Analysis
-
max time kernel
132s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14-09-2024 07:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dfbc47457506f1f84d558fbbf2ed5ae8_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
12 signatures
150 seconds
General
-
Target
dfbc47457506f1f84d558fbbf2ed5ae8_JaffaCakes118.exe
-
Size
141KB
-
MD5
dfbc47457506f1f84d558fbbf2ed5ae8
-
SHA1
306923228a4f1f3af2e3a03446c9c29a97b8154f
-
SHA256
20aae5039a0d9aacc4290b645af3b608c225e40d6640e8fec0170543d2d16678
-
SHA512
5a144f8b71eaf9fdd72fbf1e0533dfe459e5e7d0ee78ad409ac72babf0b05dab52ae5d9d1ef80389b025da5c84dfa6c2d524667a826939d6ac7fc6fde8ba48d9
-
SSDEEP
3072:YQ4XIcqkHOZpbrZ3icN5JVn23PW2IQrmequ2I5:NUIcpOZpbrZS6Z23vri
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Deletes itself 1 IoCs
pid Process 2148 wiacmfgr.exe -
Executes dropped EXE 64 IoCs
pid Process 2752 wiacmfgr.exe 2148 wiacmfgr.exe 3032 wiacmfgr.exe 3052 wiacmfgr.exe 2932 wiacmfgr.exe 3044 wiacmfgr.exe 108 wiacmfgr.exe 2068 wiacmfgr.exe 596 wiacmfgr.exe 1624 wiacmfgr.exe 1772 wiacmfgr.exe 1152 wiacmfgr.exe 1920 wiacmfgr.exe 2188 wiacmfgr.exe 2944 wiacmfgr.exe 2004 wiacmfgr.exe 1916 wiacmfgr.exe 1020 wiacmfgr.exe 1548 wiacmfgr.exe 2420 wiacmfgr.exe 2512 wiacmfgr.exe 2028 wiacmfgr.exe 1868 wiacmfgr.exe 600 wiacmfgr.exe 1564 wiacmfgr.exe 2704 wiacmfgr.exe 2812 wiacmfgr.exe 2820 wiacmfgr.exe 2900 wiacmfgr.exe 2588 wiacmfgr.exe 2592 wiacmfgr.exe 1756 wiacmfgr.exe 2884 wiacmfgr.exe 3028 wiacmfgr.exe 2656 wiacmfgr.exe 1716 wiacmfgr.exe 1244 wiacmfgr.exe 580 wiacmfgr.exe 1680 wiacmfgr.exe 2736 wiacmfgr.exe 2388 wiacmfgr.exe 2116 wiacmfgr.exe 2160 wiacmfgr.exe 1792 wiacmfgr.exe 1988 wiacmfgr.exe 2984 wiacmfgr.exe 1056 wiacmfgr.exe 1708 wiacmfgr.exe 2412 wiacmfgr.exe 1480 wiacmfgr.exe 2080 wiacmfgr.exe 3000 wiacmfgr.exe 3068 wiacmfgr.exe 2332 wiacmfgr.exe 3012 wiacmfgr.exe 2344 wiacmfgr.exe 2668 wiacmfgr.exe 2688 wiacmfgr.exe 2272 wiacmfgr.exe 2756 wiacmfgr.exe 2616 wiacmfgr.exe 2532 wiacmfgr.exe 1724 wiacmfgr.exe 2880 wiacmfgr.exe -
Loads dropped DLL 64 IoCs
pid Process 2212 dfbc47457506f1f84d558fbbf2ed5ae8_JaffaCakes118.exe 2212 dfbc47457506f1f84d558fbbf2ed5ae8_JaffaCakes118.exe 2752 wiacmfgr.exe 2148 wiacmfgr.exe 2148 wiacmfgr.exe 3052 wiacmfgr.exe 3052 wiacmfgr.exe 3044 wiacmfgr.exe 3044 wiacmfgr.exe 2068 wiacmfgr.exe 2068 wiacmfgr.exe 1624 wiacmfgr.exe 1624 wiacmfgr.exe 1152 wiacmfgr.exe 1152 wiacmfgr.exe 2188 wiacmfgr.exe 2188 wiacmfgr.exe 2004 wiacmfgr.exe 2004 wiacmfgr.exe 1020 wiacmfgr.exe 1020 wiacmfgr.exe 2420 wiacmfgr.exe 2420 wiacmfgr.exe 2028 wiacmfgr.exe 2028 wiacmfgr.exe 600 wiacmfgr.exe 600 wiacmfgr.exe 2704 wiacmfgr.exe 2704 wiacmfgr.exe 2820 wiacmfgr.exe 2820 wiacmfgr.exe 2588 wiacmfgr.exe 2588 wiacmfgr.exe 1756 wiacmfgr.exe 1756 wiacmfgr.exe 3028 wiacmfgr.exe 3028 wiacmfgr.exe 1716 wiacmfgr.exe 1716 wiacmfgr.exe 580 wiacmfgr.exe 580 wiacmfgr.exe 2736 wiacmfgr.exe 2736 wiacmfgr.exe 2116 wiacmfgr.exe 2116 wiacmfgr.exe 1792 wiacmfgr.exe 1792 wiacmfgr.exe 2984 wiacmfgr.exe 2984 wiacmfgr.exe 1708 wiacmfgr.exe 1708 wiacmfgr.exe 1480 wiacmfgr.exe 1480 wiacmfgr.exe 3000 wiacmfgr.exe 3000 wiacmfgr.exe 2332 wiacmfgr.exe 2332 wiacmfgr.exe 2344 wiacmfgr.exe 2344 wiacmfgr.exe 2688 wiacmfgr.exe 2688 wiacmfgr.exe 2756 wiacmfgr.exe 2756 wiacmfgr.exe 2532 wiacmfgr.exe -
resource yara_rule behavioral1/memory/2212-0-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2212-5-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2212-6-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2212-7-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2212-20-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2148-28-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2148-29-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2148-30-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2148-36-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/3052-49-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/3044-55-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/3044-56-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/3044-62-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2068-67-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2068-69-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2068-74-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/1624-78-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/1624-82-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/1624-83-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/1624-89-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/1152-102-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2188-116-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2004-129-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/1020-143-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2420-156-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2028-169-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/600-183-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2704-195-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2820-204-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2588-213-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/1756-222-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/3028-231-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/1716-240-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/580-249-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2736-258-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2116-267-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/1792-276-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2984-285-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/1708-294-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/1480-303-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/3000-312-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2332-321-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2344-333-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2688-342-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2756-351-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2532-360-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2880-369-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/3048-378-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/1664-387-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/1568-396-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/1836-405-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/1972-414-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2516-423-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/940-432-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/1632-441-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2424-450-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/904-459-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2700-468-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2808-477-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2676-486-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/3036-495-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2836-504-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2236-513-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral1/memory/2396-522-0x0000000000400000-0x0000000000463000-memory.dmp upx -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA dfbc47457506f1f84d558fbbf2ed5ae8_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wiacmfgr.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe dfbc47457506f1f84d558fbbf2ed5ae8_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe dfbc47457506f1f84d558fbbf2ed5ae8_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File created C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe File opened for modification C:\Windows\SysWOW64\wiacmfgr.exe wiacmfgr.exe -
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 2308 set thread context of 2212 2308 dfbc47457506f1f84d558fbbf2ed5ae8_JaffaCakes118.exe 31 PID 2752 set thread context of 2148 2752 wiacmfgr.exe 33 PID 3032 set thread context of 3052 3032 wiacmfgr.exe 35 PID 2932 set thread context of 3044 2932 wiacmfgr.exe 37 PID 108 set thread context of 2068 108 wiacmfgr.exe 39 PID 596 set thread context of 1624 596 wiacmfgr.exe 41 PID 1772 set thread context of 1152 1772 wiacmfgr.exe 43 PID 1920 set thread context of 2188 1920 wiacmfgr.exe 45 PID 2944 set thread context of 2004 2944 wiacmfgr.exe 47 PID 1916 set thread context of 1020 1916 wiacmfgr.exe 49 PID 1548 set thread context of 2420 1548 wiacmfgr.exe 51 PID 2512 set thread context of 2028 2512 wiacmfgr.exe 53 PID 1868 set thread context of 600 1868 wiacmfgr.exe 55 PID 1564 set thread context of 2704 1564 wiacmfgr.exe 57 PID 2812 set thread context of 2820 2812 wiacmfgr.exe 59 PID 2900 set thread context of 2588 2900 wiacmfgr.exe 61 PID 2592 set thread context of 1756 2592 wiacmfgr.exe 63 PID 2884 set thread context of 3028 2884 wiacmfgr.exe 65 PID 2656 set thread context of 1716 2656 wiacmfgr.exe 67 PID 1244 set thread context of 580 1244 wiacmfgr.exe 69 PID 1680 set thread context of 2736 1680 wiacmfgr.exe 71 PID 2388 set thread context of 2116 2388 wiacmfgr.exe 73 PID 2160 set thread context of 1792 2160 wiacmfgr.exe 75 PID 1988 set thread context of 2984 1988 wiacmfgr.exe 77 PID 1056 set thread context of 1708 1056 wiacmfgr.exe 79 PID 2412 set thread context of 1480 2412 wiacmfgr.exe 81 PID 2080 set thread context of 3000 2080 wiacmfgr.exe 83 PID 3068 set thread context of 2332 3068 wiacmfgr.exe 85 PID 3012 set thread context of 2344 3012 wiacmfgr.exe 87 PID 2668 set thread context of 2688 2668 wiacmfgr.exe 89 PID 2272 set thread context of 2756 2272 wiacmfgr.exe 91 PID 2616 set thread context of 2532 2616 wiacmfgr.exe 93 PID 1724 set thread context of 2880 1724 wiacmfgr.exe 95 PID 1508 set thread context of 3048 1508 wiacmfgr.exe 97 PID 1392 set thread context of 1664 1392 wiacmfgr.exe 99 PID 480 set thread context of 1568 480 wiacmfgr.exe 101 PID 2440 set thread context of 1836 2440 wiacmfgr.exe 103 PID 2136 set thread context of 1972 2136 wiacmfgr.exe 105 PID 1260 set thread context of 2516 1260 wiacmfgr.exe 107 PID 1056 set thread context of 940 1056 wiacmfgr.exe 109 PID 1000 set thread context of 1632 1000 wiacmfgr.exe 111 PID 1264 set thread context of 2424 1264 wiacmfgr.exe 113 PID 2444 set thread context of 904 2444 wiacmfgr.exe 115 PID 2072 set thread context of 2700 2072 wiacmfgr.exe 117 PID 2664 set thread context of 2808 2664 wiacmfgr.exe 119 PID 568 set thread context of 2676 568 wiacmfgr.exe 121 PID 1740 set thread context of 3036 1740 wiacmfgr.exe 123 PID 2884 set thread context of 2836 2884 wiacmfgr.exe 125 PID 2656 set thread context of 2236 2656 wiacmfgr.exe 127 PID 684 set thread context of 2396 684 wiacmfgr.exe 129 PID 2868 set thread context of 1840 2868 wiacmfgr.exe 131 PID 1316 set thread context of 2388 1316 wiacmfgr.exe 133 PID 2252 set thread context of 2160 2252 wiacmfgr.exe 135 PID 2060 set thread context of 2192 2060 wiacmfgr.exe 137 PID 2788 set thread context of 3004 2788 wiacmfgr.exe 139 PID 2728 set thread context of 1872 2728 wiacmfgr.exe 141 PID 956 set thread context of 2316 956 wiacmfgr.exe 143 PID 3016 set thread context of 2512 3016 wiacmfgr.exe 145 PID 868 set thread context of 2340 868 wiacmfgr.exe 147 PID 1700 set thread context of 2768 1700 wiacmfgr.exe 149 PID 2812 set thread context of 2172 2812 wiacmfgr.exe 151 PID 2024 set thread context of 2364 2024 wiacmfgr.exe 153 PID 2912 set thread context of 2936 2912 wiacmfgr.exe 155 PID 1428 set thread context of 1128 1428 wiacmfgr.exe 157 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiacmfgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2212 dfbc47457506f1f84d558fbbf2ed5ae8_JaffaCakes118.exe 2148 wiacmfgr.exe 3052 wiacmfgr.exe 3044 wiacmfgr.exe 2068 wiacmfgr.exe 1624 wiacmfgr.exe 1152 wiacmfgr.exe 2188 wiacmfgr.exe 2004 wiacmfgr.exe 1020 wiacmfgr.exe 2420 wiacmfgr.exe 2028 wiacmfgr.exe 600 wiacmfgr.exe 2704 wiacmfgr.exe 2820 wiacmfgr.exe 2588 wiacmfgr.exe 1756 wiacmfgr.exe 3028 wiacmfgr.exe 1716 wiacmfgr.exe 580 wiacmfgr.exe 2736 wiacmfgr.exe 2116 wiacmfgr.exe 1792 wiacmfgr.exe 2984 wiacmfgr.exe 1708 wiacmfgr.exe 1480 wiacmfgr.exe 3000 wiacmfgr.exe 2332 wiacmfgr.exe 2688 wiacmfgr.exe 2756 wiacmfgr.exe 2532 wiacmfgr.exe 2880 wiacmfgr.exe 3048 wiacmfgr.exe 1664 wiacmfgr.exe 1568 wiacmfgr.exe 1836 wiacmfgr.exe 1972 wiacmfgr.exe 2516 wiacmfgr.exe 940 wiacmfgr.exe 1632 wiacmfgr.exe 2424 wiacmfgr.exe 904 wiacmfgr.exe 2700 wiacmfgr.exe 2808 wiacmfgr.exe 2676 wiacmfgr.exe 3036 wiacmfgr.exe 2836 wiacmfgr.exe 2236 wiacmfgr.exe 2396 wiacmfgr.exe 1840 wiacmfgr.exe 2388 wiacmfgr.exe 2160 wiacmfgr.exe 2192 wiacmfgr.exe 3004 wiacmfgr.exe 1872 wiacmfgr.exe 2316 wiacmfgr.exe 2512 wiacmfgr.exe 2340 wiacmfgr.exe 2768 wiacmfgr.exe 2172 wiacmfgr.exe 2364 wiacmfgr.exe 2936 wiacmfgr.exe 1128 wiacmfgr.exe 1276 wiacmfgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2308 wrote to memory of 2212 2308 dfbc47457506f1f84d558fbbf2ed5ae8_JaffaCakes118.exe 31 PID 2308 wrote to memory of 2212 2308 dfbc47457506f1f84d558fbbf2ed5ae8_JaffaCakes118.exe 31 PID 2308 wrote to memory of 2212 2308 dfbc47457506f1f84d558fbbf2ed5ae8_JaffaCakes118.exe 31 PID 2308 wrote to memory of 2212 2308 dfbc47457506f1f84d558fbbf2ed5ae8_JaffaCakes118.exe 31 PID 2308 wrote to memory of 2212 2308 dfbc47457506f1f84d558fbbf2ed5ae8_JaffaCakes118.exe 31 PID 2308 wrote to memory of 2212 2308 dfbc47457506f1f84d558fbbf2ed5ae8_JaffaCakes118.exe 31 PID 2308 wrote to memory of 2212 2308 dfbc47457506f1f84d558fbbf2ed5ae8_JaffaCakes118.exe 31 PID 2308 wrote to memory of 2212 2308 dfbc47457506f1f84d558fbbf2ed5ae8_JaffaCakes118.exe 31 PID 2308 wrote to memory of 2212 2308 dfbc47457506f1f84d558fbbf2ed5ae8_JaffaCakes118.exe 31 PID 2308 wrote to memory of 2212 2308 dfbc47457506f1f84d558fbbf2ed5ae8_JaffaCakes118.exe 31 PID 2308 wrote to memory of 2212 2308 dfbc47457506f1f84d558fbbf2ed5ae8_JaffaCakes118.exe 31 PID 2212 wrote to memory of 2752 2212 dfbc47457506f1f84d558fbbf2ed5ae8_JaffaCakes118.exe 32 PID 2212 wrote to memory of 2752 2212 dfbc47457506f1f84d558fbbf2ed5ae8_JaffaCakes118.exe 32 PID 2212 wrote to memory of 2752 2212 dfbc47457506f1f84d558fbbf2ed5ae8_JaffaCakes118.exe 32 PID 2212 wrote to memory of 2752 2212 dfbc47457506f1f84d558fbbf2ed5ae8_JaffaCakes118.exe 32 PID 2752 wrote to memory of 2148 2752 wiacmfgr.exe 33 PID 2752 wrote to memory of 2148 2752 wiacmfgr.exe 33 PID 2752 wrote to memory of 2148 2752 wiacmfgr.exe 33 PID 2752 wrote to memory of 2148 2752 wiacmfgr.exe 33 PID 2752 wrote to memory of 2148 2752 wiacmfgr.exe 33 PID 2752 wrote to memory of 2148 2752 wiacmfgr.exe 33 PID 2752 wrote to memory of 2148 2752 wiacmfgr.exe 33 PID 2752 wrote to memory of 2148 2752 wiacmfgr.exe 33 PID 2752 wrote to memory of 2148 2752 wiacmfgr.exe 33 PID 2752 wrote to memory of 2148 2752 wiacmfgr.exe 33 PID 2752 wrote to memory of 2148 2752 wiacmfgr.exe 33 PID 2148 wrote to memory of 3032 2148 wiacmfgr.exe 34 PID 2148 wrote to memory of 3032 2148 wiacmfgr.exe 34 PID 2148 wrote to memory of 3032 2148 wiacmfgr.exe 34 PID 2148 wrote to memory of 3032 2148 wiacmfgr.exe 34 PID 3032 wrote to memory of 3052 3032 wiacmfgr.exe 35 PID 3032 wrote to memory of 3052 3032 wiacmfgr.exe 35 PID 3032 wrote to memory of 3052 3032 wiacmfgr.exe 35 PID 3032 wrote to memory of 3052 3032 wiacmfgr.exe 35 PID 3032 wrote to memory of 3052 3032 wiacmfgr.exe 35 PID 3032 wrote to memory of 3052 3032 wiacmfgr.exe 35 PID 3032 wrote to memory of 3052 3032 wiacmfgr.exe 35 PID 3032 wrote to memory of 3052 3032 wiacmfgr.exe 35 PID 3032 wrote to memory of 3052 3032 wiacmfgr.exe 35 PID 3032 wrote to memory of 3052 3032 wiacmfgr.exe 35 PID 3032 wrote to memory of 3052 3032 wiacmfgr.exe 35 PID 3052 wrote to memory of 2932 3052 wiacmfgr.exe 36 PID 3052 wrote to memory of 2932 3052 wiacmfgr.exe 36 PID 3052 wrote to memory of 2932 3052 wiacmfgr.exe 36 PID 3052 wrote to memory of 2932 3052 wiacmfgr.exe 36 PID 2932 wrote to memory of 3044 2932 wiacmfgr.exe 37 PID 2932 wrote to memory of 3044 2932 wiacmfgr.exe 37 PID 2932 wrote to memory of 3044 2932 wiacmfgr.exe 37 PID 2932 wrote to memory of 3044 2932 wiacmfgr.exe 37 PID 2932 wrote to memory of 3044 2932 wiacmfgr.exe 37 PID 2932 wrote to memory of 3044 2932 wiacmfgr.exe 37 PID 2932 wrote to memory of 3044 2932 wiacmfgr.exe 37 PID 2932 wrote to memory of 3044 2932 wiacmfgr.exe 37 PID 2932 wrote to memory of 3044 2932 wiacmfgr.exe 37 PID 2932 wrote to memory of 3044 2932 wiacmfgr.exe 37 PID 2932 wrote to memory of 3044 2932 wiacmfgr.exe 37 PID 3044 wrote to memory of 108 3044 wiacmfgr.exe 38 PID 3044 wrote to memory of 108 3044 wiacmfgr.exe 38 PID 3044 wrote to memory of 108 3044 wiacmfgr.exe 38 PID 3044 wrote to memory of 108 3044 wiacmfgr.exe 38 PID 108 wrote to memory of 2068 108 wiacmfgr.exe 39 PID 108 wrote to memory of 2068 108 wiacmfgr.exe 39 PID 108 wrote to memory of 2068 108 wiacmfgr.exe 39 PID 108 wrote to memory of 2068 108 wiacmfgr.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfbc47457506f1f84d558fbbf2ed5ae8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dfbc47457506f1f84d558fbbf2ed5ae8_JaffaCakes118.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\dfbc47457506f1f84d558fbbf2ed5ae8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dfbc47457506f1f84d558fbbf2ed5ae8_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Users\Admin\AppData\Local\Temp\DFBC47~1.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Users\Admin\AppData\Local\Temp\DFBC47~1.EXE4⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe5⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe9⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2068 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe11⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:596 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1624 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe13⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1772 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1152 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe15⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1920 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2188 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe17⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2944 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2004 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe19⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:1916 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1020 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe21⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:1548 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2420 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2512 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2028 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe25⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:1868 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:600 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe27⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1564 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2704 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2812 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2820 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe31⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:2900 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2588 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe33⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2592 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe34⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1756 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe35⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:2884 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe36⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3028 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe37⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2656 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe38⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1716 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe39⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:1244 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe40⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:580 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1680 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe42⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2736 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe43⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2388 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe44⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2116 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe45⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:2160 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe46⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1792 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe47⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:1988 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe48⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2984 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe49⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:1056 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe50⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1708 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe51⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:2412 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe52⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1480 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe53⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:2080 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe54⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3000 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3068 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe56⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2332 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3012 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe59⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:2668 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe60⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2688 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe61⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:2272 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe62⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2756 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe63⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:2616 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe64⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2532 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe65⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:1724 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe66⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2880 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe67⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1508 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe68⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3048 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe69⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1392 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe70⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1664 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe71⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:480 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe72⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1568 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe73⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:2440 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe74⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1836 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe75⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:2136 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe76⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1972 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe77⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1260 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe78⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2516 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe79⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1056 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe80⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:940 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe81⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1000 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe82⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1632 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe83⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1264 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe84⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2424 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe85⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2444 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe86⤵
- Suspicious behavior: EnumeratesProcesses
PID:904 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe87⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2072 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe88⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2700 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe89⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:2664 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe90⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2808 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe91⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:568 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe92⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2676 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe93⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:1740 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe94⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3036 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe95⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:2884 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe96⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2836 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe97⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2656 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe98⤵
- Suspicious behavior: EnumeratesProcesses
PID:2236 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe99⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:684 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe100⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2396 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe101⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2868 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe102⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1840 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe103⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1316 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe104⤵
- Suspicious behavior: EnumeratesProcesses
PID:2388 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe105⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:2252 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe106⤵
- Suspicious behavior: EnumeratesProcesses
PID:2160 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe107⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2060 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe108⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2192 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe109⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:2788 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe110⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3004 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe111⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:2728 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe112⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1872 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe113⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:956 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe114⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2316 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe115⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3016 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe116⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2512 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe117⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:868 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe118⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2340 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe119⤵
- Suspicious use of SetThreadContext
PID:1700 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe120⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2768 -
C:\Windows\SysWOW64\wiacmfgr.exe"C:\Windows\system32\wiacmfgr.exe" C:\Windows\SysWOW64\wiacmfgr.exe121⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
PID:2812
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-