Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 12:05
Behavioral task
behavioral1
Sample
c0b6ad65dd559b72bc3e8ac9a0931a49_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
c0b6ad65dd559b72bc3e8ac9a0931a49_JaffaCakes118.exe
-
Size
238KB
-
MD5
c0b6ad65dd559b72bc3e8ac9a0931a49
-
SHA1
0fdac98ec965cee92e3fe11e6b9eb7a40a98dab6
-
SHA256
53b344f6557bcf013ec2f7bc87c490c4d565ef0c1bebdddf66be9536e38493d1
-
SHA512
5d7288b4619b10fd25590f69c32ee0bf56b6011f4e2e4c73c18e651bca85b60d318a4bf2ef4e528b555c8e56e81330f93cea262e76d14640e29026e176b2e6c3
-
SSDEEP
6144:DzIdQq3Jh/Z0n9jqvqmgmreXT0M0NrhSfwqMGy:DziQq3Jh4jqvq6eD0rrh9My
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 384 iplog.exe 3240 iplog.exe 1928 iplog.exe 3512 iplog.exe 1760 iplog.exe 3264 iplog.exe 1432 iplog.exe 4896 iplog.exe 2372 iplog.exe 1004 iplog.exe 924 iplog.exe 2780 iplog.exe 2620 iplog.exe 628 iplog.exe 1176 iplog.exe 748 iplog.exe 1396 iplog.exe 1812 iplog.exe 5076 iplog.exe 208 iplog.exe 3892 iplog.exe 4516 iplog.exe 1624 iplog.exe 5012 iplog.exe 2480 iplog.exe 1040 iplog.exe 3672 iplog.exe 2152 iplog.exe 3256 iplog.exe 4084 iplog.exe 3492 iplog.exe 5088 iplog.exe 2336 iplog.exe 2020 iplog.exe 1568 iplog.exe 2684 iplog.exe 4332 iplog.exe 3992 iplog.exe 1508 iplog.exe 5092 iplog.exe 3516 iplog.exe 1052 iplog.exe 436 iplog.exe 2668 iplog.exe 1344 iplog.exe 2240 iplog.exe 4664 iplog.exe 2180 iplog.exe 2892 iplog.exe 4544 iplog.exe 2584 iplog.exe 2300 iplog.exe 3120 iplog.exe 2104 iplog.exe 3148 iplog.exe 776 iplog.exe 5068 iplog.exe 4148 iplog.exe 4044 iplog.exe 3236 iplog.exe 1664 iplog.exe 4896 iplog.exe 2264 iplog.exe 948 iplog.exe -
resource yara_rule behavioral2/memory/4992-0-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/files/0x000a0000000233ea-7.dat upx behavioral2/memory/4992-10-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/384-20-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/1928-31-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/3240-30-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/1928-40-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/3512-49-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/1760-57-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/1432-66-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/3264-67-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/1432-76-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/2372-84-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/4896-86-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/2372-95-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/1004-103-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/924-113-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/2620-123-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/2780-122-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/2620-132-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/628-141-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/1176-149-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/748-151-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/1396-159-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/748-158-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/1396-164-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/1812-169-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/5076-174-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/208-179-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/3892-184-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/4516-188-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/1624-193-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/5012-198-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/2480-203-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/1040-208-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/3672-213-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/2152-218-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/3256-223-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/4084-228-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/3492-232-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/5088-237-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/2336-242-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/2020-247-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/1568-252-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/2684-256-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/4332-261-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/3992-266-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/1508-270-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/5092-275-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/3516-280-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/1052-285-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/436-290-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/2668-294-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/1344-299-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/2240-304-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/4664-309-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/2180-314-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/2892-319-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/4544-324-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/2584-329-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/2300-334-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/3120-339-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/2104-344-0x0000000000400000-0x00000000004A3000-memory.dmp upx behavioral2/memory/3148-345-0x0000000000400000-0x00000000004A3000-memory.dmp upx -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ipsnow.exe iplog.exe File created C:\Windows\SysWOW64\iplog.exe iplog.exe File created C:\Windows\SysWOW64\ipsnow.exe iplog.exe File opened for modification C:\Windows\SysWOW64\ipsnow.exe iplog.exe File opened for modification C:\Windows\SysWOW64\ipsnow.exe iplog.exe File created C:\Windows\SysWOW64\ipsnow.exe iplog.exe File opened for modification C:\Windows\SysWOW64\ipsnow.exe iplog.exe File created C:\Windows\SysWOW64\iplog.exe iplog.exe File opened for modification C:\Windows\SysWOW64\logkey.ini iplog.exe File opened for modification C:\Windows\SysWOW64\ipsnow.exe iplog.exe File opened for modification C:\Windows\SysWOW64\logkey.ini iplog.exe File created C:\Windows\SysWOW64\ipsnow.exe iplog.exe File opened for modification C:\Windows\SysWOW64\logkey.ini iplog.exe File created C:\Windows\SysWOW64\ipsnow.exe iplog.exe File opened for modification C:\Windows\SysWOW64\logkey.ini iplog.exe File created C:\Windows\SysWOW64\ipsnow.exe iplog.exe File opened for modification C:\Windows\SysWOW64\ipsnow.exe iplog.exe File opened for modification C:\Windows\SysWOW64\logkey.ini iplog.exe File opened for modification C:\Windows\SysWOW64\ipsnow.exe iplog.exe File opened for modification C:\Windows\SysWOW64\logkey.ini iplog.exe File created C:\Windows\SysWOW64\iplog.exe iplog.exe File created C:\Windows\SysWOW64\ipsnow.exe iplog.exe File created C:\Windows\SysWOW64\ipsnow.exe iplog.exe File created C:\Windows\SysWOW64\iplog.exe iplog.exe File opened for modification C:\Windows\SysWOW64\ipsnow.exe iplog.exe File created C:\Windows\SysWOW64\ipsnow.exe iplog.exe File created C:\Windows\SysWOW64\ipsnow.exe iplog.exe File created C:\Windows\SysWOW64\ipsnow.exe iplog.exe File opened for modification C:\Windows\SysWOW64\ipsnow.exe iplog.exe File created C:\Windows\SysWOW64\iplog.exe iplog.exe File created C:\Windows\SysWOW64\ipsnow.exe iplog.exe File opened for modification C:\Windows\SysWOW64\logkey.ini iplog.exe File created C:\Windows\SysWOW64\iplog.exe iplog.exe File created C:\Windows\SysWOW64\ipsnow.exe iplog.exe File created C:\Windows\SysWOW64\ipsnow.exe iplog.exe File created C:\Windows\SysWOW64\iplog.exe iplog.exe File opened for modification C:\Windows\SysWOW64\ipsnow.exe iplog.exe File created C:\Windows\SysWOW64\ipsnow.exe iplog.exe File opened for modification C:\Windows\SysWOW64\ipsnow.exe iplog.exe File created C:\Windows\SysWOW64\ipsnow.exe iplog.exe File opened for modification C:\Windows\SysWOW64\logkey.ini iplog.exe File created C:\Windows\SysWOW64\iplog.exe c0b6ad65dd559b72bc3e8ac9a0931a49_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ipsnow.exe iplog.exe File created C:\Windows\SysWOW64\iplog.exe iplog.exe File opened for modification C:\Windows\SysWOW64\logkey.ini iplog.exe File created C:\Windows\SysWOW64\iplog.exe iplog.exe File created C:\Windows\SysWOW64\iplog.exe iplog.exe File opened for modification C:\Windows\SysWOW64\ipsnow.exe iplog.exe File created C:\Windows\SysWOW64\ipsnow.exe iplog.exe File opened for modification C:\Windows\SysWOW64\logkey.ini iplog.exe File opened for modification C:\Windows\SysWOW64\logkey.ini iplog.exe File opened for modification C:\Windows\SysWOW64\ipsnow.exe iplog.exe File created C:\Windows\SysWOW64\iplog.exe iplog.exe File created C:\Windows\SysWOW64\iplog.exe iplog.exe File created C:\Windows\SysWOW64\iplog.exe iplog.exe File created C:\Windows\SysWOW64\iplog.exe iplog.exe File opened for modification C:\Windows\SysWOW64\logkey.ini iplog.exe File created C:\Windows\SysWOW64\ipsnow.exe iplog.exe File created C:\Windows\SysWOW64\ipsnow.exe iplog.exe File created C:\Windows\SysWOW64\ipsnow.exe iplog.exe File created C:\Windows\SysWOW64\iplog.exe iplog.exe File opened for modification C:\Windows\SysWOW64\logkey.ini iplog.exe File created C:\Windows\SysWOW64\ipsnow.exe iplog.exe File opened for modification C:\Windows\SysWOW64\logkey.ini iplog.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File created C:\Windows\sk.exe c0b6ad65dd559b72bc3e8ac9a0931a49_JaffaCakes118.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe File opened for modification C:\Windows\sk.exe iplog.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c0b6ad65dd559b72bc3e8ac9a0931a49_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iplog.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4992 wrote to memory of 384 4992 c0b6ad65dd559b72bc3e8ac9a0931a49_JaffaCakes118.exe 87 PID 4992 wrote to memory of 384 4992 c0b6ad65dd559b72bc3e8ac9a0931a49_JaffaCakes118.exe 87 PID 4992 wrote to memory of 384 4992 c0b6ad65dd559b72bc3e8ac9a0931a49_JaffaCakes118.exe 87 PID 384 wrote to memory of 3240 384 iplog.exe 90 PID 384 wrote to memory of 3240 384 iplog.exe 90 PID 384 wrote to memory of 3240 384 iplog.exe 90 PID 3240 wrote to memory of 1928 3240 iplog.exe 93 PID 3240 wrote to memory of 1928 3240 iplog.exe 93 PID 3240 wrote to memory of 1928 3240 iplog.exe 93 PID 1928 wrote to memory of 3512 1928 iplog.exe 95 PID 1928 wrote to memory of 3512 1928 iplog.exe 95 PID 1928 wrote to memory of 3512 1928 iplog.exe 95 PID 3512 wrote to memory of 1760 3512 iplog.exe 96 PID 3512 wrote to memory of 1760 3512 iplog.exe 96 PID 3512 wrote to memory of 1760 3512 iplog.exe 96 PID 1760 wrote to memory of 3264 1760 iplog.exe 99 PID 1760 wrote to memory of 3264 1760 iplog.exe 99 PID 1760 wrote to memory of 3264 1760 iplog.exe 99 PID 3264 wrote to memory of 1432 3264 iplog.exe 100 PID 3264 wrote to memory of 1432 3264 iplog.exe 100 PID 3264 wrote to memory of 1432 3264 iplog.exe 100 PID 1432 wrote to memory of 4896 1432 iplog.exe 101 PID 1432 wrote to memory of 4896 1432 iplog.exe 101 PID 1432 wrote to memory of 4896 1432 iplog.exe 101 PID 4896 wrote to memory of 2372 4896 iplog.exe 102 PID 4896 wrote to memory of 2372 4896 iplog.exe 102 PID 4896 wrote to memory of 2372 4896 iplog.exe 102 PID 2372 wrote to memory of 1004 2372 iplog.exe 103 PID 2372 wrote to memory of 1004 2372 iplog.exe 103 PID 2372 wrote to memory of 1004 2372 iplog.exe 103 PID 1004 wrote to memory of 924 1004 iplog.exe 104 PID 1004 wrote to memory of 924 1004 iplog.exe 104 PID 1004 wrote to memory of 924 1004 iplog.exe 104 PID 924 wrote to memory of 2780 924 iplog.exe 105 PID 924 wrote to memory of 2780 924 iplog.exe 105 PID 924 wrote to memory of 2780 924 iplog.exe 105 PID 2780 wrote to memory of 2620 2780 iplog.exe 106 PID 2780 wrote to memory of 2620 2780 iplog.exe 106 PID 2780 wrote to memory of 2620 2780 iplog.exe 106 PID 2620 wrote to memory of 628 2620 iplog.exe 107 PID 2620 wrote to memory of 628 2620 iplog.exe 107 PID 2620 wrote to memory of 628 2620 iplog.exe 107 PID 628 wrote to memory of 1176 628 iplog.exe 108 PID 628 wrote to memory of 1176 628 iplog.exe 108 PID 628 wrote to memory of 1176 628 iplog.exe 108 PID 1176 wrote to memory of 748 1176 iplog.exe 109 PID 1176 wrote to memory of 748 1176 iplog.exe 109 PID 1176 wrote to memory of 748 1176 iplog.exe 109 PID 748 wrote to memory of 1396 748 iplog.exe 110 PID 748 wrote to memory of 1396 748 iplog.exe 110 PID 748 wrote to memory of 1396 748 iplog.exe 110 PID 1396 wrote to memory of 1812 1396 iplog.exe 111 PID 1396 wrote to memory of 1812 1396 iplog.exe 111 PID 1396 wrote to memory of 1812 1396 iplog.exe 111 PID 1812 wrote to memory of 5076 1812 iplog.exe 113 PID 1812 wrote to memory of 5076 1812 iplog.exe 113 PID 1812 wrote to memory of 5076 1812 iplog.exe 113 PID 5076 wrote to memory of 208 5076 iplog.exe 114 PID 5076 wrote to memory of 208 5076 iplog.exe 114 PID 5076 wrote to memory of 208 5076 iplog.exe 114 PID 208 wrote to memory of 3892 208 iplog.exe 116 PID 208 wrote to memory of 3892 208 iplog.exe 116 PID 208 wrote to memory of 3892 208 iplog.exe 116 PID 3892 wrote to memory of 4516 3892 iplog.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0b6ad65dd559b72bc3e8ac9a0931a49_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c0b6ad65dd559b72bc3e8ac9a0931a49_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe8⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe20⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4516 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe24⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1624 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5012 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe26⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2480 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1040 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe28⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3672 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2152 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe30⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3256 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4084 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe32⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3492 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5088 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe34⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2336 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2020 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1568 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2684 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe38⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4332 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3992 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe40⤵
- Executes dropped EXE
PID:1508 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5092 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe42⤵
- Executes dropped EXE
PID:3516 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1052 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:436 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2668 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe46⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1344 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2240 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4664 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2180 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe50⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2892 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4544 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe52⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2584 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe53⤵
- Executes dropped EXE
PID:2300 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe54⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3120 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2104 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe56⤵
- Executes dropped EXE
PID:3148 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:776 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5068 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4148 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4044 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3236 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe62⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1664 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4896 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe64⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2264 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:948 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe66⤵
- System Location Discovery: System Language Discovery
PID:2712 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe67⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1016 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe68⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2008 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe69⤵
- System Location Discovery: System Language Discovery
PID:3948 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe70⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4712 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe71⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2488 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe72⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3964 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe73⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4752 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe74⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3280 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe75⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2324 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe76⤵
- System Location Discovery: System Language Discovery
PID:3260 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe77⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1732 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe78⤵PID:1136
-
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe79⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:3672 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe80⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2308 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe81⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3348 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe82⤵PID:3572
-
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe83⤵
- System Location Discovery: System Language Discovery
PID:2428 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe84⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1428 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe85⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4168 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe86⤵
- Drops file in System32 directory
PID:2772 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe87⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:4176 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe88⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:1580 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe89⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:3928 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe90⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:748 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe91⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:3576 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe92⤵
- Drops file in Windows directory
PID:1940 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe93⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2072 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe94⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:676 -
C:\Windows\SysWOW64\iplog.exeC:\Windows\system32\iplog.exe95⤵
- System Location Discovery: System Language Discovery
PID:1808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
238KB
MD5c0b6ad65dd559b72bc3e8ac9a0931a49
SHA10fdac98ec965cee92e3fe11e6b9eb7a40a98dab6
SHA25653b344f6557bcf013ec2f7bc87c490c4d565ef0c1bebdddf66be9536e38493d1
SHA5125d7288b4619b10fd25590f69c32ee0bf56b6011f4e2e4c73c18e651bca85b60d318a4bf2ef4e528b555c8e56e81330f93cea262e76d14640e29026e176b2e6c3
-
Filesize
50B
MD5798e9d09e53254c0e70dd121cf63419b
SHA13b240d9315d03a03d447d7e48038b1d4a17e8167
SHA25651355a51199fd9af5654338e100c392da2fa7d30e42ed3314be20edaa4969ec3
SHA512e67804418a45570045cc52507333b6af1904e3b7f415cb1b58fb1af3887d6bc3d199db4aeac8c598d78370edc9a9870e2638475ac702281045923b86871ac5df
-
Filesize
238KB
MD5a954bd3c2be496fc9d476a944f9942e6
SHA1e7b9dd17a1d963d7675af5545b7794ef61fd9721
SHA25668c9c674a56e6dbff3847b2f687f9bc72a96d599b039d2b486b9e9102827d926
SHA512dc6cbd2df26bb3c3f605af26213bc97439cff9fbb011cbe3ac300d07d867e33ee36304c307e1a5b178b899062846230acc7642d0d0f4d7c20db893b277a1f99f