Analysis
-
max time kernel
77s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
24/08/2024, 19:02
Behavioral task
behavioral1
Sample
bf38333a1243cf12ea3216cc2f07bd24_JaffaCakes118.exe
Resource
win7-20240705-en
7 signatures
150 seconds
General
-
Target
bf38333a1243cf12ea3216cc2f07bd24_JaffaCakes118.exe
-
Size
28KB
-
MD5
bf38333a1243cf12ea3216cc2f07bd24
-
SHA1
53c8653bc4cf317b3d8c1cdbd9aa6a65b8bdc308
-
SHA256
27f10960594dc8b1c59001087b6027c19a583bea16ce4cac19efa71ed0b2e548
-
SHA512
84ba45f4fefc3bc70cf470c11a93ddf1613df5aa1562bd808020b916c9ced96bcfd45a67ad78fcf7c986686586a1cc19e49ad44977d4ed06a229350248818c11
-
SSDEEP
768:SKH3OqDqRniZdPHeELIO3FrDyUxfha5G:SKXvGmdfeEsetOmP
Malware Config
Signatures
-
resource yara_rule behavioral1/files/0x0005000000010300-8.dat aspack_v212_v242 -
Executes dropped EXE 64 IoCs
pid Process 2640 wintemp.exe 2644 wintemp.exe 2540 wintemp.exe 2084 wintemp.exe 1940 wintemp.exe 1956 wintemp.exe 2772 wintemp.exe 1220 wintemp.exe 2612 wintemp.exe 2860 wintemp.exe 2104 wintemp.exe 588 wintemp.exe 1240 wintemp.exe 2160 wintemp.exe 2184 wintemp.exe 748 wintemp.exe 108 wintemp.exe 1512 wintemp.exe 2380 wintemp.exe 3032 wintemp.exe 1676 wintemp.exe 3052 wintemp.exe 1316 wintemp.exe 2388 wintemp.exe 1320 wintemp.exe 2436 wintemp.exe 1616 wintemp.exe 2832 wintemp.exe 2852 wintemp.exe 2664 wintemp.exe 1564 wintemp.exe 2480 wintemp.exe 656 wintemp.exe 1524 wintemp.exe 1440 wintemp.exe 3024 wintemp.exe 2496 wintemp.exe 1496 wintemp.exe 2740 wintemp.exe 2600 wintemp.exe 2212 wintemp.exe 540 wintemp.exe 2348 wintemp.exe 1976 wintemp.exe 1896 wintemp.exe 2160 wintemp.exe 2236 wintemp.exe 1372 wintemp.exe 820 wintemp.exe 1636 wintemp.exe 1512 wintemp.exe 2992 wintemp.exe 3032 wintemp.exe 1096 wintemp.exe 2044 wintemp.exe 1032 wintemp.exe 2268 wintemp.exe 1584 wintemp.exe 2656 wintemp.exe 2320 wintemp.exe 2812 wintemp.exe 2208 wintemp.exe 2584 wintemp.exe 2560 wintemp.exe -
Loads dropped DLL 64 IoCs
pid Process 2852 bf38333a1243cf12ea3216cc2f07bd24_JaffaCakes118.exe 2852 bf38333a1243cf12ea3216cc2f07bd24_JaffaCakes118.exe 2640 wintemp.exe 2640 wintemp.exe 2644 wintemp.exe 2644 wintemp.exe 2540 wintemp.exe 2540 wintemp.exe 2084 wintemp.exe 2084 wintemp.exe 1940 wintemp.exe 1940 wintemp.exe 1956 wintemp.exe 1956 wintemp.exe 2772 wintemp.exe 2772 wintemp.exe 1220 wintemp.exe 1220 wintemp.exe 2612 wintemp.exe 2612 wintemp.exe 2860 wintemp.exe 2860 wintemp.exe 2104 wintemp.exe 2104 wintemp.exe 588 wintemp.exe 588 wintemp.exe 1240 wintemp.exe 1240 wintemp.exe 2160 wintemp.exe 2160 wintemp.exe 2184 wintemp.exe 2184 wintemp.exe 748 wintemp.exe 748 wintemp.exe 108 wintemp.exe 108 wintemp.exe 1512 wintemp.exe 1512 wintemp.exe 2380 wintemp.exe 2380 wintemp.exe 3032 wintemp.exe 3032 wintemp.exe 1676 wintemp.exe 1676 wintemp.exe 3052 wintemp.exe 3052 wintemp.exe 1316 wintemp.exe 1316 wintemp.exe 2388 wintemp.exe 2388 wintemp.exe 1320 wintemp.exe 1320 wintemp.exe 2436 wintemp.exe 2436 wintemp.exe 1616 wintemp.exe 1616 wintemp.exe 2832 wintemp.exe 2832 wintemp.exe 2852 wintemp.exe 2852 wintemp.exe 2664 wintemp.exe 2664 wintemp.exe 1564 wintemp.exe 1564 wintemp.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created \??\c:\windows\SysWOW64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File created \??\c:\windows\SysWOW64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File created \??\c:\windows\SysWOW64\wintemp.exe wintemp.exe File created \??\c:\windows\SysWOW64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File created \??\c:\windows\SysWOW64\wintemp.exe wintemp.exe File created \??\c:\windows\SysWOW64\wintemp.exe wintemp.exe File created \??\c:\windows\SysWOW64\wintemp.exe wintemp.exe File created \??\c:\windows\SysWOW64\wintemp.exe wintemp.exe File created \??\c:\windows\SysWOW64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File created \??\c:\windows\SysWOW64\wintemp.exe wintemp.exe File created \??\c:\windows\SysWOW64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File created \??\c:\windows\SysWOW64\wintemp.exe wintemp.exe File created \??\c:\windows\SysWOW64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File created \??\c:\windows\SysWOW64\wintemp.exe wintemp.exe File created \??\c:\windows\SysWOW64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File created \??\c:\windows\SysWOW64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File created \??\c:\windows\SysWOW64\wintemp.exe wintemp.exe File created \??\c:\windows\SysWOW64\wintemp.exe wintemp.exe File created \??\c:\windows\SysWOW64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File created \??\c:\windows\SysWOW64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File created \??\c:\windows\SysWOW64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File created \??\c:\windows\SysWOW64\wintemp.exe wintemp.exe File created \??\c:\windows\SysWOW64\wintemp.exe wintemp.exe File created \??\c:\windows\SysWOW64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File created \??\c:\windows\SysWOW64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File created \??\c:\windows\SysWOW64\wintemp.exe wintemp.exe File opened for modification \??\c:\windows\syswow64\wintemp.exe wintemp.exe File created \??\c:\windows\SysWOW64\wintemp.exe wintemp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wintemp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2852 wrote to memory of 2640 2852 bf38333a1243cf12ea3216cc2f07bd24_JaffaCakes118.exe 30 PID 2852 wrote to memory of 2640 2852 bf38333a1243cf12ea3216cc2f07bd24_JaffaCakes118.exe 30 PID 2852 wrote to memory of 2640 2852 bf38333a1243cf12ea3216cc2f07bd24_JaffaCakes118.exe 30 PID 2852 wrote to memory of 2640 2852 bf38333a1243cf12ea3216cc2f07bd24_JaffaCakes118.exe 30 PID 2640 wrote to memory of 2644 2640 wintemp.exe 31 PID 2640 wrote to memory of 2644 2640 wintemp.exe 31 PID 2640 wrote to memory of 2644 2640 wintemp.exe 31 PID 2640 wrote to memory of 2644 2640 wintemp.exe 31 PID 2644 wrote to memory of 2540 2644 wintemp.exe 32 PID 2644 wrote to memory of 2540 2644 wintemp.exe 32 PID 2644 wrote to memory of 2540 2644 wintemp.exe 32 PID 2644 wrote to memory of 2540 2644 wintemp.exe 32 PID 2540 wrote to memory of 2084 2540 wintemp.exe 33 PID 2540 wrote to memory of 2084 2540 wintemp.exe 33 PID 2540 wrote to memory of 2084 2540 wintemp.exe 33 PID 2540 wrote to memory of 2084 2540 wintemp.exe 33 PID 2084 wrote to memory of 1940 2084 wintemp.exe 34 PID 2084 wrote to memory of 1940 2084 wintemp.exe 34 PID 2084 wrote to memory of 1940 2084 wintemp.exe 34 PID 2084 wrote to memory of 1940 2084 wintemp.exe 34 PID 1940 wrote to memory of 1956 1940 wintemp.exe 35 PID 1940 wrote to memory of 1956 1940 wintemp.exe 35 PID 1940 wrote to memory of 1956 1940 wintemp.exe 35 PID 1940 wrote to memory of 1956 1940 wintemp.exe 35 PID 1956 wrote to memory of 2772 1956 wintemp.exe 36 PID 1956 wrote to memory of 2772 1956 wintemp.exe 36 PID 1956 wrote to memory of 2772 1956 wintemp.exe 36 PID 1956 wrote to memory of 2772 1956 wintemp.exe 36 PID 2772 wrote to memory of 1220 2772 wintemp.exe 37 PID 2772 wrote to memory of 1220 2772 wintemp.exe 37 PID 2772 wrote to memory of 1220 2772 wintemp.exe 37 PID 2772 wrote to memory of 1220 2772 wintemp.exe 37 PID 1220 wrote to memory of 2612 1220 wintemp.exe 38 PID 1220 wrote to memory of 2612 1220 wintemp.exe 38 PID 1220 wrote to memory of 2612 1220 wintemp.exe 38 PID 1220 wrote to memory of 2612 1220 wintemp.exe 38 PID 2612 wrote to memory of 2860 2612 wintemp.exe 39 PID 2612 wrote to memory of 2860 2612 wintemp.exe 39 PID 2612 wrote to memory of 2860 2612 wintemp.exe 39 PID 2612 wrote to memory of 2860 2612 wintemp.exe 39 PID 2860 wrote to memory of 2104 2860 wintemp.exe 40 PID 2860 wrote to memory of 2104 2860 wintemp.exe 40 PID 2860 wrote to memory of 2104 2860 wintemp.exe 40 PID 2860 wrote to memory of 2104 2860 wintemp.exe 40 PID 2104 wrote to memory of 588 2104 wintemp.exe 41 PID 2104 wrote to memory of 588 2104 wintemp.exe 41 PID 2104 wrote to memory of 588 2104 wintemp.exe 41 PID 2104 wrote to memory of 588 2104 wintemp.exe 41 PID 588 wrote to memory of 1240 588 wintemp.exe 42 PID 588 wrote to memory of 1240 588 wintemp.exe 42 PID 588 wrote to memory of 1240 588 wintemp.exe 42 PID 588 wrote to memory of 1240 588 wintemp.exe 42 PID 1240 wrote to memory of 2160 1240 wintemp.exe 43 PID 1240 wrote to memory of 2160 1240 wintemp.exe 43 PID 1240 wrote to memory of 2160 1240 wintemp.exe 43 PID 1240 wrote to memory of 2160 1240 wintemp.exe 43 PID 2160 wrote to memory of 2184 2160 wintemp.exe 44 PID 2160 wrote to memory of 2184 2160 wintemp.exe 44 PID 2160 wrote to memory of 2184 2160 wintemp.exe 44 PID 2160 wrote to memory of 2184 2160 wintemp.exe 44 PID 2184 wrote to memory of 748 2184 wintemp.exe 45 PID 2184 wrote to memory of 748 2184 wintemp.exe 45 PID 2184 wrote to memory of 748 2184 wintemp.exe 45 PID 2184 wrote to memory of 748 2184 wintemp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf38333a1243cf12ea3216cc2f07bd24_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bf38333a1243cf12ea3216cc2f07bd24_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:588 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:748 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"18⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:108 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"23⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:3052 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1316 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"27⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2436 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"28⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1616 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"29⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2832 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"33⤵
- Executes dropped EXE
PID:2480 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"34⤵
- Executes dropped EXE
PID:656 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"35⤵
- Executes dropped EXE
PID:1524 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"36⤵
- Executes dropped EXE
PID:1440 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"37⤵
- Executes dropped EXE
PID:3024 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"38⤵
- Executes dropped EXE
PID:2496 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1496 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"40⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2740 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"41⤵
- Executes dropped EXE
PID:2600 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"42⤵
- Executes dropped EXE
PID:2212 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"43⤵
- Executes dropped EXE
PID:540 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"44⤵
- Executes dropped EXE
PID:2348 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1976 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"46⤵
- Executes dropped EXE
PID:1896 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"47⤵
- Executes dropped EXE
PID:2160 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"48⤵
- Executes dropped EXE
PID:2236 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1372 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:820 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"51⤵
- Executes dropped EXE
PID:1636 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1512 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"53⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2992 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"54⤵
- Executes dropped EXE
PID:3032 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"55⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1096 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"56⤵
- Executes dropped EXE
PID:2044 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1032 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"58⤵
- Executes dropped EXE
PID:2268 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"59⤵
- Executes dropped EXE
PID:1584 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"60⤵
- Executes dropped EXE
PID:2656 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2320 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"62⤵
- Executes dropped EXE
PID:2812 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2208 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"64⤵
- Executes dropped EXE
PID:2584 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2560 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"66⤵
- System Location Discovery: System Language Discovery
PID:816 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"67⤵
- Drops file in System32 directory
PID:2292 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"68⤵
- System Location Discovery: System Language Discovery
PID:1276 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"69⤵PID:3016
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"70⤵PID:2936
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"71⤵
- Drops file in System32 directory
PID:2908 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"72⤵PID:444
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"73⤵PID:2056
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"74⤵PID:684
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"75⤵
- Drops file in System32 directory
PID:2104 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"76⤵PID:2076
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"77⤵PID:2356
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"78⤵
- Drops file in System32 directory
PID:2220 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"79⤵PID:1696
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"80⤵
- Drops file in System32 directory
PID:2184 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"81⤵PID:748
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"82⤵PID:2396
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"83⤵PID:2984
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"84⤵PID:1888
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"85⤵PID:1600
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"86⤵
- System Location Discovery: System Language Discovery
PID:1676 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"87⤵PID:380
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"88⤵
- Drops file in System32 directory
PID:2248 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"89⤵PID:1288
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"90⤵PID:1508
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"91⤵PID:2824
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"92⤵PID:2808
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"93⤵PID:2308
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"94⤵PID:2848
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"95⤵
- System Location Discovery: System Language Discovery
PID:2664 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"96⤵PID:2644
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"97⤵
- Drops file in System32 directory
PID:2912 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"98⤵PID:2724
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"99⤵PID:744
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"100⤵
- Drops file in System32 directory
PID:2692 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"101⤵PID:3024
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"102⤵PID:2496
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"103⤵PID:2800
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"104⤵PID:2612
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"105⤵PID:1864
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"106⤵PID:2344
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"107⤵
- System Location Discovery: System Language Discovery
PID:1640 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"108⤵PID:592
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"109⤵PID:1240
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"110⤵PID:2460
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"111⤵
- System Location Discovery: System Language Discovery
PID:1756 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"112⤵
- System Location Discovery: System Language Discovery
PID:1540 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"113⤵PID:2952
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"114⤵
- Drops file in System32 directory
PID:1556 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"115⤵PID:1796
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"116⤵
- Drops file in System32 directory
PID:1984 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"117⤵PID:2992
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"118⤵PID:980
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"119⤵
- Drops file in System32 directory
PID:2264 -
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"120⤵PID:1528
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"121⤵PID:872
-
C:\windows\SysWOW64\wintemp.exe"C:\windows\system32\wintemp.exe"122⤵PID:2444
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-