Analysis
-
max time kernel
130s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/09/2024, 20:31
Static task
static1
Behavioral task
behavioral1
Sample
db2a29365fa49dea85f6ffe5ef3dd98d_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
db2a29365fa49dea85f6ffe5ef3dd98d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
db2a29365fa49dea85f6ffe5ef3dd98d_JaffaCakes118.exe
-
Size
78KB
-
MD5
db2a29365fa49dea85f6ffe5ef3dd98d
-
SHA1
3606c3d1e60eeb80b47eccb96933c52beabd9488
-
SHA256
d5bb40879e82d6c8b8587f122910a4ba7e96f1ac38f957f7edc1842e979b4f1a
-
SHA512
954fff0359bcf7131a4d65ceb43d605396a3cc4ec7ae99e8b9905659e24f502fb7ee60c2f511d695cbc3e14e5458511ea97d7eb13cabbcb92bad22ca4b754aa4
-
SSDEEP
1536:r1L5+h66Te0e0qPWrzVa2AIxBXBFsVNM1AQ4IIWoZcdGjJvuEc4J:ZLn6y0e49uIxB0OB+HJGE7
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3196 cmd.exe -
Executes dropped EXE 64 IoCs
pid Process 2020 wmi.exe 2336 wmi.exe 2816 wmi.exe 3000 wmi.exe 2908 wmi.exe 2732 wmi.exe 2684 wmi.exe 1852 wmi.exe 912 wmi.exe 2680 wmi.exe 2708 wmi.exe 3056 wmi.exe 1648 wmi.exe 1784 wmi.exe 1572 wmi.exe 2296 wmi.exe 2416 wmi.exe 640 wmi.exe 2244 wmi.exe 2544 wmi.exe 2604 wmi.exe 2144 wmi.exe 448 wmi.exe 2224 wmi.exe 2800 wmi.exe 876 wmi.exe 1320 wmi.exe 1440 wmi.exe 1308 wmi.exe 1480 wmi.exe 2980 wmi.exe 840 wmi.exe 748 wmi.exe 2036 wmi.exe 1324 wmi.exe 2480 wmi.exe 1608 wmi.exe 1436 wmi.exe 1836 wmi.exe 3040 wmi.exe 2332 wmi.exe 1660 wmi.exe 2272 wmi.exe 2584 wmi.exe 2556 wmi.exe 2712 wmi.exe 2404 wmi.exe 2904 wmi.exe 2772 wmi.exe 2252 wmi.exe 2736 wmi.exe 2648 wmi.exe 2668 wmi.exe 2636 wmi.exe 2632 wmi.exe 1872 wmi.exe 2316 wmi.exe 676 wmi.exe 988 wmi.exe 2228 wmi.exe 796 wmi.exe 2008 wmi.exe 2956 wmi.exe 2504 wmi.exe -
Loads dropped DLL 64 IoCs
pid Process 2304 db2a29365fa49dea85f6ffe5ef3dd98d_JaffaCakes118.exe 2304 db2a29365fa49dea85f6ffe5ef3dd98d_JaffaCakes118.exe 2020 wmi.exe 2020 wmi.exe 2336 wmi.exe 2336 wmi.exe 2816 wmi.exe 2816 wmi.exe 3000 wmi.exe 3000 wmi.exe 2908 wmi.exe 2908 wmi.exe 2732 wmi.exe 2732 wmi.exe 2684 wmi.exe 2684 wmi.exe 1852 wmi.exe 1852 wmi.exe 912 wmi.exe 912 wmi.exe 2680 wmi.exe 2680 wmi.exe 2708 wmi.exe 2708 wmi.exe 3056 wmi.exe 3056 wmi.exe 1648 wmi.exe 1648 wmi.exe 1784 wmi.exe 1784 wmi.exe 1572 wmi.exe 1572 wmi.exe 2296 wmi.exe 2296 wmi.exe 2416 wmi.exe 2416 wmi.exe 640 wmi.exe 640 wmi.exe 2244 wmi.exe 2244 wmi.exe 2544 wmi.exe 2544 wmi.exe 2604 wmi.exe 2604 wmi.exe 2144 wmi.exe 2144 wmi.exe 448 wmi.exe 448 wmi.exe 2224 wmi.exe 2224 wmi.exe 2800 wmi.exe 2800 wmi.exe 876 wmi.exe 876 wmi.exe 1320 wmi.exe 1320 wmi.exe 1440 wmi.exe 1440 wmi.exe 1308 wmi.exe 1308 wmi.exe 1480 wmi.exe 1480 wmi.exe 2980 wmi.exe 2980 wmi.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\GroupPolicy\User\Scripts\scripts.ini Process not Found File created C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exe wmi.exe File created C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exe wmi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\User\Scripts\scripts.ini wmi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\autorun.bat Process not Found File opened for modification C:\Windows\SysWOW64\GroupPolicy\User\Scripts\scripts.ini Process not Found File opened for modification C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\autorun.bat wmi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini wmi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\User\Scripts\scripts.ini Process not Found File opened for modification C:\Windows\SysWOW64\GroupPolicy\User\Scripts\scripts.ini wmi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\autorun.bat wmi.exe File created C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exe wmi.exe File created C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exe wmi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini Process not Found File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini wmi.exe File created C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exe wmi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\autorun.bat wmi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\autorun.bat Process not Found File opened for modification C:\Windows\SysWOW64\GroupPolicy\User\Scripts\scripts.ini wmi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini wmi.exe File created C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exe wmi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\User\Scripts\scripts.ini Process not Found File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini wmi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini wmi.exe File created C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exe wmi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini wmi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\User\Scripts\scripts.ini wmi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\User\Scripts\scripts.ini Process not Found File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini Process not Found File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini Process not Found File created C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exe wmi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini wmi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\User\Scripts\scripts.ini wmi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\User\Scripts\scripts.ini Process not Found File created C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exe Process not Found File opened for modification C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\autorun.bat wmi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\autorun.bat wmi.exe File created C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exe wmi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\User\Scripts\scripts.ini wmi.exe File created C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exe Process not Found File opened for modification C:\Windows\SysWOW64\GroupPolicy\User\Scripts\scripts.ini Process not Found File created C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exe wmi.exe File created C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exe wmi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\User\Scripts\scripts.ini Process not Found File created C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exe Process not Found File created C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exe wmi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini wmi.exe File created C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exe wmi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\User\Scripts\scripts.ini Process not Found File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini Process not Found File opened for modification C:\Windows\SysWOW64\GroupPolicy\User\Scripts\scripts.ini wmi.exe File created C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exe wmi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\autorun.bat wmi.exe File created C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exe Process not Found File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini Process not Found File opened for modification C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\autorun.bat wmi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini wmi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\User\Scripts\scripts.ini wmi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\autorun.bat Process not Found File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini Process not Found File opened for modification C:\Windows\SysWOW64\GroupPolicy\User\Scripts\scripts.ini wmi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini wmi.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\autorun.bat Process not Found File created C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exe Process not Found -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2304 db2a29365fa49dea85f6ffe5ef3dd98d_JaffaCakes118.exe 2304 db2a29365fa49dea85f6ffe5ef3dd98d_JaffaCakes118.exe 2304 db2a29365fa49dea85f6ffe5ef3dd98d_JaffaCakes118.exe 2020 wmi.exe 2020 wmi.exe 2020 wmi.exe 2336 wmi.exe 2336 wmi.exe 2336 wmi.exe 2816 wmi.exe 2816 wmi.exe 2816 wmi.exe 3000 wmi.exe 3000 wmi.exe 3000 wmi.exe 2908 wmi.exe 2908 wmi.exe 2908 wmi.exe 2732 wmi.exe 2732 wmi.exe 2732 wmi.exe 2684 wmi.exe 2684 wmi.exe 2684 wmi.exe 1852 wmi.exe 1852 wmi.exe 1852 wmi.exe 912 wmi.exe 912 wmi.exe 912 wmi.exe 2680 wmi.exe 2680 wmi.exe 2680 wmi.exe 2708 wmi.exe 2708 wmi.exe 2708 wmi.exe 3056 wmi.exe 3056 wmi.exe 3056 wmi.exe 1648 wmi.exe 1648 wmi.exe 1648 wmi.exe 1784 wmi.exe 1784 wmi.exe 1784 wmi.exe 1572 wmi.exe 1572 wmi.exe 1572 wmi.exe 2296 wmi.exe 2296 wmi.exe 2296 wmi.exe 2416 wmi.exe 2416 wmi.exe 2416 wmi.exe 640 wmi.exe 640 wmi.exe 640 wmi.exe 2244 wmi.exe 2244 wmi.exe 2244 wmi.exe 2544 wmi.exe 2544 wmi.exe 2544 wmi.exe 2604 wmi.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2304 db2a29365fa49dea85f6ffe5ef3dd98d_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2020 wmi.exe Token: SeIncBasePriorityPrivilege 2336 wmi.exe Token: SeIncBasePriorityPrivilege 2816 wmi.exe Token: SeIncBasePriorityPrivilege 3000 wmi.exe Token: SeIncBasePriorityPrivilege 2908 wmi.exe Token: SeIncBasePriorityPrivilege 2732 wmi.exe Token: SeIncBasePriorityPrivilege 2684 wmi.exe Token: SeIncBasePriorityPrivilege 1852 wmi.exe Token: SeIncBasePriorityPrivilege 912 wmi.exe Token: SeIncBasePriorityPrivilege 2680 wmi.exe Token: SeIncBasePriorityPrivilege 2708 wmi.exe Token: SeIncBasePriorityPrivilege 3056 wmi.exe Token: SeIncBasePriorityPrivilege 1648 wmi.exe Token: SeIncBasePriorityPrivilege 1784 wmi.exe Token: SeIncBasePriorityPrivilege 1572 wmi.exe Token: SeIncBasePriorityPrivilege 2296 wmi.exe Token: SeIncBasePriorityPrivilege 2416 wmi.exe Token: SeIncBasePriorityPrivilege 640 wmi.exe Token: SeIncBasePriorityPrivilege 2244 wmi.exe Token: SeIncBasePriorityPrivilege 2544 wmi.exe Token: SeIncBasePriorityPrivilege 2604 wmi.exe Token: SeIncBasePriorityPrivilege 2144 wmi.exe Token: SeIncBasePriorityPrivilege 448 wmi.exe Token: SeIncBasePriorityPrivilege 2224 wmi.exe Token: SeIncBasePriorityPrivilege 2800 wmi.exe Token: SeIncBasePriorityPrivilege 876 wmi.exe Token: SeIncBasePriorityPrivilege 1320 wmi.exe Token: SeIncBasePriorityPrivilege 1440 wmi.exe Token: SeIncBasePriorityPrivilege 1308 wmi.exe Token: SeIncBasePriorityPrivilege 1480 wmi.exe Token: SeIncBasePriorityPrivilege 2980 wmi.exe Token: SeIncBasePriorityPrivilege 840 wmi.exe Token: SeIncBasePriorityPrivilege 748 wmi.exe Token: SeIncBasePriorityPrivilege 2036 wmi.exe Token: SeIncBasePriorityPrivilege 1324 wmi.exe Token: SeIncBasePriorityPrivilege 2480 wmi.exe Token: SeIncBasePriorityPrivilege 1608 wmi.exe Token: SeIncBasePriorityPrivilege 1436 wmi.exe Token: SeIncBasePriorityPrivilege 1836 wmi.exe Token: SeIncBasePriorityPrivilege 3040 wmi.exe Token: SeIncBasePriorityPrivilege 1660 wmi.exe Token: SeIncBasePriorityPrivilege 2272 wmi.exe Token: SeIncBasePriorityPrivilege 2584 wmi.exe Token: SeIncBasePriorityPrivilege 2556 wmi.exe Token: SeIncBasePriorityPrivilege 2712 wmi.exe Token: SeIncBasePriorityPrivilege 2404 wmi.exe Token: SeIncBasePriorityPrivilege 2904 wmi.exe Token: SeIncBasePriorityPrivilege 2772 wmi.exe Token: SeIncBasePriorityPrivilege 2252 wmi.exe Token: SeIncBasePriorityPrivilege 2736 wmi.exe Token: SeIncBasePriorityPrivilege 2648 wmi.exe Token: SeIncBasePriorityPrivilege 2668 wmi.exe Token: SeIncBasePriorityPrivilege 2636 wmi.exe Token: SeIncBasePriorityPrivilege 2632 wmi.exe Token: SeIncBasePriorityPrivilege 1872 wmi.exe Token: SeIncBasePriorityPrivilege 2316 wmi.exe Token: SeIncBasePriorityPrivilege 676 wmi.exe Token: SeIncBasePriorityPrivilege 988 wmi.exe Token: SeIncBasePriorityPrivilege 2228 wmi.exe Token: SeIncBasePriorityPrivilege 796 wmi.exe Token: SeIncBasePriorityPrivilege 2008 wmi.exe Token: SeIncBasePriorityPrivilege 2956 wmi.exe Token: SeIncBasePriorityPrivilege 2504 wmi.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2304 wrote to memory of 2020 2304 db2a29365fa49dea85f6ffe5ef3dd98d_JaffaCakes118.exe 30 PID 2304 wrote to memory of 2020 2304 db2a29365fa49dea85f6ffe5ef3dd98d_JaffaCakes118.exe 30 PID 2304 wrote to memory of 2020 2304 db2a29365fa49dea85f6ffe5ef3dd98d_JaffaCakes118.exe 30 PID 2304 wrote to memory of 2020 2304 db2a29365fa49dea85f6ffe5ef3dd98d_JaffaCakes118.exe 30 PID 2020 wrote to memory of 2336 2020 wmi.exe 31 PID 2020 wrote to memory of 2336 2020 wmi.exe 31 PID 2020 wrote to memory of 2336 2020 wmi.exe 31 PID 2020 wrote to memory of 2336 2020 wmi.exe 31 PID 2336 wrote to memory of 2816 2336 wmi.exe 32 PID 2336 wrote to memory of 2816 2336 wmi.exe 32 PID 2336 wrote to memory of 2816 2336 wmi.exe 32 PID 2336 wrote to memory of 2816 2336 wmi.exe 32 PID 2816 wrote to memory of 3000 2816 wmi.exe 33 PID 2816 wrote to memory of 3000 2816 wmi.exe 33 PID 2816 wrote to memory of 3000 2816 wmi.exe 33 PID 2816 wrote to memory of 3000 2816 wmi.exe 33 PID 3000 wrote to memory of 2908 3000 wmi.exe 34 PID 3000 wrote to memory of 2908 3000 wmi.exe 34 PID 3000 wrote to memory of 2908 3000 wmi.exe 34 PID 3000 wrote to memory of 2908 3000 wmi.exe 34 PID 2908 wrote to memory of 2732 2908 wmi.exe 35 PID 2908 wrote to memory of 2732 2908 wmi.exe 35 PID 2908 wrote to memory of 2732 2908 wmi.exe 35 PID 2908 wrote to memory of 2732 2908 wmi.exe 35 PID 2732 wrote to memory of 2684 2732 wmi.exe 36 PID 2732 wrote to memory of 2684 2732 wmi.exe 36 PID 2732 wrote to memory of 2684 2732 wmi.exe 36 PID 2732 wrote to memory of 2684 2732 wmi.exe 36 PID 2684 wrote to memory of 1852 2684 wmi.exe 37 PID 2684 wrote to memory of 1852 2684 wmi.exe 37 PID 2684 wrote to memory of 1852 2684 wmi.exe 37 PID 2684 wrote to memory of 1852 2684 wmi.exe 37 PID 1852 wrote to memory of 912 1852 wmi.exe 38 PID 1852 wrote to memory of 912 1852 wmi.exe 38 PID 1852 wrote to memory of 912 1852 wmi.exe 38 PID 1852 wrote to memory of 912 1852 wmi.exe 38 PID 912 wrote to memory of 2680 912 wmi.exe 39 PID 912 wrote to memory of 2680 912 wmi.exe 39 PID 912 wrote to memory of 2680 912 wmi.exe 39 PID 912 wrote to memory of 2680 912 wmi.exe 39 PID 2680 wrote to memory of 2708 2680 wmi.exe 40 PID 2680 wrote to memory of 2708 2680 wmi.exe 40 PID 2680 wrote to memory of 2708 2680 wmi.exe 40 PID 2680 wrote to memory of 2708 2680 wmi.exe 40 PID 2708 wrote to memory of 3056 2708 wmi.exe 41 PID 2708 wrote to memory of 3056 2708 wmi.exe 41 PID 2708 wrote to memory of 3056 2708 wmi.exe 41 PID 2708 wrote to memory of 3056 2708 wmi.exe 41 PID 3056 wrote to memory of 1648 3056 wmi.exe 42 PID 3056 wrote to memory of 1648 3056 wmi.exe 42 PID 3056 wrote to memory of 1648 3056 wmi.exe 42 PID 3056 wrote to memory of 1648 3056 wmi.exe 42 PID 1648 wrote to memory of 1784 1648 wmi.exe 43 PID 1648 wrote to memory of 1784 1648 wmi.exe 43 PID 1648 wrote to memory of 1784 1648 wmi.exe 43 PID 1648 wrote to memory of 1784 1648 wmi.exe 43 PID 1784 wrote to memory of 1572 1784 wmi.exe 44 PID 1784 wrote to memory of 1572 1784 wmi.exe 44 PID 1784 wrote to memory of 1572 1784 wmi.exe 44 PID 1784 wrote to memory of 1572 1784 wmi.exe 44 PID 1572 wrote to memory of 2296 1572 wmi.exe 45 PID 1572 wrote to memory of 2296 1572 wmi.exe 45 PID 1572 wrote to memory of 2296 1572 wmi.exe 45 PID 1572 wrote to memory of 2296 1572 wmi.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\db2a29365fa49dea85f6ffe5ef3dd98d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\db2a29365fa49dea85f6ffe5ef3dd98d_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2296 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2416 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:640 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2244 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2544 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2604 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2144 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:448 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2224 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2800 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:876 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1320 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1440 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1308 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1480 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2980 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:840 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:748 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2036 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1324 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2480 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1608 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1436 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1836 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3040 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe42⤵
- Executes dropped EXE
PID:2332 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1660 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2272 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2584 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2556 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2712 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2404 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2904 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2772 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2252 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2736 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2648 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2668 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2636 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2632 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1872 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2316 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:676 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:988 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2228 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:796 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2008 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2956 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe65⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2504 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe66⤵PID:2716
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe67⤵PID:1404
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe68⤵PID:1056
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe69⤵PID:588
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe70⤵
- Drops file in System32 directory
PID:2964 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe71⤵PID:2372
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe72⤵PID:2032
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe73⤵PID:916
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe74⤵PID:1848
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe75⤵PID:1956
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe76⤵PID:1300
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe77⤵PID:576
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe78⤵PID:1700
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe79⤵PID:1612
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe80⤵PID:1420
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe81⤵PID:632
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe82⤵
- System Location Discovery: System Language Discovery
PID:1656 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe83⤵PID:2148
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe84⤵
- Drops file in System32 directory
PID:2580 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe85⤵PID:2208
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe86⤵PID:872
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe87⤵PID:3032
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe88⤵
- Drops file in System32 directory
PID:2528 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe89⤵PID:1980
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe90⤵PID:1984
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe91⤵PID:2288
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe92⤵PID:2776
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe93⤵PID:2768
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe94⤵
- System Location Discovery: System Language Discovery
PID:2920 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe95⤵PID:2340
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe96⤵PID:2652
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe97⤵PID:2488
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe98⤵PID:1860
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe99⤵PID:1232
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe100⤵PID:1408
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe101⤵PID:1708
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe102⤵PID:2880
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe103⤵PID:352
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe104⤵PID:1204
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe105⤵PID:2108
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe106⤵PID:1616
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe107⤵PID:1036
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe108⤵PID:1732
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe109⤵PID:1092
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe110⤵PID:1228
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe111⤵PID:820
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe112⤵PID:1940
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe113⤵
- Drops file in System32 directory
PID:328 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe114⤵PID:2260
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe115⤵PID:1644
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe116⤵PID:1220
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe117⤵PID:3008
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe118⤵PID:2056
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe119⤵
- System Location Discovery: System Language Discovery
PID:784 -
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe120⤵PID:2328
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe121⤵PID:2848
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe122⤵PID:1584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-