 996 z.exe 100 PID 996 wrote to memory of 1276 996 z.exe 100 PID 1276 wrote to memory of 740 1276 z.exe 101 PID 1276 wrote to memory of 740 1276 z.exe 101 PID 1276 wrote to memory of 740 1276 z.exe 101 PID 740 wrote to memory of 436 740 z.exe 102 PID 740 wrote to memory of 436 740 z.exe 102 PID 740 wrote to memory of 436 740 z.exe 102 PID 436 wrote to memory of 1372 436 z.exe 103 PID 436 wrote to memory of 1372 436 z.exe 103 PID 436 wrote to memory of 1372 436 z.exe 103 PID 1372 wrote to memory of 3480 1372 z.exe 104 PID 1372 wrote to memory of 3480 1372 z.exe 104 PID 1372 wrote to memory of 3480 1372 z.exe 104 PID 3480 wrote to memory of 3248 3480 z.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2a38561450e0c3b850c3ba28a784b67_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b2a38561450e0c3b850c3ba28a784b67_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe23⤵
- Executes dropped EXE
PID:3248 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe24⤵
- Executes dropped EXE
PID:4432 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe25⤵
- Executes dropped EXE
PID:3820 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe26⤵
- Executes dropped EXE
PID:3980 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe27⤵
- Executes dropped EXE
PID:3368 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe28⤵
- Executes dropped EXE
PID:3516 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe29⤵
- Executes dropped EXE
PID:2088 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe30⤵
- Executes dropped EXE
PID:1448 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4004 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe32⤵
- Executes dropped EXE
PID:4900 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe33⤵
- Executes dropped EXE
PID:1168 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe34⤵
- Executes dropped EXE
PID:2044 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe35⤵
- Executes dropped EXE
PID:2928 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe36⤵
- Executes dropped EXE
PID:5096 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe37⤵
- Executes dropped EXE
PID:2464 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe38⤵
- Executes dropped EXE
PID:2336 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe39⤵
- Executes dropped EXE
PID:3540 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe40⤵
- Executes dropped EXE
PID:3644 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe41⤵
- Executes dropped EXE
PID:4632 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe42⤵
- Executes dropped EXE
PID:3464 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe43⤵
- Executes dropped EXE
PID:548 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe44⤵
- Executes dropped EXE
PID:1736 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe45⤵
- Executes dropped EXE
PID:4740 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe46⤵
- Executes dropped EXE
PID:3928 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe47⤵
- Executes dropped EXE
PID:60 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe48⤵
- Executes dropped EXE
PID:2624 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe49⤵
- Executes dropped EXE
PID:4184 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe50⤵
- Executes dropped EXE
PID:4160 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe51⤵
- Executes dropped EXE
PID:880 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe52⤵
- Executes dropped EXE
PID:3268 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe53⤵
- Executes dropped EXE
PID:4196 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe54⤵
- Executes dropped EXE
PID:4312 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1656 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe56⤵
- Executes dropped EXE
PID:1968 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe57⤵
- Executes dropped EXE
PID:400 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe58⤵
- Executes dropped EXE
PID:388 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe59⤵
- Executes dropped EXE
PID:4244 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe60⤵
- Executes dropped EXE
PID:3456 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe61⤵
- Executes dropped EXE
PID:4140 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe62⤵
- Executes dropped EXE
PID:972 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe63⤵
- Executes dropped EXE
PID:4284 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe64⤵
- Executes dropped EXE
PID:4720 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe65⤵
- Executes dropped EXE
PID:4784 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe66⤵PID:3924
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe67⤵PID:2008
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe68⤵
- Drops file in System32 directory
PID:4008 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe69⤵PID:1924
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe70⤵PID:4412
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe71⤵PID:1668
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe72⤵PID:4816
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe73⤵PID:3152
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe74⤵PID:1444
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe75⤵PID:4352
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe76⤵PID:4444
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe77⤵PID:2436
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe78⤵PID:2368
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe79⤵PID:3476
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe80⤵PID:2372
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe81⤵PID:4592
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe82⤵PID:5008
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe83⤵PID:4084
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe84⤵PID:1744
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe85⤵PID:1844
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe86⤵PID:1172
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe87⤵PID:2176
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe88⤵PID:224
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe89⤵PID:4716
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe90⤵PID:3784
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe91⤵PID:996
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe92⤵PID:4436
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe93⤵PID:3192
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe94⤵PID:4916
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe95⤵PID:4376
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe96⤵PID:3012
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe97⤵PID:3528
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe98⤵PID:2936
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe99⤵PID:2824
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe100⤵
- Drops file in System32 directory
PID:4432 -
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe101⤵PID:2076
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe102⤵PID:3916
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe103⤵PID:2756
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe104⤵PID:2064
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe105⤵PID:876
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe106⤵PID:2664
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe107⤵PID:3416
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe108⤵PID:2088
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe109⤵PID:1448
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe110⤵PID:516
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe111⤵PID:3632
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe112⤵PID:3080
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe113⤵PID:2044
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe114⤵PID:2616
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe115⤵PID:4852
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe116⤵PID:3292
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe117⤵PID:3956
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe118⤵PID:2404
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe119⤵PID:3920
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe120⤵PID:3644
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe121⤵PID:1808
-
\??\c:\windows\SysWOW64\z.exec:\windows\system32\z.exe122⤵PID:1504
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-