Analysis
-
max time kernel
137s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10-09-2024 10:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
General
-
Target
d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe
-
Size
564KB
-
MD5
d80ac0bdd070bb0d8ebd15d8d445bee8
-
SHA1
cfd16e3314d35aae73d0f9ce37adb4fd9090dbd9
-
SHA256
53a39cac95df5873549dbf3c3c55a98c7d7fea9f09c9d5a32e27754941762fc8
-
SHA512
67470fcfc9c0c2d19e9208208305c2321df31775311874068a0b07c1e8ab999b36dcf39ee416aa03ce1b9d5920d16eb441186ae93e3ef69122e66b878cf19cd2
-
SSDEEP
6144:xD1y69ghIcyyePClPJ9rxffwdeXV4q2IQS7SdfyktPFLNJI4HmzxHv1LU+D:rz98I3PwBNl/2IGycFLNJ7HCxHvX
Malware Config
Extracted
Family
emotet
Botnet
Epoch1
C2
125.99.61.162:7080
94.183.71.206:7080
91.83.93.105:8080
216.98.148.181:8080
68.183.190.199:8080
170.84.133.72:7080
139.5.237.27:443
5.77.13.70:80
46.29.183.211:8080
46.41.151.103:8080
182.188.39.68:80
170.84.133.72:8443
186.83.133.253:8080
46.28.111.142:7080
62.75.160.178:8080
178.79.163.131:8080
190.104.253.234:990
149.62.173.247:8080
178.249.187.151:8080
81.169.140.14:443
5.196.35.138:7080
80.85.87.122:8080
187.188.166.192:80
186.0.95.172:80
151.80.142.33:80
201.199.93.30:443
68.183.170.114:8080
183.82.97.25:80
71.244.60.231:7080
91.205.215.57:7080
190.85.152.186:8080
189.166.68.89:443
217.199.160.224:8080
203.25.159.3:8080
190.158.19.141:80
82.196.15.205:8080
181.188.149.134:80
5.1.86.195:8080
190.10.194.42:8080
78.189.76.2:50000
200.58.171.51:80
51.15.8.192:8080
185.86.148.222:8080
123.168.4.66:22
200.57.102.71:8443
89.188.124.145:443
190.38.14.52:80
190.230.60.129:80
185.187.198.10:8080
142.93.82.57:8080
109.104.79.48:8080
189.160.49.234:8443
201.183.247.58:443
119.159.150.176:443
138.68.106.4:7080
159.203.204.126:8080
79.143.182.254:8080
71.244.60.230:7080
201.163.74.202:443
181.36.42.205:443
91.83.93.124:7080
87.106.77.40:7080
200.51.94.251:143
181.29.101.13:8080
212.71.237.140:8080
79.129.0.173:8080
190.221.50.210:8080
119.92.51.40:8080
88.250.223.190:8080
46.163.144.228:80
77.55.211.77:8080
190.1.37.125:443
62.75.143.100:7080
119.59.124.163:8080
46.101.212.195:8080
109.169.86.13:8080
76.69.29.42:80
77.245.101.134:8080
114.79.134.129:443
186.1.41.111:443
86.42.166.147:80
50.28.51.143:8080
81.213.215.216:50000
184.69.214.94:20
190.230.60.129:8080
rsa_pubkey.plain
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat resapifwdr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language resapifwdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d80ac0bdd070bb0d8ebd15d8d445bee8_jaffacakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language resapifwdr.exe -
Modifies data under HKEY_USERS 21 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 resapifwdr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" resapifwdr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BDD7137-BD17-4902-9D51-DA1826AE3301} resapifwdr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-04-d3-71-69-2c resapifwdr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-04-d3-71-69-2c\WpadDecision = "0" resapifwdr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings resapifwdr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix resapifwdr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" resapifwdr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 resapifwdr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0101000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 resapifwdr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BDD7137-BD17-4902-9D51-DA1826AE3301}\WpadDecisionTime = b08e81146903db01 resapifwdr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad resapifwdr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BDD7137-BD17-4902-9D51-DA1826AE3301}\WpadDecision = "0" resapifwdr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BDD7137-BD17-4902-9D51-DA1826AE3301}\22-04-d3-71-69-2c resapifwdr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections resapifwdr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" resapifwdr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings resapifwdr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BDD7137-BD17-4902-9D51-DA1826AE3301}\WpadDecisionReason = "1" resapifwdr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BDD7137-BD17-4902-9D51-DA1826AE3301}\WpadNetworkName = "Network 3" resapifwdr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-04-d3-71-69-2c\WpadDecisionReason = "1" resapifwdr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-04-d3-71-69-2c\WpadDecisionTime = b08e81146903db01 resapifwdr.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec\ = "[print(\"%1\")]" d80ac0bdd070bb0d8ebd15d8d445bee8_jaffacakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon resapifwdr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command\ = "C:\\Windows\\SysWOW64\\RESAPI~1.EXE /dde" resapifwdr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1 resapifwdr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D80AC0~1.EXE /dde" d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1 d80ac0bdd070bb0d8ebd15d8d445bee8_jaffacakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec\ = "[print(\"%1\")]" resapifwdr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ = "Recalc.Document.1" resapifwdr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew\NullFile d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\ = "Recalc Document" d80ac0bdd070bb0d8ebd15d8d445bee8_jaffacakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D80AC0~1.EXE /dde" d80ac0bdd070bb0d8ebd15d8d445bee8_jaffacakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.RCL d80ac0bdd070bb0d8ebd15d8d445bee8_jaffacakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1 d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec\ = "[open(\"%1\")]" d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.RCL d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon resapifwdr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.RCL resapifwdr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command d80ac0bdd070bb0d8ebd15d8d445bee8_jaffacakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec resapifwdr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ = "Recalc.Document.1" d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec resapifwdr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command resapifwdr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\ = "Recalc Document" resapifwdr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec resapifwdr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command resapifwdr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew resapifwdr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec d80ac0bdd070bb0d8ebd15d8d445bee8_jaffacakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command d80ac0bdd070bb0d8ebd15d8d445bee8_jaffacakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command resapifwdr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.RCL resapifwdr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]" d80ac0bdd070bb0d8ebd15d8d445bee8_jaffacakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew\NullFile d80ac0bdd070bb0d8ebd15d8d445bee8_jaffacakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec resapifwdr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ = "Recalc.Document.1" resapifwdr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew resapifwdr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]" d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D80AC0~1.EXE /dde" d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command resapifwdr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec\ = "[print(\"%1\")]" resapifwdr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D80AC0~1.EXE,1" d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D80AC0~1.EXE /dde" d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew d80ac0bdd070bb0d8ebd15d8d445bee8_jaffacakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command resapifwdr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec\ = "[open(\"%1\")]" resapifwdr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec resapifwdr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon\ = "C:\\Windows\\SysWOW64\\RESAPI~1.EXE,1" resapifwdr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\ = "Recalc Document" resapifwdr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]" resapifwdr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command\ = "C:\\Windows\\SysWOW64\\RESAPI~1.EXE /dde" resapifwdr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command resapifwdr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec resapifwdr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command\ = "C:\\Windows\\SysWOW64\\RESAPI~1.EXE /dde" resapifwdr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec\ = "[print(\"%1\")]" d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2104 resapifwdr.exe 2104 resapifwdr.exe 2104 resapifwdr.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2412 d80ac0bdd070bb0d8ebd15d8d445bee8_jaffacakes118.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3044 d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe 3044 d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe 2412 d80ac0bdd070bb0d8ebd15d8d445bee8_jaffacakes118.exe 2412 d80ac0bdd070bb0d8ebd15d8d445bee8_jaffacakes118.exe 1984 resapifwdr.exe 1984 resapifwdr.exe 2104 resapifwdr.exe 2104 resapifwdr.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2412 3044 d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe 30 PID 3044 wrote to memory of 2412 3044 d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe 30 PID 3044 wrote to memory of 2412 3044 d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe 30 PID 3044 wrote to memory of 2412 3044 d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe 30 PID 1984 wrote to memory of 2104 1984 resapifwdr.exe 33 PID 1984 wrote to memory of 2104 1984 resapifwdr.exe 33 PID 1984 wrote to memory of 2104 1984 resapifwdr.exe 33 PID 1984 wrote to memory of 2104 1984 resapifwdr.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d80ac0bdd070bb0d8ebd15d8d445bee8_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\d80ac0bdd070bb0d8ebd15d8d445bee8_jaffacakes118.exe--23764072⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:2412
-
-
C:\Windows\SysWOW64\resapifwdr.exe"C:\Windows\SysWOW64\resapifwdr.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\resapifwdr.exe--d0f58d4b2⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2104
-